Putting your domain behind Cloudflare’s proxy

This is for a domain you brought, whose DNS is in Cloudflare. A domain bought in homeport keeps its DNS here. The DNS records themselves are on Custom domains.

1. Add the TXT record first

Behind the orange cloud, DNS answers with Cloudflare’s addresses, not homeport’s, so a record pointing at homeport no longer proves the domain is yours. The _homeport TXT record does. Add it before you turn the proxy on, or the domain’s next check can’t prove it.

1. Open the app’s Domains tab. On a live domain, open Putting it behind Cloudflare’s proxy? under it and copy the record. Its value reads homeport-verify=…, unique to the domain and the app.
2. In Cloudflare, under DNS → Records, add a TXT record named _homeport.shop.example.com (Cloudflare shows it as _homeport.shop) with that value.
3. Wait until it resolves:

dig +short TXT _homeport.shop.example.com

Keep the A or CNAME record that points at homeport. When you turn the proxy on, it is the record that becomes proxied; don’t delete it or point it elsewhere. Behind the proxy, Cloudflare answers with IPv4 and IPv6 addresses of its own, which is fine.

Adding a domain that is already proxied works the same way: create both records the Domains tab shows, leave the one pointing at homeport proxied, and the TXT record proves it.

Subdomains

Each name needs its own TXT record: www.example.com is proved by _homeport.www.example.com, not by the record for example.com. Copy each one from that domain’s row on the Domains tab.

2. Set SSL/TLS to Full (strict)

In Cloudflare, go to SSL/TLS → Overview and set the encryption mode to Full (strict).

• Flexible sends your HTTPS visitors to homeport over plain HTTP, homeport redirects them to HTTPS, and the visitor loops between the two until the browser gives up.
• Full (strict) connects over HTTPS and checks homeport’s certificate. That certificate is publicly trusted, so the check passes.

3. Let certificate checks through

homeport issues your domain’s certificate by answering a check over plain HTTP on port 80, at /.well-known/acme-challenge/. The other way it can be checked, over TLS, can’t pass through Cloudflare, which ends TLS itself. Cloudflare’s Always Use HTTPS redirects every plain HTTP request, that path included, and it can’t make an exception. So replace it with a Redirect Rule that skips that one path.

1. In Cloudflare, go to Rules → Redirect Rules and choose Create rule.
2. Name it HTTPS except ACME.
3. Under If incoming requests match, choose Custom filter expression, choose Edit expression and paste:

(not ssl and not starts_with(http.request.uri.path, "/.well-known/acme-challenge/"))

4. Under Then, choose Dynamic and paste:

concat("https://", http.host, http.request.uri.path)

5. Set the status code to 301, tick Preserve query string, and choose Deploy.
6. Then go to SSL/TLS → Edge Certificates and turn Always Use HTTPS off. The rule now does its job, minus that path.

• No other rule may block, challenge or redirect /.well-known/acme-challenge/: check your WAF custom rules, rate limits and other redirects.
• On Enterprise, Strict (SSL-Only Origin Pull) can’t work: it always reaches homeport over HTTPS, so the plain HTTP check never arrives.
• The first visit after you turn the proxy on can be slow, or get a Cloudflare 52x error, while the certificate is issued. Try again after a few seconds.

Now turn the proxy on: set the record pointing at homeport to Proxied.

The visitor’s address

Once homeport sees the domain behind Cloudflare, your app is given the visitor’s address in X-Real-IP and X-Forwarded-For, as on any other domain. homeport sees it when, on a check, the domain is proved by its TXT record and every A and AAAA answer is inside Cloudflare’s published ranges. Only for such a domain, and only on requests that come from Cloudflare, does it believe the address Cloudflare passes on (CF-Connecting-IP), so nobody can forge it. Read X-Real-IP: CF-Connecting-IP itself is not passed to your app.

• Live domains are checked every 6 hours, so it can take up to 6 hours after you turn the proxy on. Until then the domain works, but your app sees Cloudflare’s address.
• The Domains tab shows each live domain as Through Cloudflare or Direct.
• Behind any other proxy or CDN, the domain shows as Direct and your app gets that proxy’s address.

Turning it off

Set the record back to DNS only (the grey cloud). A domain behind Cloudflare is checked every 5 minutes, so homeport notices within about 5 minutes and shows it as Direct again. Nothing else needs changing: the record still points at homeport, and the TXT record can stay.

Worth knowing

• Cloudflare Transform Rules and Workers on the zone run on proxied traffic. A header they add reaches your app, so don’t inject secrets or headers you don’t want it to receive.
• Records that have nothing to do with homeport, such as mail, its autoconfig names or other subdomains, are not affected by any of this.
• Encrypted Client Hello (ECH), which hides the site name a visitor connects to, is Cloudflare’s to offer on a proxied domain: it covers the visitor’s connection to Cloudflare. Turn it on in Cloudflare (SSL/TLS → Edge Certificates); nothing changes on homeport’s side.

Checklist