{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "item": { "id": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "slug": "do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior", "url": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior.md", "json": "https://update.dsesecurity.com/api/v1/posts/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/" }, "title": "Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior", "summary": "A proxied member changes how Cloudflare treats the address set for that name.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:16:50+00:00", "modified_at": "2026-10-20T18:34:36+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 259, "potentially_affected": "This concerns Cloudflare DNS proxy status for a shared hostname.", "dse_recommendation": "DSE recommends defining the intended traffic path at the hostname level before adding a second address.", "primary_source": { "name": "Cloudflare — Proxy status", "url": "https://developers.cloudflare.com/dns/proxy-status/", "published_on": null, "authority": "developers.cloudflare.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

A proxied member changes how Cloudflare treats the address set for that name.

\n

Source facts

\n

Cloudflare states that when a name has several A or AAAA records and at least one is proxied, all A/AAAA records on that name are treated as proxied. A proxied answer uses Cloudflare addresses rather than directly exposing each configured origin. DNS-only answers instead return the actual origin addresses and do not route the resulting HTTP traffic through Cloudflare’s proxy.

\n

Source: Cloudflare — Proxy status.

\n

Applicability

\n

This concerns Cloudflare DNS proxy status for a shared hostname.

\n

DSE recommendation

\n

DSE recommends defining the intended traffic path at the hostname level before adding a second address. Use separate names or an appropriate supported traffic-management design when the services need genuinely different proxy behavior. Review certificates, origin reachability, and application controls for the selected path. Do not label one row DNS-only in an inventory and assume that row will produce direct access while another row for the same name is proxied. Review every A and AAAA row for the name together, with the intended application path written once for the set. Ask the service owner to identify any required direct endpoint separately. Test both address families where configured before accepting the hostname-level proxy decision.

\n

Verification

\n

Query the hostname through authoritative and representative recursive resolvers and inspect the returned addresses. Request the intended application and correlate the actual origin path with its logs. Confirm the entire record set behaves as designed before treating a second address as a distinct direct-access endpoint.

\n

Official reference

\n

Cloudflare — Proxy status. Reviewed October 20, 2026.

", "content_text": "A proxied member changes how Cloudflare treats the address set for that name.\nSource facts\nCloudflare states that when a name has several A or AAAA records and at least one is proxied, all A/AAAA records on that name are treated as proxied. A proxied answer uses Cloudflare addresses rather than directly exposing each configured origin. DNS-only answers instead return the actual origin addresses and do not route the resulting HTTP traffic through Cloudflare’s proxy.\nSource: Cloudflare — Proxy status.\nApplicability\nThis concerns Cloudflare DNS proxy status for a shared hostname.\nDSE recommendation\nDSE recommends defining the intended traffic path at the hostname level before adding a second address. Use separate names or an appropriate supported traffic-management design when the services need genuinely different proxy behavior. Review certificates, origin reachability, and application controls for the selected path. Do not label one row DNS-only in an inventory and assume that row will produce direct access while another row for the same name is proxied. Review every A and AAAA row for the name together, with the intended application path written once for the set. Ask the service owner to identify any required direct endpoint separately. Test both address families where configured before accepting the hostname-level proxy decision.\nVerification\nQuery the hostname through authoritative and representative recursive resolvers and inspect the returned addresses. Request the intended application and correlate the actual origin path with its logs. Confirm the entire record set behaves as designed before treating a second address as a distinct direct-access endpoint.\nOfficial reference\nCloudflare — Proxy status. Reviewed October 20, 2026.", "content_markdown": "A proxied member changes how Cloudflare treats the address set for that name.\n\n## Source facts\n\nCloudflare states that when a name has several A or AAAA records and at least one is proxied, all A/AAAA records on that name are treated as proxied. A proxied answer uses Cloudflare addresses rather than directly exposing each configured origin. DNS-only answers instead return the actual origin addresses and do not route the resulting HTTP traffic through Cloudflare’s proxy.\n\nSource: [Cloudflare — Proxy status](https://developers.cloudflare.com/dns/proxy-status/).\n\n## Applicability\n\nThis concerns Cloudflare DNS proxy status for a shared hostname.\n\n## DSE recommendation\n\nDSE recommends defining the intended traffic path at the hostname level before adding a second address. Use separate names or an appropriate supported traffic-management design when the services need genuinely different proxy behavior. Review certificates, origin reachability, and application controls for the selected path. Do not label one row DNS-only in an inventory and assume that row will produce direct access while another row for the same name is proxied. Review every A and AAAA row for the name together, with the intended application path written once for the set. Ask the service owner to identify any required direct endpoint separately. Test both address families where configured before accepting the hostname-level proxy decision.\n\n## Verification\n\nQuery the hostname through authoritative and representative recursive resolvers and inspect the returned addresses. Request the intended application and correlate the actual origin path with its logs. Confirm the entire record set behaves as designed before treating a second address as a distinct direct-access endpoint.\n\n## Official reference\n\n[Cloudflare — Proxy status](https://developers.cloudflare.com/dns/proxy-status/). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "url": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior", "item": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/#article", "identifier": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "url": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/", "headline": "Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior", "description": "A proxied member changes how Cloudflare treats the address set for that name.", "abstract": "A proxied member changes how Cloudflare treats the address set for that name.", "articleBody": "A proxied member changes how Cloudflare treats the address set for that name.\nSource facts\nCloudflare states that when a name has several A or AAAA records and at least one is proxied, all A/AAAA records on that name are treated as proxied. A proxied answer uses Cloudflare addresses rather than directly exposing each configured origin. DNS-only answers instead return the actual origin addresses and do not route the resulting HTTP traffic through Cloudflare’s proxy.\nSource: Cloudflare — Proxy status.\nApplicability\nThis concerns Cloudflare DNS proxy status for a shared hostname.\nDSE recommendation\nDSE recommends defining the intended traffic path at the hostname level before adding a second address. Use separate names or an appropriate supported traffic-management design when the services need genuinely different proxy behavior. Review certificates, origin reachability, and application controls for the selected path. Do not label one row DNS-only in an inventory and assume that row will produce direct access while another row for the same name is proxied. Review every A and AAAA row for the name together, with the intended application path written once for the set. Ask the service owner to identify any required direct endpoint separately. Test both address families where configured before accepting the hostname-level proxy decision.\nVerification\nQuery the hostname through authoritative and representative recursive resolvers and inspect the returned addresses. Request the intended application and correlate the actual origin path with its logs. Confirm the entire record set behaves as designed before treating a second address as a distinct direct-access endpoint.\nOfficial reference\nCloudflare — Proxy status. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:16:50+00:00", "dateModified": "2026-10-20T18:34:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 259, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Cloudflare — Proxy status", "url": "https://developers.cloudflare.com/dns/proxy-status/" } } ] } }