DNS

Cloudflare DNS is authoritative DNS with optional orange-cloud proxying. Records route traffic to origins or through Cloudflare's edge for TLS, caching, and WAF. For a FullStack JS app you typically point `A`/`AAAA` or `CNAME` at your host, choose proxied vs DNS-only per record, and align TTL with deploy and failover plans.

| Record | Typical use | |--------|-------------| | `A` / `AAAA` | Origin IP for API or static host | | `CNAME` | SaaS, Pages, or load balancer alias | | Proxied (orange) | Traffic through edge; hides origin IP | | DNS only (grey) | Pure resolution; mail, verification TXT |

CNAME flattening at apex lets root domains use CNAME-like behavior. Proxy mode affects certificate issuance (Universal SSL) and whether origin sees Cloudflare IPs.

On interviews: proxied vs DNS-only, TTL trade-offs, apex CNAME flattening, failover with health checks, and how DNS changes impact TLS and deploy cutovers.

Common pitfalls: proxying mail or non-HTTP records; stale TTL during migrations; forgetting that proxied origins must allow Cloudflare IP ranges; mixing apex and www without redirect strategy.

The trade-off is edge protection and performance (proxied) versus direct origin exposure and simpler debugging (DNS only).

Checklist:

• Document proxied vs grey per hostname.
• Plan TTL before cutover or rollback.
• Restrict origin to trusted Cloudflare/source IPs when proxied.
• Validate TXT/MX records stay DNS-only.