DNS records
When you create a tunnel, Cloudflare generates a subdomain of cfargotunnel.com with the UUID of the created tunnel. You can treat <UUID>.cfargotunnel.com as if it were an origin target in the Cloudflare dashboard.
Unlike publicly routable IP addresses, the subdomain will only proxy traffic for a DNS record in the same Cloudflare account. If someone discovers your subdomain UUID, they will not be able to create a DNS record in another account or system to proxy traffic to the address.
To create a new DNS record for your tunnel:
- Log in to the Cloudflare dashboard ↗ and select your account and domain.
- Go to DNS > Records.
- Select Add record.
- Input the following information:
- Type: CNAME
- Name: Subdomain of your application
- Target:
<UUID>.cfargotunnel.com
- Select Save.
You can create a new DNS record directly from cloudflared:
cloudflared tunnel route dns <UUID or NAME> www.app.comThis command create a CNAME record that points to the tunnel subdomain, but will not proxy traffic if the tunnel is not currently running.
The DNS record is distinct from the state of the tunnel. You can create DNS records that point to a tunnel that is not currently running. If the tunnel stops running, the DNS record will not be deleted. If you point the DNS record to a tunnel not currently running, visitors will see a 1016 error message.
Additionally, you can create multiple DNS records that point to the same tunnel subdomain. If you are routing traffic from multiple hostnames to multiple services, you will need to create a CNAME entry for each hostname. The CNAME entries will share the same target.
The application will default to the Cloudflare settings of the hostname in your account that includes the Cloudflare Tunnel DNS record, including cache rules and firewall policies. You can changes these settings for your hostname in Cloudflare's dashboard.