29 votes
Accepted

Strange characters appearing in some DNS checkers, but not others for DKIM and SPF, possibly causing DMARC to fail

FWIW, \239\187\191 is DNS encoding of 3 bytes of decimal values 239, 187, 191 which maps in hexadecimal to EF BB BF, which is the UTF-8 encoding of Unicode codepoint U+FEFF, which is ZERO WIDTH NO-...
Patrick Mevzek's user avatar
25 votes
Accepted

Why does my Let's Encrypt certificate contain references to Cloudflare?

Nimbus2023 is a certificate transparency log, hosted by Cloudflare. Basically CAB requires that all issued certificates is listed in transparency logs - and CF operates one such. SCT is a Signed ...
vidarlo's user avatar
  • 9,190
14 votes
Accepted

Cloudflare + AWS route 53 combined to handle records

okay, after tinkering around. I finally got it working! thanks for everyone for their help. If anyone else is in the same situation as me. Here is what you have to do. I bought the domain from ...
John's user avatar
  • 301
13 votes
Accepted

Domain Ownership error. No CNAME records were found. Please add a CNAME record pointing to myapp.azurewebsites.net

The problem is due to a conflict between CloudFlare's CNAME flattening and Azure's CNAME verification. The CNAME flattening essentially returns A records, which speeds up DNS resolution and is a good ...
Stephen Cleary's user avatar
12 votes
Accepted

Adding CloudFlare to S3 bucket

Here is a list of steps you will have to take to get Cloudflare to work for your S3 bucket, I will try to elaborate later as necessary, but there are quite a few steps here: Step 1: Set up your domain-...
drussey's user avatar
  • 261
11 votes
Accepted

getting ERR_SSL_VERSION_OR_CIPHER_MISMATCH on nginx webserver via cloudflare

Turns out you can not use multilevel subdomains with ssl on the free plan
user618509's user avatar
10 votes

How to bypass cloudflare caching like reddit does

There are two key ways of doing this with CloudFlare: In CloudFlare you can set a page rule to avoid caching files of your choice. You can serve no-cache headers which CloudFlare will respect. In ...
mjsa's user avatar
  • 395
10 votes
Accepted

Configuring SMTP through Cloudflare

There are a few things that don't make sense. First: CNAME mail prismapixel.studio Auto Proxied This means that mail.prismapixel.studio is a CNAME to prismapixel.studio....
Wesley's user avatar
  • 32.8k
10 votes

Why do I see more than one IP address for my site when I PING it from CMD?

You are getting different IP addresses because you are using Cloudflare. The whole point of Cloudflare is directing traffic through different nodes to distribute and cache traffic. Pinging the ...
Gerald Schneider's user avatar
8 votes

How do I deny all requests not from cloudflare?

As described here, you can only allow ip addresses from cloudflare. https://erichelgeson.github.io/blog/2014/01/18/whitelisting-cloudflare-in-nginx/ # https://www.cloudflare.com/ips # IPv4 allow 103....
user6327's user avatar
  • 181
7 votes
Accepted

Cloudflare integration with Azure websites

The DNS settings for your website in Cloudflare allow you to proxy traffic so that requests to example.com and www.example.com will be protected. You do not control azurewebsites.net though so you ...
Mani Gandham's user avatar
7 votes

How do I deny all requests not from cloudflare?

The only solution I came up with that can be done with nginx by itself requires nginx version 1.9.7 or higher. You can use the ngx_http_geo_module to identify and return a 403 response for any ip's ...
jhilliar's user avatar
7 votes
Accepted

Cloudflare and .DE domain

As far as I can glance the German registry DENIC will verify if the name servers for a domain are configured correctly and whether the zone is in accordance with the DENIC guidelines before allowing ...
HBruijn's user avatar
  • 80.3k
7 votes
Accepted

How to prevent DDOS attack impact on Netlify? (downtime + bandwith usage/cost)

Put your server behind a CDN / DDOS protection vendor such as CloudFlare / AWS CloudFront + WAF and ensure that your server only accepts direct connections from your vendor and your own static IP's. ...
Tim's user avatar
  • 32.8k
6 votes

The incompatibility between Cloudflare and the reverse DNS

The PTR record will need to be set at OVH, however, before being able to do that, you will need to create an A record at CloudFlare for the servers hostname and set that record to not pass through ...
Florin Asăvoaie's user avatar
6 votes
Accepted

Is it normal to have HTTP 499 errors in 1 out of 4000 requests?

