The other day someone asked me how I integrate Cloudflare and why it’s relatively fast — and why the resolved IPs are still three A records? Let me share my site’s architecture and how I use Cloudflare.
First: if you want room to play, your domain must not be on Cloudflare. My domain is registered at GoDaddy, and DNS resolution is hosted at Aliyun. Neither choice is mandatory — you just need DNS outside Cloudflare, with support for region-based resolution. Ready? Let’s go.
Cloudflare SaaS CNAME integration
To use CNAME with Cloudflare, the official route is buying Enterprise. I obviously can’t afford that, though Cloudflare has emailed me about Enterprise plenty of times. Before this, people could do CNAME integration through CloudFlare Partner, but that program has ended — no more applications, no more adding domains.
Now, though, Cloudflare offers its SaaS feature, which lets anyone integrate via CNAME. There are plenty of tutorials online so I won’t belabor it — here’s the gist:
- Find another domain, onboard it to Cloudflare via NS or transfer it in. Say ex.com.
- Add an A record on ex.com pointing to your server, e.g. w.ex.com → 123.12.34.12
- In SSL/TLS → Custom Hostnames, set the fallback origin to w.ex.com
- Add a custom hostname: www.renfei.net
- CNAME www.renfei.net to w.ex.com, plus the TXT verification record
One drawback of Cloudflare SaaS: one hostname can only point to one IP address. If you have multiple servers, you may need several hostnames configured separately.
By the way: the *.cdn.cloudflared.net I use is my own domain — just for show. The official one is *.cdn.cloudflare.net; mine adds a letter “d”. Only Enterprise can integrate with the official *.cdn.cloudflared.net, or legacy domains that were onboarded through the old CloudFlare Partner program.
Region-based DNS resolution
Domestic DNS resolution doesn’t require ICP filing, so you can host your domain’s DNS with a Chinese cloud provider. The services are all about the same — the main thing to check is region-based resolution.
With region-based DNS on the root domain, overseas users resolve straight to the Cloudflare SaaS hostname. For domestic users there are two cases:
- Without ICP filing: you can hand-pick a few Cloudflare IPs and resolve to those. The upside is choosing IPs with good routing, plus domestic DNS resolution is faster than Cloudflare’s.
- With ICP filing: domestic traffic can go through a Chinese CDN provider — domestic users hit the domestic CDN, overseas users hit Cloudflare. Under attack, you can switch everything to Cloudflare at the DNS level in seconds.
Picking Cloudflare IPs
Any Cloudflare IP works. Because Cloudflare is anycast, IPs are routed globally — an IP doesn’t represent a specific datacenter. That said, some IP ranges generally route to the US West, and from my location the US West is faster than Europe, so I hand-pick US West IPs.
IP-picking methods are all over the internet; no point repeating them — search away.
Server location
If you have ICP filing, choosing domestic vs overseas is a headache — it depends on where your users are. Mostly domestic? Pick a domestic server and sacrifice overseas speed. If you have money, get one of each with database replication, and then you don’t have to choose.
Without ICP filing, go overseas — but where? Since hand-picked IPs mostly route to the US West, I put my server in the US West too, close to Cloudflare’s datacenters: California cities like San Francisco or Santa Clara.
As for cloud providers — a few recommendations. If you don’t care, you can stop reading here. If you want server recommendations, keep going.
Domestic providers are all much the same — Aliyun, Tencent, Huawei; if it’s a big brand the service is comparable. Pick whichever you like.
Overseas, two picks:
- Vultr: if you care about the price/quality balance, pick Vultr (sign up via the link for $100 credit). I use them. If money is no object, AWS.
- HETZNER: if you’re really price-sensitive, pick HETZNER (sign up via the link for €20). They’re absurdly cheap — I use them too.
Both are in my own use; stability and network are fine. And HETZNER’s dedicated servers: 1 Gbps bandwidth, unmetered traffic. Can you believe it?