---
title: DNS and Cloudflare
description: Point your domain at the NexCMP server, optionally through Cloudflare, and get a valid certificate with the right SSL mode.
url: https://nexcmp.com/docs/getting-started/dns-and-cloudflare/
applies_to: NexCMP 1.6.1
updated: 2026-11-02
---

# DNS and Cloudflare

NexCMP needs one DNS name — its **main domain** — and works in two modes.

## Mode A: DNS points straight at the server

1. Create an **A** record `cloud.example.com → <server public IPv4>` (and an **AAAA** record if the server has IPv6).
2. Optional, if you use them: `admin.cloud.example.com` and `partner.cloud.example.com` pointing at the same IP.
3. Run (or re-run) the [installer](https://nexcmp.com/docs/getting-started/installation/). It sees that the name resolves to the server's own public IP and obtains a Let's Encrypt certificate through the HTTP-01 challenge on port 80.

## Mode B: the domain is proxied by Cloudflare

Create the same records with the orange cloud (**Proxied**). The installer detects that the name resolves only to Cloudflare addresses and switches to Cloudflare mode:

- nginx still listens on 80/443 on your server;
- the visitor's real IP is read from the `CF-Connecting-IP` header — **only** for connections coming from Cloudflare's published ranges, so it cannot be forged by anyone else;
- the certificate is obtained through Let's Encrypt (Cloudflare forwards the challenge to your origin); if that is not possible yet, a **self-signed origin certificate** is created so that "Full" mode works, and a later re-run of the installer upgrades to Let's Encrypt.

You can force this mode with `--behind-cloudflare`.

::: important Set SSL/TLS mode in Cloudflare
In Cloudflare go to **SSL/TLS › Overview** and select **Full (strict)** once the installer reports a Let's Encrypt certificate. With a self-signed origin certificate use **Full**. **Flexible** will cause redirect loops.
:::

::: tip
If "Always Use HTTPS" is on, Cloudflare sends the validation request to port 443 of your origin. The installer handles this by creating the temporary self-signed certificate first, then retrying Let's Encrypt.
:::

## Check it

```bash
dig +short cloud.example.com        # A record (a Cloudflare address in mode B)
curl -I https://cloud.example.com/healthz
sudo certbot certificates           # certificate name, domains and expiry
```

Certificates renew automatically with certbot's timer. Renewal uses the webroot `/var/www/nexcmp-acme`, so port 80 must stay reachable (directly or through Cloudflare).

## Common problems

| Symptom | Cause | Fix |
|---|---|---|
| Installer says "DNS … does not point to … (nor to Cloudflare) — skipping nginx/TLS" | DNS record missing, wrong, or not propagated | Fix the record, wait for propagation, re-run the installer. |
| Browser shows `ERR_TOO_MANY_REDIRECTS` behind Cloudflare | SSL mode is **Flexible** | Set **Full (strict)** (or **Full**). |
| Cloudflare error 525/526 | Origin certificate rejected | Use **Full** with a self-signed origin certificate, or **Full (strict)** with Let's Encrypt. |
| Visitors all show Cloudflare IPs in logs | Not in Cloudflare mode | Re-run the installer with `--behind-cloudflare`. |

More in [Installation errors](https://nexcmp.com/docs/troubleshooting/installation-errors/).