Connect Cloudflare

If your domain's DNS is at Cloudflare, you can keep it there. Choose Connect Cloudflare when you add the domain, approve Tanzahost on Cloudflare's own page, and we add your site's records in your Cloudflare account. You then edit the zone's records from our DNS tab or at Cloudflare, whichever you like.

What we can and can't touch

You approve on Cloudflare's page, never ours, and you choose which Cloudflare accounts we may see. We ask for:

• reading your zones, to find the domain;

• editing DNS records, to add ours;

• reading zone settings, only to check the SSL mode.

We never get your Cloudflare password or your billing. Cloudflare doesn't let you pick single zones, so we only ever touch the zones of domains you add here, and only records we made, unless you edit one yourself in our DNS tab.

Connect a domain

1. Open your project, then Domains, then Add a domain.

2. Type the domain, choose Connect Cloudflare, then Continue.

3. Choose Continue to Cloudflare, log in there if asked, choose the accounts, and approve.

4. Cloudflare sends you back to the dashboard, which finishes the connection and adds the domain.

The domain must already be a zone in one of the accounts you approved; if it isn't, you're told to add it to Cloudflare first. Being connected isn't proof that the domain is yours: we write the _domain-verify TXT record into the zone, and the domain is proven when the public DNS answers it. A zone that's still pending at Cloudflare proves nothing until Cloudflare is its nameserver.

Example: Asha's second shop

Asha's other domain, dukashop.com, has used Cloudflare for years. She adds it as an extra domain with Connect Cloudflare, approves on Cloudflare's page, and comes back. A minute later, the DNS tab shows the zone's records under Records in your Cloudflare account: hers, and the new ones we added, which carry the comment "Managed by Tanzahost" in Cloudflare's dashboard. She never typed an address.

The orange cloud

Each A, AAAA and CNAME record has a Proxy switch: Proxied by Cloudflare or DNS only. On our records, the proxy can be turned on once SSL is active for that name. That's the safe order: the certificate is made while visitors reach us directly, then Cloudflare can sit in front.

When you turn the proxy on, set Cloudflare's SSL mode for the domain to Full (strict): in Cloudflare, open SSL/TLS for the domain. With Flexible, visitors go round in circles between http and https. If we see Flexible, the domain and the DNS tab say so.

Records

• Changes you make in our DNS tab are made at Cloudflare in one go, all or none.

• Changes you make in Cloudflare's dashboard show here within a minute.

• If you change one of our records at Cloudflare, we put it back, because it keeps your site reachable.

• If one of your own A, AAAA or CNAME records is in the way of ours, the domain shows a conflict. Remove it there, or here in DNS.

Templates, history, undo and the zone file export work as they do on our nameservers.

Disconnecting

Choose Disconnect Cloudflare in the DNS tab. We stop managing records in your Cloudflare account, for every domain in this account. The records already there stay, so your sites keep working until you change them.

If you revoke our access from Cloudflare's side instead, we notice within 10 minutes, the domains say Cloudflare is disconnected, and you're told under the bell. Choose Connect Cloudflare again to fix it.