How to Manage DNS Records Using Cloudflare — A Complete Guide

What Is DNS and Why Does It Matter?

DNS — the Domain Name System — is the internet's phonebook. Every website lives on a server with an IP address like 104.21.45.6, but humans can't remember strings of numbers. DNS translates memorable domain names like aniketbhawkar.com into the IP addresses that computers actually use to route your request. Without DNS, the web as we know it would not exist.

DNS matters because every single request your browser makes — loading a page, sending an email, connecting an app — passes through a DNS lookup. Slow or misconfigured DNS results in slow page loads, failed email delivery, and broken services. Good DNS management means fast lookups, correct record settings, and zero downtime when you change hosting providers or add new services.

How Cloudflare DNS Differs from Your Registrar's DNS

When you buy a domain from a registrar like Namecheap, GoDaddy, or Google Domains, the registrar gives you basic DNS management. It works, but it is slow, offers no caching, and provides zero security features. Cloudflare replaces your registrar's nameservers with its own global anycast network — the result is DNS resolution up to 28% faster on average than the next fastest provider.

The biggest difference with Cloudflare is the orange cloud toggle. Records can be set to Proxied (orange cloud) or DNS-only (grey cloud). When proxied, your real server IP is hidden behind Cloudflare's edge network. Traffic passes through Cloudflare first, enabling their CDN, DDoS protection, firewall, and caching features. When set to DNS-only, Cloudflare simply resolves the IP — no proxy, no CDN, no firewall. Mail records (MX), TXT, and NS records should always remain DNS-only; A and CNAME records pointing to your web server should usually be proxied.

DNS Record Types Explained — With Real Use Cases

A Record — Map Your Domain to an IPv4 Address

The A record is the most fundamental DNS record. It points your domain name directly to an IPv4 address. For example, you would create an A record where the Name is @ (representing the root domain, e.g. aniketbhawkar.com) and the Content is your server's IPv4 address such as 1.2.3.4. If you also want www.aniketbhawkar.com to resolve to the same IP, add a second A record with Name set to www.

Common use: pointing your domain to a VPS, a dedicated server, or a static IP from your hosting provider. When you change hosting providers, updating the A record's IP address is typically all that is needed to point traffic to your new server.

AAAA Record — Map Your Domain to an IPv6 Address

The AAAA record works identically to an A record but for IPv6 addresses, which look like 2400:cb00:2048:1::c629:d7a2. IPv6 adoption is growing and having an AAAA record alongside your A record ensures visitors on IPv6-only networks can still reach your site. Most hosting providers give you both an IPv4 and IPv6 address — add both record types.

CNAME Record — Create an Alias for a Domain

A CNAME (Canonical Name) record creates an alias that points one hostname to another hostname rather than an IP address. The classic use case is making www.aniketbhawkar.com point to aniketbhawkar.com. You set Name to www and Content to aniketbhawkar.com. Cloudflare then resolves that root domain to its IP on behalf of the visitor.

Other common CNAME uses: pointing a subdomain like shop.aniketbhawkar.com to a Shopify store URL, pointing mail.aniketbhawkar.com to a mail server hostname, or pointing blog.aniketbhawkar.com to a Ghost or Substack publication. Important: you cannot use a CNAME on the root domain (@) with standard DNS — but Cloudflare solves this with CNAME Flattening, which automatically converts the CNAME to an A record at the apex.

MX Record — Route Email to the Right Mail Server

MX (Mail Exchanger) records tell the internet where to deliver email for your domain. Without correct MX records, nobody can send email to your @yourdomain.com addresses. Each MX record has a priority number — lower numbers are tried first. If you are setting up Google Workspace, you add five MX records all pointing to Google's mail servers with their specified priorities:

Priority 1: ASPMX.L.GOOGLE.COM
Priority 5: ALT1.ASPMX.L.GOOGLE.COM
Priority 5: ALT2.ASPMX.L.GOOGLE.COM
Priority 10: ALT3.ASPMX.L.GOOGLE.COM
Priority 10: ALT4.ASPMX.L.GOOGLE.COM

For Zoho Mail, the setup differs — Zoho typically uses two MX records: mx.zoho.com at priority 10 and mx2.zoho.com at priority 20. Always check your mail provider's exact setup guide. MX records must always be DNS-only (grey cloud) — never proxy them.

TXT Record — Verification and Email Authentication

TXT records hold plain text data and serve multiple important purposes. The two most common are domain verification and email authentication (SPF and DKIM).

Domain verification: When you add your site to Google Search Console, Google asks you to add a TXT record like google-site-verification=abc123xyz at your root domain. This proves you own the domain without changing any visible content.

