GUIDE · DNS · CLOUDFLARE

Connect your domain when your DNS lives on Cloudflare

You created the CNAME, the record looks perfect in the Cloudflare dashboard, and verification still never finishes. It is almost always the same thing: the orange cloud. This guide explains what is happening and how to get it working in a few minutes.

The symptom

You add your hostname in the Paradarum panel, create the CNAME on Cloudflare, and the hostname sits in PendingValidation with its yellow badge. If you query the domain with dig or an online DNS checker, your CNAME is nowhere to be seen: the name resolves to Cloudflare IPs. The record exists, but nobody outside can see it.

Why it happens: the orange cloud answers for you

Every Cloudflare record has two modes:

• Proxied (orange cloud): Cloudflare answers DNS queries with its own IPs and puts its network in front of your site.
• DNS only (grey cloud): Cloudflare acts as a plain DNS server and returns the target you actually typed.

With the orange cloud on, www.yourdomain.com never resolves to a Paradarum PoP: it resolves to Cloudflare. Verification cannot complete, no certificate is issued, and any traffic that did arrive would pass through two chained CDNs — two hops, two caches and headers stepping on each other. To serve your domain from another CDN, the record must be DNS only.

Step by step: the CNAME on “DNS only”

You need your property’s system hostname — the CNAME target, in the form my-site.prdrm.net. Copy it from the property’s Hostnames tab (the “DNS Configuration Required” dialog has a copy button).

1. Log in at dash.cloudflare.com, pick your domain and open DNS → Records.
2. Click Add record: type CNAME, Name www, Target my-site.prdrm.net.
3. Click the record’s orange cloud so it turns grey and reads DNS only.
4. Save.

The apex: yourdomain.com without www

The apex — the root domain, the @ record — does not accept a CNAME: the DNS specification forbids it and most providers reject it. You have two ways out:

• www + redirect. Point www at the CDN with the CNAME above and redirect yourdomain.com → www.yourdomain.com with Cloudflare Redirect Rules. This scheme works at every provider.
• CNAME flattening. A concrete Cloudflare advantage: you may create the CNAME directly on @ (Target my-site.prdrm.net, also DNS only) and Cloudflare serves it as synthesized A records, which are legal at the apex.

The recommended setup is to add both hostnames — www.yourdomain.com and yourdomain.com — to the property: each one is verified independently and gets its own certificate. It requires a plan that allows at least 2 custom hostnames per property; on Seed, with 1, use www — it works at every provider.

Verification and SSL: the panel does the rest

With the record saved, go back to the panel and leave the DNS dialog open. The panel re-checks your DNS every few seconds — there is no TXT token to add and no button to keep clicking: it is a plain forward lookup confirming your hostname resolves to an active PoP. As soon as the record is visible, the status flips to Active and the Let’s Encrypt certificate job is enqueued automatically; the certificate appears shortly after.

Typical propagation is 5–10 minutes. If the name previously carried a record with a high TTL, it can stretch until that TTL expires. Closing the panel loses nothing: on the Hostnames tab, the Retry action re-runs verification whenever you are ready.

If it still will not verify

• The hostname resolves to Cloudflare IPs. The record is still Proxied: switch it to DNS only (grey cloud).
• The record looks right and verification still fails. Look for a leftover A/AAAA on the same name, and confirm the target is the system hostname (my-site.prdrm.net), not your origin server.
• The apex rejects the CNAME. Expected — use flattening or www + redirect, as above.
• Pending for over an hour. Resolve it yourself with dig www.yourdomain.com: until it returns the CNAME chain to prdrm.net, the CDN cannot see it either.