Do not mix proxied and DNS-only addresses on one Cloudflare hostname expecting split behavior

A proxied member changes how Cloudflare treats the address set for that name.

Source facts

Cloudflare states that when a name has several A or AAAA records and at least one is proxied, all A/AAAA records on that name are treated as proxied. A proxied answer uses Cloudflare addresses rather than directly exposing each configured origin. DNS-only answers instead return the actual origin addresses and do not route the resulting HTTP traffic through Cloudflare’s proxy.

Source: Cloudflare — Proxy status.

Applicability

This concerns Cloudflare DNS proxy status for a shared hostname.

DSE recommendation

DSE recommends defining the intended traffic path at the hostname level before adding a second address. Use separate names or an appropriate supported traffic-management design when the services need genuinely different proxy behavior. Review certificates, origin reachability, and application controls for the selected path. Do not label one row DNS-only in an inventory and assume that row will produce direct access while another row for the same name is proxied. Review every A and AAAA row for the name together, with the intended application path written once for the set. Ask the service owner to identify any required direct endpoint separately. Test both address families where configured before accepting the hostname-level proxy decision.

Verification

Query the hostname through authoritative and representative recursive resolvers and inspect the returned addresses. Request the intended application and correlate the actual origin path with its logs. Confirm the entire record set behaves as designed before treating a second address as a distinct direct-access endpoint.

Official reference

Cloudflare — Proxy status. Reviewed October 20, 2026.