What's the difference between Cloudflare's orange cloud and grey cloud?

Grey means plain DNS — Cloudflare just answers the query. Orange means proxied: HTTP(S) traffic to that hostname routes through Cloudflare's network first, enabling its CDN, WAF and DDoS protection. Proxying only ever affects HTTP and HTTPS traffic, nothing else.

Why did email stop working after I moved my domain to Cloudflare?

MX records can't be proxied at all, but the A record an MX target depends on can be — and if it is, incoming mail servers try to deliver to Cloudflare's proxy IP over SMTP, which doesn't work. That specific A record needs to stay grey-clouded.

Do I need to do anything extra to enable DNSSEC on Cloudflare?

Yes — enabling it in the dashboard is one click, but you then have to add the DS record Cloudflare generates at your domain's registrar. Skipping that leaves DNSSEC half-enabled, which shows as a validation error rather than protection.

Setting Up a Domain on Cloudflare: The DNS Pitfalls

Cloudflare's DNS dashboard looks like any other, with one extra control that changes what a record actually does: the proxy toggle. Getting it wrong on the right record is the single most common way a Cloudflare migration breaks something.

Orange Cloud vs. Grey Cloud

A grey-clouded record is plain DNS — Cloudflare answers the query, nothing more. A proxied (orange-clouded) record routes traffic to that hostname through Cloudflare's network first, which is what enables the CDN caching, DDoS protection and WAF Cloudflare is known for. Critically, proxying only ever applies to HTTP and HTTPS traffic — it has no effect on any other protocol.

Why Proxying Breaks Email

MX records themselves can't be proxied — Cloudflare's dashboard doesn't even offer the toggle for them. The actual trap is the A record an MX target depends on: if your MX record points to mail.yourdomain.com, and that hostname's own A record is orange-clouded, incoming mail servers try to deliver over SMTP to Cloudflare's proxy IP, which doesn't speak SMTP. That specific A record has to stay grey-clouded even if other records for similar-looking hostnames are proxied for web traffic.

SPF and Cloudflare Email Routing

Enabling Cloudflare's own Email Routing adds the MX and TXT records it needs automatically — adding your own conflicting entries for the same purpose afterward, rather than letting Cloudflare manage them, is a common way to end up with duplicate or contradictory SPF includes.

DNSSEC Is One Click, With a Manual Step After

Enabling DNSSEC in the Cloudflare dashboard is a single toggle, but it isn't complete until you take the DS record Cloudflare generates and add it at your domain's registrar. Skipped, this leaves DNSSEC in a half-enabled state that shows as an error rather than protection — enabling it and never finishing the registrar step is worse than not enabling it at all.

Check a Domain's Current DNS

Look up a domain's DNS →Next: Subdomains on a different host →

Try it on your domain

See the theory in practice — run a DNS Lookup for your own domain.