# Custom domain behind Cloudflare proxy

> Why a SupaHost custom domain needs Cloudflare's "DNS only" setting, what the "proxied by Cloudflare" message means, and how to set the record up correctly.

Source: https://supahost.app/kb/cloudflare-proxy-custom-domain · Updated 2026-11-11

## What you see

Your custom domain is stuck on **Waiting for DNS** or **Needs attention** on *Dashboard → your project → **Domains***, with a message like:

```
api.bookings.example is proxied by Cloudflare. Set the record to “DNS only” (grey cloud) so we can issue the certificate.
```

or

```
We couldn’t issue a certificate. Check that the record points at your project and isn’t proxied, then check DNS again.
```

## Why it happens

With Cloudflare's proxy on (the orange cloud), your hostname resolves to Cloudflare's IP addresses, not your instance's. Two things then fail:

- **The DNS check.** SupaHost looks for a CNAME to your project host or A records equal to your instance's IP. A proxied CNAME is flattened and returns Cloudflare's addresses, so neither matches.
- **The certificate.** SupaHost issues your domain's HTTPS certificate with Let's Encrypt, which has to reach your instance directly. With the proxy in between, it can't.

SupaHost terminates HTTPS itself and renews the certificate automatically, so the record has to stay unproxied, not just during setup.

## How to fix it

1. In Cloudflare, open your zone and go to **DNS → Records**.
2. Find the record for your hostname, for example `api`.
3. Set it up like this:

   | Type | Name | Target | Proxy status |
   |---|---|---|---|
   | CNAME | `api` | `app-one.acme.supahost.space` | DNS only |

4. Save, then click **Check DNS** on the domain's row in the SupaHost dashboard.
5. Confirm from your machine that the proxy is off. The CNAME answer should be your project host:

   ```bash
   dig +short api.bookings.example CNAME
   ```

The domain moves to **Issuing certificate** and then **Active** with **HTTPS**, usually about a minute after DNS resolves.

### Root domains

For a root domain such as `bookings.example`, Cloudflare flattens the CNAME automatically. That's fine as long as the record is **DNS only**: the flattened answer is then your instance's IP, which the check accepts.

### Keeping Cloudflare for the rest of your site

You can keep the proxy on for your website and app (`www`, `app`) and leave only the API hostname unproxied. Your app then calls `https://api.bookings.example`, which goes straight to SupaHost.

## On SupaHost

- SupaHost serves HTTPS for the custom domain with its own Let's Encrypt certificate, so you don't need Cloudflare's SSL settings for this hostname.
- Your SupaHost address (`https://app-one.acme.supahost.space`) keeps working whatever you do in Cloudflare.
- Don't turn the proxy back on once the domain is active. SupaHost expects direct connections for this hostname, including when it renews the certificate. Leave it on **DNS only**.

## Related

- [Custom domain stuck verifying](/kb/custom-domain-not-verifying)
- [Custom domains](/docs/platform/custom-domains)
- [Netlify and Cloudflare](/docs/integrations/netlify-cloudflare)