Remember that nginx logs a 499 when, from its perspective, the client it was talking to closed the connection. Remember also that CloudFlare is not the only thing talking to your web server. It is ...
Michael Hampton's user avatar
6 votes
Accepted

Delegating only a third level zone (a.b.example) to CloudFlare

The problem with your overall goal is that Cloudflare only accepts domain names directly under a public suffix, which is a policy decision on their part. (Public suffix like com, co.uk, etc. Ie, ...
Håkan Lindqvist's user avatar
6 votes

How do I setup a CloudFlare Origin Certificate in AWS Certificate Manager?

CloudFlare published the key chain certificates in their support article here: https://support.cloudflare.com/hc/en-us/articles/218689638-What-are-the-root-certificate-authorities-CAs-used-with-...
flickerfly's user avatar
  • 2,823
6 votes

Hide subdomains from scan tools

You can't. It would defeat the primary purpose of the dns system: To map ip addresses to domain (or subdomain) names. For that reason all dns entries are public. Also see Domain Name System A ...
Martin Weil's user avatar
6 votes

Putting google cloud platform (cloud run) behind cloud flare

Edit: Cloud run allows you to use port 80, but this depends on the container, as per my experience, when you use port 80 as HTTP server, GCP automatically redirects it into HTTPS at port 443 with a ...
Frank's user avatar
  • 381
6 votes
Accepted

Why is my PC doing more than one DNS query for www.ietf.org?

There are multiple queries because of using CNAME records, which is very often the case when using CDNs. You can see it easily: $ dig www.ietf.org +noall +ans www.ietf.org. 16m2s IN CNAME www....
Patrick Mevzek's user avatar
5 votes

rDNS / PTR record when using Cloudflare

It is a good idea to use different (sub)domains for email and web servers. For example mail.example.com and www.example.com This allows you to resolve this issue fairly easily. Typically rDNS is ...
BillThor's user avatar
  • 28k
5 votes

Redirect loop using cloudflare's Flexible ssl

This can fix the problem if you have the valid SSL certificate on your. [Crypto] box and select Full (strict) as in the image. Really no need to update the web server configuration file for Nginx.
prosti's user avatar
  • 348
5 votes

How to Set PTR Record?

The PTR record (also called reverse DNS record) is not located in the domain's zone but in the ARPA's zone, as it relates to the IP address, not the domain name. That record needs to be created by ...
Julie Pelletier's user avatar
5 votes
Accepted

Is it possible for CloudFlare to get content from 8080 and serve it on 80?

To the best of my knowledge, no. CloudFlare on the free plan can't do port translation. If you make a request on port 80, CloudFlare will send it to your origin on port 80. CloudFlare is essentially ...
Tim's user avatar
  • 32.8k
5 votes

Is it possible to avoid costs for invalid requests at AWS S3 or cloudfront during a DDoS attack?

Very interesting Analysis. Guess only way is to have strict monitoring on traffic and also cost. In addition may be have a look at AWS Shield advanced. Even though there is additional cost per month, ...
Narain's user avatar
  • 181
5 votes
Accepted

Why cant Office 365 find my CName record for autodiscover?

I believe the issue here is that you have enabled the Cloudflare CDN services for this record (the orange cloud button on the right in your screenshot). This causes the address record (A/AAAA) or ...
Håkan Lindqvist's user avatar
5 votes

Delegating only a third level zone (a.b.example) to CloudFlare

Apparently Cloudflare doesn't support what you want to achieve. They seem to require that you delegate to them directly from the registrar level. This seems to be related post on their support site: ...
Tomek's user avatar
  • 3,553
5 votes
Accepted

Hide subdomains from scan tools

If your dev versions of your sites with the subdomains that you do not want to be publicly obvious are all located on the same host. Thus your dev sites just use host headers, then you could just use ...
dmarietta's user avatar
  • 519
5 votes
Accepted

is cloudflare now using let's encrypt certificates for edge?

Yes. Certificate authorities Cloudflare may issue certificates for SSL products from any of the following Certificate Authorities (CAs): DigiCert GlobalSign Let’s Encrypt Sectigo (formerly Comodo) ...
Paul's user avatar
  • 3,137

Only top scored, non community-wiki answers of a minimum length are eligible