DNS-Only vs. Proxied on Cloudflare: Why the Orange Cloud Is Still Off

Cloudflare's DNS records ship with a toggle that's orange when "proxied" and grey when "DNS only." Proxied looks like the obviously correct default: it caches assets, terminates TLS at the edge, hides the origin IP, and absorbs a chunk of DDoS traffic before it reaches the server. For diogocouto.dev, it's currently off.

What proxying changes underneath

Once a record is proxied, Cloudflare's edge becomes a real hop in every request: it terminates the client-facing TLS connection and opens its own connection to the origin. That means the origin server sees Cloudflare's IP as the client, not the visitor's — anything that logs or rate-limits by source IP needs CF-Connecting-IP instead, or it silently rate-limits Cloudflare itself. WebSocket and some long-lived connections behave differently through the proxy too, and debugging a "why is this slow" question gains an extra hop to reason about.

Why DNS-only is the right default for a single small server

A single Hetzner box running one personal site has a small, predictable traffic pattern and no real DDoS exposure to speak of — the upside of hiding the origin IP is theoretical until there's a reason to think someone's targeting it. Meanwhile DNS-only keeps the mental model simple: the domain resolves straight to the server, TLS terminates there, and every log line's source IP is the actual visitor. One less layer to have an opinion about while nothing has demonstrated a need for it.

When the toggle would flip

The honest trigger isn't "eventually, for best practice" — it's a concrete event: a traffic spike that looks adversarial, a plan to add a second origin behind a load balancer, or wanting edge caching for static assets because origin bandwidth actually becomes a cost. Until one of those is true, DNS-only is the simpler, more debuggable choice, not a corner cut.