Connect Cloudflare and keep your DNS there

The problem

Your domain's DNS is at Cloudflare and you would rather not move it just to run a site on Tanzahost. Until now that meant adding every record by hand in Cloudflare's dashboard, with the proxy off.

By the end of this post the domain is connected, its records are written into your own Cloudflare zone and marked Managed by Tanzahost, and you can edit the zone from our DNS tab or at Cloudflare. Asha does exactly this with dukashop.com, her second shop.

What's new

From the changelog:

• Connect Cloudflare when you add a domain: approve Tanzahost on Cloudflare's own page, choose which Cloudflare accounts we may see, and come back. We never get your Cloudflare password or billing.

• Your records, added for you: we write the records your site needs into your own Cloudflare zone, marked Managed by Tanzahost, and put them back if one is changed by mistake.

• Edit in either place: change the zone's records from our DNS tab or in Cloudflare. Changes made at Cloudflare show here within a minute.

• The orange cloud: a Proxy switch on each record, once SSL is active for that name. If Cloudflare's SSL mode is Flexible, the domain warns you before visitors go round in circles.

• Disconnect from the DNS tab at any time. The records stay, so your sites keep working. If you remove our access at Cloudflare, we notice within 10 minutes and tell you.

This is for anyone whose domains already use Cloudflare and who wants to keep the zone there while the site runs on Tanzahost.

What we can and can't touch

You approve on Cloudflare's page, never ours, and you choose which Cloudflare accounts we may see. We ask for:

• reading your zones, to find the domain;

• editing DNS records, to add ours;

• reading zone settings, only to check the SSL mode.

We never get your Cloudflare password or your billing. Cloudflare doesn't let you pick single zones, so we only ever touch the zones of domains you add here, and only records we made, unless you edit one yourself in our DNS tab.

What you need before you start

• A project on Tanzahost with a site that needs a domain.

• The domain already added as a zone in one of the Cloudflare accounts you will approve. If it isn't, you're told to add it to Cloudflare first.

• The Cloudflare login for those accounts.

• If Connect Cloudflare isn't in the Add a domain dialog yet, it isn't set up yet: connect the domain with Add records yourself, and add the records in Cloudflare's dashboard, with the proxy off. Everything below waits until the option is there.

Full detail lives in Connect Cloudflare.

Asha connects dukashop.com

Asha's other domain, dukashop.com, has used Cloudflare for years. She wants the shop live without touching a single address.

Open Add a domain

Open your project, then Domains, then Add a domain.

Type the domain and choose Connect Cloudflare

Type the domain, choose Connect Cloudflare, then Continue.

Approve on Cloudflare's page

Choose Continue to Cloudflare, log in there if asked, choose the accounts, and approve. That page is Cloudflare's, not ours, and it asks only to read your zones, edit DNS records, and read zone settings to check the SSL mode.

Come back to the dashboard

Cloudflare sends you back to the dashboard, which finishes the connection and adds the domain.

A minute later the DNS tab shows the zone's records under Records in your Cloudflare account: hers, and the new ones we added, which carry the comment Managed by Tanzahost in Cloudflare's dashboard. She never typed an address.

Prove the domain is yours

Being connected isn't proof that the domain is yours. We write the _domain-verify TXT record into the zone, and the domain is proven when the public DNS answers it. A zone that's still pending at Cloudflare proves nothing until Cloudflare is its nameserver.

Turn on the orange cloud

Each A, AAAA and CNAME record has a Proxy switch: Proxied by Cloudflare or DNS only. On our records, the proxy can be turned on once SSL is active for that name. That's the safe order: the certificate is made while visitors reach us directly, then Cloudflare can sit in front.

When you turn the proxy on, set Cloudflare's SSL mode for the domain to Full (strict): in Cloudflare, open SSL/TLS for the domain. With Flexible, visitors go round in circles between http and https. If we see Flexible, the domain and the DNS tab say so.

Edit the zone from either side

• Changes you make in our DNS tab are made at Cloudflare in one go, all or none.

• Changes you make in Cloudflare's dashboard show here within a minute.

• If you change one of our records at Cloudflare, we put it back, because it keeps your site reachable.

• If one of your own A, AAAA or CNAME records is in the way of ours, the domain shows a conflict. Remove it there, or here in DNS.

• Templates, history, undo and the zone file export work as they do on our nameservers.

Check it worked

• The DNS tab lists the zone's records under Records in your Cloudflare account, yours and ours together.

• In Cloudflare's dashboard, the records we added carry the comment Managed by Tanzahost.

• The _domain-verify TXT record is answered by the public DNS, so the domain is proven.

• The domain shows no conflict, and no Flexible SSL warning.

• With Proxied by Cloudflare set on a record, the site still loads, and the proxy only goes on after SSL is active for that name.

Mistakes and how to fix each

Disconnecting

Choose Disconnect Cloudflare in the DNS tab. We stop managing records in your Cloudflare account, for every domain in this account. The records already there stay, so your sites keep working until you change them.

Next

• Connect Cloudflare covers the permissions, the records and the proxy in full.

• Our nameservers covers templates, history, undo and the zone file export.

• The changelog entry is the short version of what shipped.