To point a domain managed by Cloudflare to a VPS, add the domain to Cloudflare, create DNS records for the VPS, delegate the domain to Cloudflare’s assigned nameservers at your registrar, then configure proxying and HTTPS. An A record maps a hostname to an IPv4 address, an AAAA record maps it to IPv6, and a CNAME maps it to another hostname. Nameserver delegation makes Cloudflare authoritative; the DNS record identifies your VPS.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The safest order is: preserve existing records, add the VPS record, disable DNSSEC before changing nameservers, switch delegation, choose Proxied or DNS only, and test the web server, firewall and certificate. There is no guaranteed universal propagation time; resolver caches and the record’s TTL determine how quickly a change is seen.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What you need before changing DNS
Have these details ready before onboarding the domain:
- Access to the Cloudflare account that will manage the zone.
- Access to the registrar where the domain’s nameservers are changed.
- The VPS provider’s current IPv4 address, IPv6 address if available, or hostname.
- The hostnames you intend to serve, such as the root domain,
www, orapp. - Access to the VPS web-server configuration, firewall and certificate tooling.
Record every service currently using the domain. Mail, verification systems, APIs and other services can stop working when their DNS records are omitted. Cloudflare’s onboarding process may import existing records, but imported data must be reviewed rather than assumed to be complete or current.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Add the domain to Cloudflare
- Sign in to Cloudflare and choose the option to add a site or domain.
- Enter the domain and select the full DNS setup. Do not treat this step as merely buying a certificate: Cloudflare must become the authoritative DNS provider for the zone.
- Review the records Cloudflare found or imported. Check MX records for mail, TXT records used for SPF, DKIM, DMARC or verification, and any records used by other hosted services.
- Note the two Cloudflare nameservers assigned to the zone. They are unique to the zone and are the values you will enter at the registrar.
“After you connect your domain to Cloudflare, Cloudflare will act as the reverse proxy and DNS provider for your site.” — Cloudflare, Add a site documentation
Do not switch nameservers until the important records are present in the Cloudflare zone. A nameserver change transfers authority; it does not automatically repair a missing MX, TXT, CNAME or verification record.
Recommended Free Tools
Create the DNS record for the VPS
Open the domain’s DNS records in Cloudflare and add the record that matches the information supplied by your VPS provider. The record name determines which hostname users request.
| Record | Use it when | Address or target | Typical name |
|---|---|---|---|
| A | The VPS has an IPv4 address | The VPS IPv4 address | Root domain (the apex) |
| AAAA | The VPS has an IPv6 address | The VPS IPv6 address | Root domain (the apex) |
| CNAME | Your provider gives you a hostname instead of an address | The provider’s hostname | www, app or another subdomain |
Point the root domain
For example.com, use the root or apex name offered by Cloudflare’s record editor. Enter the VPS IPv4 address in an A record. If the VPS also has IPv6, add an AAAA record for the same root name. Publishing both address families lets clients that support IPv6 connect over IPv6 while others use IPv4.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Point a subdomain
For www.example.com, create a record named www. For app.example.com, use app. An A or AAAA record points that label directly to the VPS; a CNAME points it to a hostname supplied by the hosting provider.
Choose CNAME only for a hostname target
A CNAME is not a substitute for an IP address. Use it when the service you are connecting to gives you a hostname and expects that hostname to remain the target. If the provider gives you an IPv4 or IPv6 address, use A or AAAA instead. Confirm that the target hostname is intended to serve your requested domain.
Check the record name and value
Enter only the label requested by Cloudflare’s editor. A frequent mistake is entering the entire domain when the editor already appends the zone name, creating an unintended name. Recheck every digit in an IP address and compare it with the VPS provider’s current value; addresses can change after a rebuild, migration or reassignment.
Change the domain’s authoritative nameservers
DNS records in Cloudflare do not become public authority until the registrar delegates the domain to Cloudflare. This is a separate action from creating an A, AAAA or CNAME record.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
- Sign in to the registrar.
- Open the domain’s nameserver or DNS delegation settings.
