Setup (10)

Last updated Apr 15, 2026 To set up Cloudflare for SaaS for apex proxying - as opposed to the normal setup - perform the following steps.

Before you begin

Before you start creating custom hostnames:

  1. Add your zone to Cloudflare (this should be within the account associated with your IP prefixes).
  2. Enable Cloudflare for SaaS for your zone.
  3. Review the Hostname prioritization guidelines. Wildcard custom hostnames behave differently than an exact hostname match.

  4. (optional) Review the following documentation:

  5. API documentation (if you have not worked with the Cloudflare API before).

  6. Certificate validation.

Initial setup

When you first enable Cloudflare for SaaS, you need to perform a few steps prior to creating any custom hostnames.

1. Get IP range

With apex proxying, you can either bring your own IP range or use a set of IP addresses provided by Cloudflare.

For more details on this step, reach out to your account team.

Caution

These IP addresses are different than those associated with your Cloudflare zone.

2. Create fallback origin

The fallback origin is where Cloudflare will route traffic sent to your custom hostnames (must be proxied).

Note

To route custom hostnames to distinct origins, refer to custom origin server.

To create your fallback origin:

  1. Create a proxied A, AAAA, or CNAME record pointing to the IP address of your fallback origin (where Cloudflare will send custom hostname traffic).
Type Name IPv4 address Proxy status
A proxy-fallback 192.0.2.1 Proxied

  1. Designate that record as your fallback origin.

  2. In the Cloudflare dashboard, go to the Custom Hostnames page. Go to Custom Hostnames ↗

  3. For Fallback Origin, enter the hostname for your fallback origin.
  4. Select Add Fallback Origin.

Using the hostname of the record you just created, update the fallback origin value.

  1. Once you have added the fallback origin, confirm that its status is Active.

Note

When Cloudflare marks your fallback origin as Active, that only reflects that we are ready to send traffic to that DNS record.

You need to make sure your DNS record is sending traffic to the correct origin location.

Per-hostname setup

You need to perform the following steps for each custom hostname.

1. Plan for validation

Before you create a hostname, you need to plan for:

  1. Certificate validation: Upon successful validation, the certificates are deployed to Cloudflare’s global network.
  2. Hostname validation: Upon successful validation, Cloudflare proxies traffic for this hostname.

You must complete both these steps for the hostname to work as expected.

Note

Depending on which method you select for each of these options, additional steps might be required for you and your customers.

2. Create custom hostname

After planning for certification and hostname validation, you can create the custom hostname.

Zone name restriction

Do not configure a custom hostname which matches the zone name. For example, if your SaaS zone is example.com, do not create a custom hostname named example.com.

To create a custom hostname:

  1. In the Cloudflare dashboard, go to the Custom Hostnames page. Go to Custom Hostnames ↗
  2. Select Add Custom Hostname.
  3. Add your customer's hostname app.customer.com and set the relevant options, including:
  4. Select the minimum TLS version.
  5. Select the validation method.
  6. Define a custom origin server.
  7. Enterprise customers can also select the certificate authority (CA), upload a custom certificate, or enable wildcard, which adds a *.<custom-hostname> SAN to the custom hostname certificate. For more details, refer to Hostname priority and Plans.
  8. Select Add Custom Hostname.

Default behavior

When you create a custom hostname:

  • If you issue a custom hostname certificate with wildcards enabled, you cannot customize TLS settings for these wildcard hostnames.

  • If you do not specify the Minimum TLS Version, it defaults to the zone's Minimum TLS Version. You can still edit this setting after creation.

  • To create a custom hostname using the API, use the Create Custom Hostname endpoint.

  • Only Enterprise customers can use the certificate_authority parameter to specify a CA, the custom_certificate/ custom_cert_bundle to upload a custom certificate, or wildcard to create a wildcard certificate. Refer to Plans.
  • You can leave the certificate_authority parameter empty to set it to "default CA". With this option, Cloudflare checks the CAA records before requesting the certificates, which helps ensure the certificates can be issued from the CA.
  • For the newly created custom hostname, the POST response may not return the DCV validation token validation_records. It is recommended to make a second GET command (with a delay) to retrieve these details.

The response contains the complete definition of the new custom hostname.

Default behavior

When you create a custom hostname:

  • If you issue a custom hostname certificate with wildcards enabled, you cannot customize TLS settings for these wildcard hostnames.
  • If you do not specify the Minimum TLS Version, it defaults to the zone's Minimum TLS Version. You can still edit this setting after creation.

Note

For each custom hostname, Cloudflare issues two certificates bundled in chains that maximize browser compatibility (unless you upload custom certificates).

The primary certificate uses a P-256 key, is SHA-2/ECDSA signed, and will be presented to browsers that support elliptic curve cryptography (ECC). The secondary or fallback certificate uses an RSA 2048-bit key, is SHA-2/RSA signed, and will be presented to browsers that do not support ECC.

3. Have customer create DNS record

To finish the custom hostname setup, your customer can set up either an A or CNAME record at their authoritative DNS provider.

Note

If you want your customers to be able to use CNAME records, you will need to complete the normal setup process as well.

A record

If your customer uses an A record at their authoritative DNS provider, they need to point their hostname to the IP prefix allocated for your account. You should also make sure that they point to the specific IPs that you want to use for apex proxying - if you have Static IPs or BYOIP, and your customer points to any of the IPs associated to your account, validation will run.

Caution

Before your customer points DNS to your SaaS target, decide whether hostname validation and certificate validation should happen before or after DNS cutover.

If you need the hostname to be active before DNS cutover, use hostname pre-validation and wait until Hostname status is Active. If you need the certificate to be active before DNS cutover, use TXT validation or Delegated DCV and wait until Certificate status is Active.

If you use automatic HTTP certificate validation or real-time hostname validation, validation happens after your customer adds their DNS record. This can create a short downtime window while the hostname activates or the certificate moves to Active.

Your customer's A record might look like the following:

example.com.  60  IN  A   192.0.2.1

CNAME record

If your customer uses a CNAME record at their authoritative DNS, they need to point their hostname to your CNAME target <sup>1</sup>.

Caution

Before your customer points DNS to your SaaS target, decide whether hostname validation and certificate validation should happen before or after DNS cutover.

If you need the hostname to be active before DNS cutover, use hostname pre-validation and wait until Hostname status is Active. If you need the certificate to be active before DNS cutover, use TXT validation or Delegated DCV and wait until Certificate status is Active.

If you use automatic HTTP certificate validation or real-time hostname validation, validation happens after your customer adds their DNS record. This can create a short downtime window while the hostname activates or the certificate moves to Active.

Your customer's CNAME record might look like the following:

mystore.com CNAME customers.saasprovider.com

Service continuation

If your customer is also using Cloudflare for their domain, they should keep their DNS record pointing to your SaaS provider in place for as long as they want to use your service.

For more details, refer to Remove custom hostnames.

Footnotes

  1. If you have regional services set up for your custom hostnames, Cloudflare always uses the processing region associated with your DNS target record (instead of the processing region of any custom origins). ↩

Was this helpful?

YesNo

On this page

Setup (10) - 图1Docs

{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup/#page","headline":"Setup","description":"Configure Cloudflare for SaaS to support apex domain custom hostnames.","url":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/setup/og.png?v=dea4d0f89a1f9b85","dateModified":"2026-04-15","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}

description: Route custom hostname traffic to a different origin server per hostname. title: Custom origin server image: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/custom-origin/og.png?v=5909370eb8453a34

Skip to content

Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-for-platforms/llms.txt
Use this file to discover all available pages before exploring further.