Apex Domains for Cloudflare for SaaS

How it works

The proxy logic

The mechanism itself isn't much code, and we're not precious about it. Here's the actual relay: it resolves your Cloudflare for SaaS hostname, opens an outbound connection for every inbound one, and pipes bytes in both directions. No TLS termination, no inspection, nothing clever. We're not putting this on GitHub or maintaining it as a project, just dropping it here. Do what you want with it.

const net = require('net')
const dns = require('dns').promises

const TARGET_HOST = 'proxy.yourdomain.com' // your Cloudflare for SaaS zone
const PORTS = [80, 443]

let cachedIp = null
let cachedAt = 0
const CACHE_MS = 60_000

async function resolveTarget() {
  const now = Date.now()
  if (cachedIp && now - cachedAt < CACHE_MS) return cachedIp
  const [ip] = await dns.resolve4(TARGET_HOST)
  cachedIp = ip
  cachedAt = now
  return ip
}

function startRelay(port) {
  net.createServer(async (client) => {
    let targetIp
    try {
      targetIp = await resolveTarget()
    } catch {
      return client.destroy()
    }
    const upstream = net.connect(port, targetIp, () => {
      client.pipe(upstream)
      upstream.pipe(client)
    })
    upstream.on('error', () => client.destroy())
    client.on('error', () => upstream.destroy())
  }).listen(port, '0.0.0.0')
}

PORTS.forEach(startRelay)

That's genuinely most of the idea. The hard part was never the pipe, it was everything around making that pipe trustworthy enough to put in front of a real customer's traffic:

• ✓A static IP that survives a box getting replaced. If the instance behind it dies, swapping in a new one can't change the address your customer already put in their DNS.
• ✓Real health checks, not port checks. Ours makes an actual HTTPS request through the relay every couple of minutes and forces a replacement on repeated failure, before a customer notices anything.
• ✓Load testing against real infrastructure, not a guess. We pushed it past thousands of concurrent connections before trusting it with a single domain.
• ✓A real look at DDoS exposure. A single box on the open internet, like the code above, is an easy target, and we won't pretend otherwise. That's exactly why production doesn't look like that: Anycast IPs spread the same address across many locations so an attack on one doesn't take the address down, on top of the other DDoS mitigations built into the infrastructure behind it.
• ✓Monitoring and alerting on all of the above, every hour of every day, so a failure gets fixed before it's a support ticket.

None of that shows up in thirty lines of code, and none of it is a one-time cost. It's the ongoing work of running this reliably for domains that aren't ours, which is the actual thing you'd be paying for: not the trick, but the operations behind it, already built and already running.

Pricing

$0.20 / apex domain / month

Double the $0.10 per-hostname unit Cloudflare already charges for a custom hostname, extended to the apex domains that would otherwise fail verification over a plain A record. No setup fee, no minimum commitment.

That $0.20 is a baseline, not a flat rate covering unlimited traffic. Every account gets a set amount of bandwidth included at no extra cost, with any overage billed based on your tier. We're still learning what real bandwidth use looks like across different customers, so both the included amount and the overage pricing are subject to change as we get more data.

Early access

This is new, and we're onboarding a small group of customers by hand before opening it up further. Leave your email and roughly how many apex domains you'd need it for, and we'll reach out.

Frequently asked questions