- Replace the current authoritative nameservers with both Cloudflare nameservers assigned to the zone.
- Save the change and leave the domain registered at the registrar; only DNS authority is moving.
Handle DNSSEC in the correct order
Disable DNSSEC at the registrar before replacing the nameservers. An old delegation-signing arrangement can make the new Cloudflare delegation fail validation. After Cloudflare reports that the zone is active, re-enable DNSSEC through Cloudflare if you want it and your registrar and plan support it. Follow Cloudflare’s supplied DS-record instructions when enabling it; do not copy an old DS value from the previous DNS provider.
Cloudflare’s onboarding guidance covers nameserver replacement and this DNSSEC ordering. The practical rule is simple: remove the old DNSSEC dependency first, delegate to Cloudflare, then establish the new DNSSEC configuration.
Choose Proxied or DNS only
Each web record in Cloudflare has a traffic mode. The orange-cloud Proxied mode sends supported HTTP and HTTPS traffic through Cloudflare. The gray-cloud DNS only mode returns the VPS address directly to the client.
| Decision point | Proxied (orange cloud) | DNS only (gray cloud) |
|---|---|---|
| Traffic path | Client connects to Cloudflare’s edge, which connects to the VPS origin | Client connects directly to the VPS address |
| Cloudflare edge services | Available for supported web traffic | Not placed in the traffic path |
| Origin address exposure | The web client receives Cloudflare’s endpoint rather than the VPS address | The VPS address is returned directly |
| Certificate responsibility | Cloudflare can provide an edge certificate; the origin still must accept the selected Cloudflare-to-origin connection | A valid certificate must be installed and renewed on the VPS |
| Non-HTTP records | Do not proxy records or services that Cloudflare does not support through its web proxy | Use direct DNS for mail and other services that require their own endpoints |
When Proxied is appropriate
Use Proxied for a normal website or web application when you want Cloudflare’s edge services in front of the VPS. The browser reaches Cloudflare first, and Cloudflare then connects to your origin. This mode changes the network path, so your VPS firewall and web server must accept the resulting origin connections rather than assuming every request will come directly from a visitor’s address.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
When DNS only is appropriate
Use DNS only when the service must expose the VPS address directly, when the protocol is not supported by Cloudflare’s web proxy, or while you are deliberately testing the origin. DNS only is also the correct mode for mail records. It does not provide an edge certificate, so the VPS must present a valid certificate for every HTTPS hostname.
Do not proxy mail records
Keep MX and mail-related hostnames DNS only unless the mail service explicitly supports another arrangement. The web proxy is not a general-purpose tunnel for SMTP, IMAP or unrelated protocols. If mail stops after the move, restore the MX and associated TXT records and make sure they are not orange-cloud proxied.
Configure HTTPS for the selected traffic path
HTTPS with Proxied records
A proxied hostname can use Cloudflare’s edge certificate for the client-to-Cloudflare connection. You must still select an SSL/TLS mode that matches what the VPS serves and verify that the origin accepts the connection Cloudflare makes. A certificate problem at the origin can therefore remain even when the browser sees Cloudflare at the edge.
HTTPS with DNS only
With DNS only, the browser connects to the VPS itself. Install a certificate on the VPS for the exact hostname, configure the web server to present it, open port 443, and arrange renewal. Cloudflare cannot supply an edge certificate for a connection that bypasses its proxy.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Match the certificate name to the request
A certificate for example.com does not automatically cover www.example.com or app.example.com. Issue and configure coverage for each hostname users will visit, then test both HTTP and HTTPS behavior. Redirecting HTTP to HTTPS is a web-server decision on the origin or an edge setting; choose one deliberate policy instead of creating a redirect loop.
Prepare the VPS web server and firewall
DNS only tells a client where to connect. The VPS must be ready to answer for the domain:
- Configure the web server’s virtual host or server block with the requested hostname in its Host-header configuration.
- Serve the intended application from that virtual host, rather than the provider’s default site.
- Allow inbound TCP ports 80 and 443 in the VPS firewall and any provider-level firewall.
