Infra Notes

Cloudflare proxied DNS vs DNS-only: when origin testing gets confusing

Cloudflare proxied records can hide origin behavior, so origin testing should be done explicitly.

CloudflareCloudflareDNSProxyOriginDebugging

Problem

A service works through Cloudflare but direct origin behavior is unclear, or the opposite happens.

Why it happens

Proxied DNS sends traffic through Cloudflare, while DNS-only exposes the origin directly.

Fix / Approach

Know what you are testing: Cloudflare edge behavior or origin behavior.

Command / Config

Useful checks:

bash

dig example.com
curl -I https://example.com
curl -H "Host: example.com" http://ORIGIN_IP

When to use

  • Debugging Cloudflare
  • Nginx
  • Ingress
  • SSL
  • Origin routing
  • WAF behavior

When not to use

  • Services intentionally accessible only through Cloudflare Access or WAF rules