# Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior

> A proxied member changes how Cloudflare treats the address set for that name.

- Canonical URL: https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:50+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A proxied member changes how Cloudflare treats the address set for that name.

## Potentially affected

This concerns Cloudflare DNS proxy status for a shared hostname.

## DSE recommendation

DSE recommends defining the intended traffic path at the hostname level before adding a second address.

## Article

A proxied member changes how Cloudflare treats the address set for that name.

## Source facts

Cloudflare states that when a name has several A or AAAA records and at least one is proxied, all A/AAAA records on that name are treated as proxied. A proxied answer uses Cloudflare addresses rather than directly exposing each configured origin. DNS-only answers instead return the actual origin addresses and do not route the resulting HTTP traffic through Cloudflare’s proxy.

Source: [Cloudflare — Proxy status](https://developers.cloudflare.com/dns/proxy-status/).

## Applicability

This concerns Cloudflare DNS proxy status for a shared hostname.

## DSE recommendation

DSE recommends defining the intended traffic path at the hostname level before adding a second address. Use separate names or an appropriate supported traffic-management design when the services need genuinely different proxy behavior. Review certificates, origin reachability, and application controls for the selected path. Do not label one row DNS-only in an inventory and assume that row will produce direct access while another row for the same name is proxied. Review every A and AAAA row for the name together, with the intended application path written once for the set. Ask the service owner to identify any required direct endpoint separately. Test both address families where configured before accepting the hostname-level proxy decision.

## Verification

Query the hostname through authoritative and representative recursive resolvers and inspect the returned addresses. Request the intended application and correlate the actual origin path with its logs. Confirm the entire record set behaves as designed before treating a second address as a distinct direct-access endpoint.

## Official reference

[Cloudflare — Proxy status](https://developers.cloudflare.com/dns/proxy-status/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Proxy status
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/dns/proxy-status/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior,” DSE Security, https://update.dsesecurity.com/updates/do-not-mix-proxied-and-dns-only-addresses-on-one-cloudflare-hostname-expecting-split-behavior/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.