Cloudflare Orange Cloud vs Grey Cloud: Wrong Toggle Breaks Site
Toggling Cloudflare's proxy on or off changes whether traffic hits the edge or the origin. The wrong state breaks SSL, WebSockets, or apex CNAMEs subtly.
Articles tagged with #DNS
Toggling Cloudflare's proxy on or off changes whether traffic hits the edge or the origin. The wrong state breaks SSL, WebSockets, or apex CNAMEs subtly.
You turned on DNSSEC and resolvers now return SERVFAIL. The DS at the registrar does not match the DNSKEY at your nameservers, breaking the chain.
IPv4 users reach the site fine but IPv6 users get timeouts. Either AAAA is absent, points to a dead address, or your firewall blocks v6. Fix dual-stack.
You delegated a subdomain to its own nameservers but resolution fails. The parent zone needs glue A/AAAA when NS targets live inside the subzone.
Run en.yoursite.com and zh.yoursite.com on separate hosting regions to cut latency for each audience — without splitting SEO or breaking shared assets.
Same domain works fine when bound to Vercel, fails when you try Firebase Hosting. Why Firebase has stricter requirements and how to fix.
You changed hosts but DNS still resolves to the old provider. Where to look in the DNS chain to find where the wrong record lives.
Google has indexed all four versions of your site. Each version splits link equity. How to unify under one canonical.
Your site responds on both http and https. Google indexes both versions and your security score is downgraded.
Beginners confuse name servers (NS) and individual DNS records (A, CNAME). Changing one without understanding the other causes hours of debugging.
Google indexes `your-app.vercel.app` or `your-site.web.app` instead of your custom domain. Why and how to fix.
You moved from old.com to new.com. Some pages redirect correctly, others return 404. How to map and verify a complete redirect set.
You shipped from a starter template but RSS feed entries and og:url still say `https://example.com/...`. Why these are silent SEO killers and how to fix.
You moved domains but your old GSC property doesn't track the new one. How to migrate without losing historical data.
Sometimes the site loads, sometimes it shows a hosting platform error or DNS error. Common causes after binding a domain to a new platform.
After domain migration, sitemap.xml still lists URLs on the old domain. Search Console sees mismatched URLs.
Site is on HTTPS but browser shows a "Not fully secure" warning. Caused by HTTP assets loaded on HTTPS pages.
You changed DNS but it takes 24+ hours to propagate. Lowering TTL before changes makes propagation predictable.
Visitors can reach both yourdomain.com and www.yourdomain.com. Both load. Why this hurts SEO and how to fix.
Step-by-step on deploying a static Astro site to Firebase Hosting, with the configuration that avoids the common pitfalls in 2026.
Add a custom domain to Firebase Hosting with the exact DNS records, dig commands for verification, and the common failures explained.
Point a custom domain at Vercel with the exact DNS records, dig + curl verification, and Cloudflare-in-front configuration that does not break SSL.
Decide when to buy a custom domain — with a checklist, WHOIS / trademark commands, and registrar checks that prevent expensive regret.
Your host says use A; another doc says CNAME. Records conflict and site doesn't resolve.
You updated DNS records but the site shows old IP or fails to load.
You changed DNS and some users see new, some see old. Here's why and how to test.
You changed something at the DNS provider and now email stopped working.
You bound a custom domain on Vercel / Firebase / Netlify but SSL stays "pending."
You configured a subdomain but it doesn't resolve to your site.
www.example.com works but example.com doesn't (or vice versa).
A records point to an IP. CNAMEs point to another name. That single sentence solves 90% of indie DNS confusion — here is the other 10%.
"24 to 48 hours" is folklore. Modern DNS propagates in minutes — when it does not, something is broken. Here is how to tell.
Root vs www is cosmetic — until both serve the same content. Use this DNS table, redirect config, and curl verification to lock it down once.