SPF (Sender Policy Framework): An SPF record tells receiving mail servers which IP addresses are allowed to send email on behalf of your domain. Without it, your emails are far more likely to land in spam. For Google Workspace, the SPF TXT record at your root domain would be: v=spf1 include:_spf.google.com ~all. For sending via multiple providers (e.g. Google and Mailchimp), you combine them: v=spf1 include:_spf.google.com include:servers.mcsv.net ~all. You can only have one SPF record per domain.

DKIM (DomainKeys Identified Mail): DKIM adds a cryptographic signature to your outgoing emails. Mail providers generate a public key that you publish as a TXT record at a specific subdomain like google._domainkey.aniketbhawkar.com. The value is a long string like v=DKIM1; k=rsa; p=MIGfMA0GCS.... Your mail provider will supply the exact value to copy in.

NS Record — Nameserver Records

NS (Nameserver) records tell the internet which DNS servers are authoritative for your domain. When you add your domain to Cloudflare, it gives you two custom nameservers like amos.ns.cloudflare.com and vera.ns.cloudflare.com. You enter these at your domain registrar. Once propagated, all DNS queries for your domain will go to Cloudflare's nameservers. Never delete your NS records — doing so will take your entire domain offline.

SRV Record — Service Location Records

SRV records specify the host and port for specific services, used by certain applications rather than websites. Common uses include Microsoft Teams/Skype for Business autodiscovery, game servers, and VoIP providers like Twilio. An SRV record has a Service, Protocol, Priority, Weight, Port, and Target. For example, for SIP over TCP you might see: Service _sip, Protocol _tcp, Priority 10, Weight 20, Port 5060, Target sip.yourdomain.com. Most website owners will never need SRV records unless running services that specifically require them.

Step-by-Step: Logging In and Navigating to DNS

Go to dash.cloudflare.com and sign in with your Cloudflare credentials.
On the dashboard home page, you will see all your websites listed. Click on the domain you want to manage.
In the left sidebar, click DNS, then click Records. This is the DNS management page where all your records are listed.
You will see a table of all existing records with columns for Type, Name, Content, Proxy status, and TTL.

How to Add a New DNS Record — A, CNAME, and MX Examples

On the DNS Records page, click the blue Add record button. A form will appear at the top of the record table. Here is how to fill it in for three common record types:

Adding an A Record

Type: Select A from the dropdown.
Name: Enter @ for the root domain, or a subdomain like mail for mail.yourdomain.com.
IPv4 address: Enter your server's IP address, e.g. 1.2.3.4.
Proxy status: Toggle to Proxied (orange cloud) if you want Cloudflare to protect and accelerate your site. Use DNS only (grey cloud) if you need the raw IP exposed (e.g. for SSH access).
TTL: Leave as Auto when proxied. For DNS-only records, set TTL to 300 seconds (5 minutes) if you anticipate changing the value soon, or 3600 (1 hour) for stable records.
Click Save.

Adding a CNAME Record

Type: Select CNAME.
Name: Enter www (to create www.yourdomain.com) or any subdomain like shop.
Target: Enter the destination hostname, e.g. aniketbhawkar.com or yourstore.myshopify.com.
Proxy status: Proxied for web subdomains; DNS only for mail-related subdomains.
Click Save.

Adding an MX Record

Type: Select MX.
Name: Enter @ (MX records always apply to the root domain).
Mail server: Enter the mail server hostname provided by your email provider, e.g. ASPMX.L.GOOGLE.COM.
Priority: Enter the priority number specified by your provider, e.g. 1.
Proxy status: MX records are always DNS only — you cannot proxy mail.
Click Save. Repeat for each MX record your mail provider requires.

Proxied (Orange Cloud) vs DNS-Only (Grey Cloud) — When to Use Each

This is one of the most important concepts in Cloudflare. The proxy toggle controls whether traffic flows through Cloudflare's edge network or goes straight to your server.

Use Proxied (orange cloud) when: You want Cloudflare's full suite of features for your web server — CDN caching, DDoS mitigation, the Web Application Firewall, rate limiting, and IP masking. Your real server IP stays hidden from the public internet. This applies to A and CNAME records pointing to web servers. When proxied, TTL is locked at "Auto" (typically 300 seconds) because Cloudflare manages it.

Use DNS-only (grey cloud) when: The service cannot run behind a proxy — for example, mail (MX), FTP servers, game servers, custom TCP/UDP services, and any non-HTTP/HTTPS service. Also use DNS-only when debugging to confirm whether an issue is with Cloudflare or your origin server. When DNS-only, your server's real IP is publicly visible in DNS responses.