- Install the origin certificate when using DNS only, and when the selected proxied SSL/TLS mode requires Cloudflare to validate the origin.
- Check that the application itself accepts the hostname and does not redirect to an old domain.
A correct DNS record can still display the wrong site if the web server sends its default virtual host. Conversely, a correctly configured virtual host cannot be reached when the firewall blocks the required port.
Verify activation and resolution
- In Cloudflare, confirm that the zone is active and that the record has the intended name, value and cloud status.
- At the registrar, confirm that both authoritative nameservers exactly match the pair Cloudflare assigned.
- Use a DNS lookup service or resolver available to you to query the root and each subdomain. Check A, AAAA and CNAME answers separately; do not assume an A lookup proves that IPv6 is correct.
- Open the site over HTTP and HTTPS from more than one network. Confirm the requested hostname, certificate, redirects and application content.
- Inspect the VPS web-server logs while making a request. This distinguishes a DNS problem from a firewall, virtual-host or application problem.
Cloudflare does not promise one universal propagation interval. Recursive resolvers cache answers for the record’s TTL, and some users may continue seeing an earlier answer until that cache expires. A new nameserver delegation can also be observed at different times by different resolvers. Avoid repeatedly changing records while waiting; each change can create another cached state.
Troubleshoot the common failures
NXDOMAIN or “domain does not exist”
- Confirm the domain was added to the correct Cloudflare account and the zone is active.
- Check the registrar’s nameserver fields for both Cloudflare-assigned nameservers, with no old nameserver left in the delegation.
- Verify the record name. A typo in a subdomain label creates a valid record for the wrong hostname.
- Confirm that the record exists in the authoritative Cloudflare zone. Cloudflare warns that missing records can produce DNS errors.
The old site still appears
- Compare the A and AAAA values in Cloudflare with the VPS provider’s current addresses.
- Check whether the old address is still present in another record, especially an AAAA record that IPv6-capable clients may prefer.
- Confirm that the VPS web server has a virtual host for the requested Host header and that it serves the intended application.
- Account for resolver caching and the record TTL before treating a short-lived old answer as proof that the change failed.
An SSL or certificate error appears
- For DNS only, install a valid certificate on the VPS for the exact hostname and ensure the web server presents it on port 443.
- For Proxied, check Cloudflare’s SSL/TLS mode and confirm that the origin accepts the selected connection and certificate requirements.
- Make sure the browser is reaching the intended hostname, not an old redirect or a different virtual host.
Mail stopped working
- Restore the correct MX records in Cloudflare.
- Restore TXT records used by mail authentication and provider verification.
- Keep mail-related records DNS only unless the mail provider explicitly supports proxying.
- Check that the mail hostname was not accidentally replaced by the VPS web record.
Changes appear slowly
Check the record TTL and the caches of the resolvers showing the old answer. Compare results from multiple networks and authoritative lookups. Do not promise a fixed number of minutes or hours: the available documentation describes caching behavior, not a single guaranteed propagation time.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesA safe change checklist
- Collect the VPS IPv4 address, IPv6 address or provider hostname.
- Add the domain to Cloudflare with the full DNS setup.
- Review imported records, especially MX and TXT records.
- Create the A, AAAA or CNAME record for the required hostname.
- Disable DNSSEC at the registrar.
- Replace the registrar’s nameservers with both Cloudflare-assigned nameservers.
- Wait for Cloudflare to activate the zone, then establish DNSSEC through Cloudflare if desired and supported.
- Select Proxied for supported web traffic or DNS only for direct-origin traffic and mail.
- Configure the VPS virtual host, firewall ports 80/443 and certificate.
- Test DNS answers, HTTP, HTTPS, redirects, application content and mail.
What changes when you move the VPS later
When the VPS address changes, update the A and/or AAAA record in Cloudflare and verify that no stale address remains in another record. If the provider changes from an IP address to a hostname, replace the address record with the provider’s CNAME arrangement where appropriate. Keep the nameserver delegation unchanged unless you are moving DNS authority as well. Review TTL and resolver caches after the change, and repeat the web-server and certificate checks before declaring the migration complete.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
