Cloudflare Domain Management

Why Cloudflare for Domains

Every domain I own goes through Cloudflare, even the ones that don't use the proxy. The DNS propagation is fast, the dashboard is clean, the API is well-documented, and most homelab tools — Traefik, cert-manager, ACME clients — have first-class Cloudflare DNS integration baked in.

DNS Record Types I Use

| Type | Use case | |------|----------| | A | Point a subdomain to an IP address | | CNAME | Alias a subdomain to another hostname | | MX | Mail routing for custom domains | | TXT | SPF, DKIM, and domain ownership verification |

Proxy vs DNS Only

Every record has two modes:

• Proxied (orange cloud) — traffic routes through Cloudflare's edge. Hides origin IP, adds DDoS protection, enables caching. Good for public-facing web services.
• DNS only (grey cloud) — standard DNS, no Cloudflare proxy. Required for non-HTTP services (databases, SSH, anything that's not web traffic) and for services that terminate their own SSL or tunnel through cloudflared.

For homelab services I expose via Cloudflare Tunnel, everything goes proxied. For internal subdomains that only resolve on the local network or go through Pangolin, I leave them DNS-only since the tunnel handles the actual routing.

Subdomain Structure

I use a flat subdomain structure: service.domain.com for everything. One subdomain per service. Clean routing rules in Traefik and Pangolin, easy to reason about, easy to revoke access to a specific service by removing one DNS record.

API Token for Tools

Tools like Traefik need to interact with Cloudflare's DNS API for the ACME DNS-01 challenge (wildcard SSL). Create a scoped token:

1. Dashboard → My Profile → API Tokens → Create Token
2. Use the Edit zone DNS template
3. Restrict the token to the specific zone (your domain)
4. Copy the token and store it in your secrets manager — not in a plaintext config file

This token goes into Traefik's static config as CF_DNS_API_TOKEN. The same token works for any other tool that supports the Cloudflare DNS provider.

Notes

Cloudflare's free tier covers everything I use day-to-day — DNS, proxying, basic analytics, and tunnel support. The paid plans add Workers, advanced analytics, and WAF rules, none of which I've needed for homelab use.