Use Cloudflare DNS with Krexel

If your domain is already managed by Cloudflare, this guide shows you how to point it at a Krexel-hosted site. The whole thing takes about 5 minutes.

You get to keep Cloudflare's other features (WAF, analytics, Workers) while using Krexel for the actual hosting.

Before you start

You need:

• A Cloudflare account with at least one domain added (orange-clouded or grey-clouded both work)
• A Krexel account with at least one site deployed
• Your domain added in Krexel (run krexel domains add yourname.com first, or use the dashboard)

The right way to think about Cloudflare + Krexel

There are two common setups:

Option A — DNS-only (recommended)

Cloudflare handles DNS for your domain. You add A/CNAME records pointing to Krexel. Krexel handles SSL and hosting. Cloudflare's proxy (orange cloud) stays OFF for these specific records.

Use this if: You want Cloudflare's DNS performance but don't need its WAF or DDoS protection for the Krexel site specifically.

Option B — Cloudflare proxy in front

Cloudflare's orange cloud proxies traffic. You add an A record to Cloudflare IPs, then in Cloudflare's settings, you set up a Worker or page rule to forward to Krexel.

Use this if: You want Cloudflare's full feature set in front of your Krexel site.

This guide covers Option A. Option B requires custom Cloudflare Workers and is out of scope.

Step 1 — Log in to Cloudflare

Go to dash.cloudflare.com and sign in.

Step 2 — Select your domain

From the account home, click on the domain you want to connect.

Step 3 — Open DNS management

In the left sidebar, click DNS → Records.

You're now on the DNS records page.

Step 4 — Add the A records

If you have existing A records pointing @ somewhere else, delete them first. They conflict.

Click Add record:

Click Save.

Add a second A record:

Important: Proxy status MUST be "DNS only" (grey cloud). If you leave it as "Proxied" (orange cloud), traffic gets intercepted by Cloudflare and Krexel can't see it.

Step 5 — (For www subdomain) Add a CNAME record

Click Add record:

Click Save.

Step 6 — Add the CAA record (recommended)

Click Add record:

Click Save.

(Cloudflare's UI varies; if you don't see the right fields, you can paste it as a custom record: 0 issue "letsencrypt.org".)

Step 7 — Wait for verification

Back in your terminal:

krexel domains verify yourname.com

Cloudflare's DNS changes propagate almost instantly (faster than most registrars — usually under 1 minute). Verification should succeed quickly.

Cloudflare-specific gotchas

"Proxy status is orange cloud by default and I forgot to change it"

If you accidentally proxied traffic through Cloudflare, you'll see a Cloudflare-branded 522 or 523 error.

Fix:

1. Go to DNS → Records
2. Click the orange cloud next to your A record
3. Toggle it to "DNS only" (grey cloud)

Wait 30 seconds, then re-verify.

"I want Cloudflare's proxy in front of Krexel"

You'll need to set up a Cloudflare Worker that forwards requests to Krexel. This is a more advanced setup and we don't recommend it for most users.

If you specifically need it (e.g. you want Cloudflare's WAF protecting your Krexel site), contact support@krexel.com for the Worker template.

"I have existing Cloudflare page rules"

Cloudflare page rules that redirect or rewrite URLs can interfere with the connection. Specifically, any rule that:

• Forces HTTPS (Krexel handles this — turn it off)
• Redirects apex to www (you'll create a loop)
• Caches everything (Krexel's CDN is already in front)

Disable or adjust these rules.

"Cloudflare SSL mode is 'Full (Strict)' but I get a cert error"

Change SSL/TLS encryption mode to Full (not "Full Strict"). Krexel uses Let's Encrypt certificates, which Full accepts. Strict would require a CA-signed cert on the origin (Krexel), which we'd need to coordinate.

"I want to keep Cloudflare's email routing"

Cloudflare email routing is independent of your web DNS. Leave those MX records alone. Adding web records (A/CNAME/CAA) doesn't affect email.

Advanced: Setting up Cloudflare proxy correctly (Option B)

If you really want the orange cloud on (for WAF, DDoS protection, etc.):

1. Add A records pointing to Krexel's IPs (198.51.100.42, 198.51.100.43) with proxy enabled (orange cloud)
2. Go to Rules → Page Rules (or Ruleset in newer accounts)
3. Create a rule: *yourname.com/* → Forward URL → https://krexel-edge.pages.dev/$1 with status 301
4. Set SSL/TLS mode to Full

This works but adds a hop (Cloudflare → Krexel → origin) and the redirect can confuse caching. Use only if you really need Cloudflare's protection layer.

What if I want to use Cloudflare Workers for custom logic?

You can use Cloudflare Workers alongside Krexel. Common setup:

• Workers handle authentication, edge logic, A/B testing
• Krexel handles static hosting

Set up the Worker to forward to Krexel:

export default {
  async fetch(request) {
    const url = new URL(request.url);
    url.hostname = "krexel-edge.pages.dev";
    return fetch(url, request);
  },
};

Configure the Worker to run on yourname.com/* and you're done.

Troubleshooting

"DNS not propagating" — Cloudflare DNS is usually instant. If you see this, double-check the proxy status is "DNS only" (grey cloud).

SSL handshake fails — Cloudflare SSL/TLS mode might be "Full (Strict)". Change to "Full".

Visitor sees Cloudflare's "please confirm you're human" challenge — your proxy is on, and Cloudflare is treating your site as suspicious. Either turn off the proxy or add a WAF exception for your domain.

Email stops working — you accidentally modified MX records. Restore them.

Why use Cloudflare DNS if Krexel has its own?

Reasons to use Cloudflare DNS:

• Faster global resolution (Cloudflare's anycast network)
• DNS analytics (who's resolving your domain)
• Easy DNS record management UI
• Free DNSSEC
• You already use Cloudflare for other things

Reasons to use Krexel's default DNS:

• One less account to manage
• Records managed via krexel domains CLI

Either works. Most users on Cloudflare for other reasons stay there.

Related

• Connect a custom domain (overview) — for any registrar
• DNS: GoDaddy — if you bought from GoDaddy
• DNS: Namecheap — if you bought from Namecheap
• Billing & plans — what's included per tier