How to Point a Domain to a VPS with Cloudflare

Cloudflare is the fastest free way to point a domain at your VPS, and it adds a CDN, DDoS protection and free SSL along the way. This guide takes you from a domain sitting at your registrar to a working A record resolving to your server's IP, and explains the one setting — the proxy toggle — that trips almost everyone up.

You'll need your server's public IPv4 address and a Cloudflare account (the free plan is fine).

Step 1: Add your site to Cloudflare

Sign up at Cloudflare, click Add a site, and enter your root domain (e.g. example.com, not www.example.com). Cloudflare scans your existing DNS and shows you what it found. Pick the Free plan.

Cloudflare will give you two nameservers, something like:

dana.ns.cloudflare.com
rick.ns.cloudflare.com

Step 2: Change your nameservers at the registrar

At your domain registrar (Namecheap, GoDaddy, Google Domains, wherever you bought it), replace the existing nameservers with the two Cloudflare gave you. This is what hands DNS control to Cloudflare. If you're unsure how, our guide on setting up custom nameservers for your domain walks through it, and what are nameservers explains the concept.

Nameserver changes can take anywhere from a few minutes to 24 hours to register. Cloudflare emails you when your site is active.

Step 3: Create the A records

In the Cloudflare dashboard, open DNS → Records and add:

• Type: A, Name: @, IPv4 address: your server IP, e.g. 203.0.113.10
• Type: A, Name: www, IPv4 address: the same IP

The @ record points the bare domain (example.com); the www record points www.example.com. If your VPS has an IPv6 address, add matching AAAA records too.

Step 4: Decide on the orange cloud (proxy)

Each record has a cloud icon. Orange means Cloudflare proxies the traffic (CDN, caching, hides your IP, free SSL at the edge). Grey means DNS-only — traffic goes straight to your server and dig returns your real IP.

Two rules save a lot of pain:

• For a website on ports 80/443, leave it orange. You get free SSL and DDoS protection.
• For anything that is not HTTP/HTTPS — SSH, a game server, a mail server, a custom port — set it to grey (DNS-only). Cloudflare's proxy only understands web traffic, so proxying an SSH or game subdomain will simply break it.

This is the single most common Cloudflare mistake. If you can't SSH in after adding DNS, your record is probably orange when it should be grey.

Step 5: Set SSL mode

Under SSL/TLS → Overview, choose Full (strict) if you have a valid certificate on the server, or Full if you have a self-signed one. Avoid Flexible — it encrypts browser-to-Cloudflare but leaves Cloudflare-to-server in plaintext, which causes redirect loops. If you need a real certificate on the origin, see free SSL for a custom domain.

Step 6: Verify it worked

From your own machine:

dig +short example.com
dig +short www.example.com

If the record is grey (DNS-only) you'll see your server IP. If it's orange, you'll see Cloudflare IPs (starting 104. or 172.) — that's expected. To see the real origin behind the proxy, check the record value in the dashboard. For a deeper look at query tools, read how to diagnose DNS problems with dig and nslookup.

Common problems

• Site not loading after 24 hours: your registrar nameservers probably didn't save. Re-check them.
• "Too many redirects": you're on Flexible SSL — switch to Full.
• Can't SSH / game won't connect: the subdomain is proxied (orange). Switch it to grey.
• www works but bare domain doesn't: you're missing the @ A record.

Redirect www and apex to one canonical URL

Once both records resolve, pick which version is canonical — example.com or www.example.com — and redirect the other so you don't split SEO signals. Cloudflare does this at the edge without touching your server: go to Rules → Redirect Rules, match www.example.com and forward to https://example.com/$1 with a 301. It's instant and uses no server resources. To handle it on the box instead, the pattern is in how to redirect www to your apex domain.

Speed up propagation and test before go-live

The nameserver switch is the slow part; record edits inside Cloudflare are near-instant because Cloudflare serves them itself. If you're impatient waiting for activation, you can query Cloudflare's nameservers directly to preview the answer before the world catches up:

dig @dana.ns.cloudflare.com example.com A +short

That returns your configured value even while your registrar delegation is still catching up. Once Cloudflare emails you that the site is active, run a full pre-launch check.

A pre-launch checklist

• DNS resolves: dig +short example.com returns the expected target (Cloudflare IPs if proxied, your origin if grey).
• HTTPS works: https://example.com shows a valid padlock — Cloudflare issues an edge certificate automatically within minutes of activation.
• No redirect loop: SSL mode is Full or Full (strict), never Flexible.
• Non-web services connect: SSH, mail and game subdomains are grey (DNS-only).
• Both apex and www load: and one 301-redirects to the other.

Why Cloudflare in front of a VPS is worth it

Beyond pointing the domain, proxying through Cloudflare hides your origin IP so attackers can't hit the VPS directly, absorbs DDoS traffic, caches static assets across a global edge network, and hands you free SSL — all on the free plan. For a small VPS that's a real performance and security upgrade, not just a DNS convenience. The single discipline to keep is the orange/grey rule: web records proxied, everything else DNS-only.

FAQ

Do I need to keep my registrar after moving to Cloudflare?

Yes. Cloudflare manages your DNS, but your domain registration still lives at (and renews through) your registrar unless you also transfer the registration.

Is Cloudflare DNS really free?

Yes, the Free plan includes unlimited DNS records, the CDN and basic DDoS protection with no bandwidth cap for cached content.

Why does dig show a Cloudflare IP instead of my server?

Because the record is proxied (orange cloud). That's normal and hides your origin IP. Set the record to grey if you need the real IP to resolve publicly.

How long until the domain points to my VPS?

Once nameservers are active, record changes inside Cloudflare propagate in seconds to a few minutes thanks to low TTLs.

Can I use Cloudflare for just one subdomain?

Not the way most people expect on the free plan. Cloudflare's standard DNS wants your whole domain's nameservers pointed at Cloudflare, so it manages the entire zone rather than a single subdomain. The practical workaround is to host the full zone at Cloudflare and simply set the one subdomain you care about to proxied (orange) while leaving everything else grey (DNS-only) — same end result. If you genuinely must delegate only a subdomain (say a marketing team runs shop.example.com elsewhere), you can add an NS record delegating that label to another provider's nameservers, but that's the exception. For nearly all sites, move the whole zone and use the per-record orange/grey toggle.

Ready to give that domain somewhere to point? Spin up an NVMe VPS with full root access, or grab a domain and DNS in one place with Nxeon domains.