What Proxied enables specifically: CDN caching (static assets cached at Cloudflare's 300+ data centres worldwide), DDoS protection (automatic mitigation of volumetric attacks), the WAF (block SQL injection, XSS, and other OWASP top 10 threats), Bot Management, SSL/TLS termination at the edge, and the ability to use Cloudflare Workers for serverless logic at the edge.

DNS Propagation — What It Is and How Long It Takes

DNS propagation is the time it takes for a DNS change to spread across all the DNS resolvers on the internet. When you update a record in Cloudflare, the change is immediate within Cloudflare's own network. However, ISPs, corporate networks, and other resolvers around the world cache DNS records based on their TTL value. Until those caches expire, some visitors may still see your old DNS records.

Propagation typically completes within a few minutes for Cloudflare-proxied records (because Cloudflare controls the TTL), but for DNS-only records with a TTL of 3600 seconds (1 hour), it can take up to an hour for most resolvers to update, and in rare cases up to 48 hours for some stubborn ISP resolvers in certain regions.

How to check propagation: Use whatsmydns.net to see how your record looks from servers in different countries simultaneously. You can also use the command line tool dig:

dig aniketbhawkar.com A

This returns the current A record as seen from your location. To query a specific nameserver directly:

dig @8.8.8.8 aniketbhawkar.com A

The @8.8.8.8 specifies Google's public DNS resolver. Querying multiple resolvers gives you a clear picture of propagation progress.

Common DNS Tasks — Step by Step

Pointing Your Domain to a New Hosting Provider

Get the new server's IP address from your new host's control panel.
In Cloudflare DNS, find your existing A record for @.
Click the Edit (pencil) icon next to the record.
Replace the old IP with the new IP address.
Click Save. The update takes effect within seconds on Cloudflare's network.

Adding a Subdomain

Click Add record in Cloudflare DNS.
Select the record type — usually A (if pointing to an IP) or CNAME (if pointing to another hostname).
Enter the subdomain name (e.g. staging to create staging.aniketbhawkar.com).
Enter the IP or hostname it should resolve to.
Set proxy status and click Save.

Setting Up Email — Adding MX Records

Before deleting old MX records, export or note them down. Then:

Delete any existing MX records pointing to your old mail server by clicking the Delete (trash) icon.
Add each new MX record as described in the section above, using the exact hostnames and priorities from your new mail provider.
Also add the TXT records your mail provider requires (SPF, DKIM, DMARC). These are separate from the MX records but equally important for email deliverability.
Test by sending a test email from an external account (Gmail, Outlook) to your domain address. Use mxtoolbox.com to verify your MX records are correctly published.

Adding SPF and DKIM for Email Deliverability

Poor email deliverability is one of the most common problems for new domain owners. Without SPF and DKIM, your emails will land in spam or be rejected outright. Here is a basic setup:

SPF: Add a TXT record at @ with value v=spf1 include:_spf.google.com ~all (adjust for your mail provider). Only ever have one SPF TXT record at the root.
DKIM: Your mail provider will generate a DKIM key pair and give you a TXT record to add at a specific subdomain like google._domainkey. Copy the value exactly — even one character wrong will break DKIM verification.
DMARC: Add a TXT record at _dmarc with a value like v=DMARC1; p=none; rua=mailto:[email protected]. Start with p=none (monitor only) and move to p=quarantine or p=reject after confirming legitimate email passes SPF and DKIM checks.

Common DNS Mistakes and How to Avoid Them

Wrong TTL settings: Leaving TTL at 86400 (24 hours) when you are about to make changes means visitors could be stuck on old records for a full day. Lower TTL to 300 seconds at least an hour before making a change, then raise it back after confirming the change is correct.
Forgetting to proxy web records: Many people add Cloudflare to their domain but leave all records as DNS-only, missing out on all of Cloudflare's security and performance features. Toggle A records and CNAME records pointing to your web server to Proxied.
Deleting NS records: NS records are auto-managed by Cloudflare and must never be manually deleted. Deleting your nameserver records would make your domain unresolvable for everyone on the internet.
Misconfiguring MX records: The most common MX mistake is entering the wrong priority numbers, putting an IP address instead of a hostname, or accidentally proxying the MX record (which breaks email). Always verify with mxtoolbox.com after any MX change.
Multiple conflicting SPF records: Having two TXT records that both start with v=spf1 at the root domain causes SPF validation to fail entirely. If you need to add multiple sending services, combine them into a single SPF record.
Not waiting for propagation before testing: If you test from the same device immediately after making a change, your local DNS cache may still return old values. Clear your local DNS cache (ipconfig /flushdns on Windows, sudo dscacheutil -flushcache on Mac) or use a tool like whatsmydns.net to verify from multiple locations.

You may also find it useful to read about how to block countries using Cloudflare's firewall.