Cloudflare Docs
Cloudflare for Platforms
Cloudflare Docs
Cloudflare for Platforms
Edit this page
Report an issue with this page
Log into the Cloudflare dashboard
Set theme to dark (⇧+D)
  1. Products
  2. Cloudflare for Platforms
  3. ...
  4. ...
  5. ...
  6. Apex proxying
  7. Setup

Set up apex proxying

To set up Cloudflare for SaaS for apex proxying - as opposed to the normal setup - perform the following steps.

​​ Before you begin

Before you start creating custom hostnames:

  1. Add your zone to Cloudflare (this should be within the account associated with your IP prefixes).
  2. Enable Cloudflare for SaaS for your zone.
  3. Review the Hostname prioritization guidelines. Wildcard custom hostnames behave differently than an exact hostname match.
  4. (optional) Review the following documentation:

​​ Initial setup

When you first enable Cloudflare for SaaS, you need to perform a few steps prior to creating any custom hostnames.

​​ Step 1 - Get IP range

With apex proxying, you can either bring your own IP range or use a set of IP addresses provided by Cloudflare.

For more details on this step, reach out to your account team.

​​ Step 2 - Create fallback origin

The fallback origin is where Cloudflare will route traffic sent to your custom hostnames (must be proxied).

To create your fallback origin:

  1. Create a proxied A, AAAA, or CNAME record pointing to the IP address of your fallback origin (where Cloudflare will send custom hostname traffic).
TypeNameIPv4 addressProxy status
Aproxy-fallback192.0.2.1Proxied
  1. Designate that record as your fallback origin.
  1. Log into the Cloudflare dashboard.
  2. Select your account and zone.
  3. Go to SSL/TLS > Custom Hostnames.
  4. For Fallback Origin, enter the hostname for your fallback origin.
  5. Select Add Fallback Origin.
Using the hostname of the record you just created, update the fallback origin value.
  1. Once you have added the fallback origin, confirm that its status is Active.

​​ Per-hostname setup

You need to perform the following steps for each custom hostname.

​​ Step 1 — Plan for validation

Before you create a hostname, you need to plan for:

  1. Certificate validation: Upon successful validation, the certificates are deployed to Cloudflare’s global network.
  2. Hostname validation: Upon successful validation, Cloudflare proxies traffic for this hostname.

You must complete both these steps for the hostname to work as expected.

​​ Step 2 — Create custom hostname

After planning for certification and hostname validation, you can create the custom hostname.

To create a custom hostname:

  1. Log in to the Cloudflare dashboard and select your account.
  2. Select your Cloudflare for SaaS application.
  3. Navigate to SSL/TLS > Custom Hostnames.
  4. Click Add Custom Hostname.
  5. Add your customer’s hostname app.customer.com and set the relevant options, including:
  6. Click Add Custom Hostname.

  1. To create a custom hostname using the API, use the Create Custom Hostname endpoint.

    • You can leave the certificate_authority parameter empty to set it to “default CA”. With this option, Cloudflare checks the CAA records before requesting the certificates, which helps ensure the certificates can be issued from the CA.

  2. For the newly created custom hostname, the POST response may not return the DCV validation token validation_records. It is recommended to make a second GET command (with a delay) to retrieve these details.

The response contains the complete definition of the new custom hostname.

​​ Step 3 - Have customer create DNS record

To finish the custom hostname setup, your customer can set up either an A or CNAME record at their authoritative DNS provider.

​​ A record

If your customer uses an A record at their authoritative DNS provider, they need to point their hostname to the IP prefixed allocated for your account.

Your customer’s A record might look like the following:

example.com.  60  IN  A   192.0.2.1

​​ CNAME record

If your customer uses a CNAME record at their authoritative DNS, they need to point their hostname to your CNAME target 1.

Your customer’s CNAME record might look like the following:

mystore.com CNAME customers.saasprovider.com

​​ Service continuation

If your customer is also using Cloudflare for their domain, they should keep their DNS record pointing to your SaaS provider in place for as long as they want to use your service.

For more details, refer to Remove custom hostnames.

  1. If you have regional services set up for your custom hostnames, Cloudflare always uses the processing region associated with your DNS target record (instead of the processing region of any custom origins). ↩︎