Coresender LogoMobile menu icon

Why we require "DNS only" mode in Cloudflare?

If you have ever configured a domain at Coresender, you have probably come across our message to Cloudflare users, asking them to set the Proxy status to "DNS only" for records they add. The same applies to all DDoS/privacy protection services such as Akamai, Incapsula, Sucuri, etc. If you use any of them, read on.

TL;DR version

When configuring Coresender's CNAME records in Cloudflare (or similar proxying services), always disable the "Proxied" mode and go with the simplest "DNS only".

How proxying works at Cloudflare

In the old days, when DDoS protection services did not exist, your DNS server would only have one goal: to resolve a domain name to the IP address, so the client could connect to a service (e.g., website) you provide. The principle behind the simplest DDoS attack would be to generate high-enough traffic to deplete all resources of your server, rendering your website unavailable to regular users.

Services such as Cloudflare work as a shield. They take all the impact on themselves and allow only legitimate traffic to reach your server. When you add a host to your domain in Cloudflare, it replaces your IP with its own to protect you. The same happens when you add an alias (or CNAME) so that your host points to some other host by name. Unfortunately, in some cases, this method breaks recursive DNS queries. Let's find out how.

How Coresender uses CNAME records

Let's take one of our DKIM records as an example. We instruct you to create the following entry in your DNS server:

When the receiving SMTP server wants to verify your DKIM signature, it first needs to obtain a public key. It does it by querying a DNS TXT record this way:

Example 1
$ host -t txt is an alias for descriptive text "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0Mi1ZbalFRcpxsXtoK7zbN76nPr4NFWTXYgnuj8HMRKLiheg8AKegChOttXmHWqOFEiIM7+a6b7Xsq5rAgLQ+eWb3rqq4153WoXq226mpTLLMVb5jjt1xqktlyUaVYq4AvOiOe2Xc1g8MV8UK/2ghSUqDSWXWBuKo03EAkWEFYOp0vCQxg2erusZnL2A6u+v4" "P2Si2dMNVsq6wtwImB80KN/VmTpGldl2f4L3mIM83ItiYDnAlO7+uc4IOsUMl+o4h/+LDsVwdhmiSCscKX8ktjlaKHWy1qeMO7QG+ic/DF5WdrUytARpGKIRt/fYrngOTreQcNu5dYY7NPG5kF+6wIDAQAB"

and since is a CNAME, the DNS can reach out to and request its TXT record, obtaining a key in return. It's called recursive querying.

What happens if you use the "Proxied" mode in Cloudflare

If you add your DNS CNAME record using a "Proxied" mode, what Cloudflare really does is it creates an A record instead and hides your original CNAME target. So when you ask a DNS for such record, it replies with something like this:

Example 2
$ host has address has address has address has IPv6 address 2606:4700:3034::6818:6fd2 has IPv6 address 2606:4700:3036::ac43:aa50 has IPv6 address 2606:4700:3031::6818:6ed2

As you can see, there's no indication that is actually a CNAME. And unfortunately, it means that DNS can't recursively query a CNAME target for the TXT record. So in this example, when the receiving SMTP server tries to look for a public DKIM key, this will happen:

Example 3
$ host -t txt has no TXT record

DKIM key will not be found, and the check will fail. The good news is that Coresender will protect you from making this mistake by declining to verify your domain settings if the "Proxied" mode was used.

Yeah, but is it safe?

Yes, it is. Since you are just pointing some of your hostnames to the external service provider (like Coresender), you're not exposing any part of your infrastructure. You're not putting any privacy at risk. The world will know you're using Coresender anyway, so this should not be any concern either.

Back to articles listBack to articles list

Try Coresender today

Whether you need to send a few hundred emails or a few million, we’re ready to help you deliver your message. Are you ready to get started?

Try for free