> ## Content Index
> Fetch the complete content index at: https://notes.d4rkcyber.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cloudflare Domain Management
- URL: https://notes.d4rkcyber.com/cloudflare-domain-management/
- Published: 2026-06-02T00:00:00.000Z
- Updated: 2026-10-28T16:57:39.000Z
- Description: How I manage domains through Cloudflare — DNS records, proxy vs DNS-only, API token setup for tools like Traefik, and how this fits the homelab stack.
- Author: David Dami
- Tags: Infrastructure, cloudflare, dns, domains, homelab

## Why Cloudflare for Domains

Every domain I own goes through Cloudflare, even the ones that don't use the proxy. The DNS propagation is fast, the dashboard is clean, the API is well-documented, and most homelab tools — Traefik, cert-manager, ACME clients — have first-class Cloudflare DNS integration baked in.

## DNS Record Types I Use

| **Type** | **Use case**                                 |
| -------- | -------------------------------------------- |
| A        | Point a subdomain to an IP address           |
| CNAME    | Alias a subdomain to another hostname        |
| MX       | Mail routing for custom domains              |
| TXT      | SPF, DKIM, and domain ownership verification |

## Proxy vs DNS Only

Every record has two modes:

- **Proxied (orange cloud)** — traffic routes through Cloudflare's edge. Hides origin IP, adds DDoS protection, enables caching. Good for public-facing web services.
- **DNS only (grey cloud)** — standard DNS, no Cloudflare proxy. Required for non-HTTP services (databases, SSH, anything that's not web traffic) and for services that terminate their own SSL or tunnel through cloudflared.

For homelab services I expose via Cloudflare Tunnel, everything goes proxied. For internal subdomains that only resolve on the local network or go through Pangolin, I leave them DNS-only since the tunnel handles the actual routing.

## Subdomain Structure

I use a flat subdomain structure: `service.domain.com` for everything. One subdomain per service. Clean routing rules in Traefik and Pangolin, easy to reason about, easy to revoke access to a specific service by removing one DNS record.

## API Token for Tools

Tools like Traefik need to interact with Cloudflare's DNS API for the ACME DNS-01 challenge (wildcard SSL). Create a scoped token:

1. Dashboard → My Profile → API Tokens → Create Token
2. Use the **Edit zone DNS** template
3. Restrict the token to the specific zone (your domain)
4. Copy the token and store it in your secrets manager — not in a plaintext config file

This token goes into Traefik's static config as `CF_DNS_API_TOKEN`. The same token works for any other tool that supports the Cloudflare DNS provider.

## Notes

Cloudflare's free tier covers everything I use day-to-day — DNS, proxying, basic analytics, and tunnel support. The paid plans add Workers, advanced analytics, and WAF rules, none of which I've needed for homelab use.