RedirectIQ
How-to

How to Redirect an Apex Domain on Cloudflare (CNAME Flattening Explained)

Most DNS providers can't put a CNAME at the domain root. Cloudflare can, via CNAME flattening — here's the exact setup, including the proxy setting that trips people up.

Almost every DNS provider refuses to let you put a CNAME record at the apex (root) of a domain — it's a restriction from the original DNS specification, not a provider choice. Cloudflare is the one major exception: it supports CNAME flattening, which lets you point your bare domain (yourdomain.com, no www) directly at a redirect service with full HTTPS, no workaround required.

Why the apex is normally off-limits for CNAME

A CNAME record says "this hostname is an alias for that hostname" — nothing else can share a record at the same name. But the apex of a domain typically needs to hold other record types too (MX for email, TXT for verification, and so on), and the DNS spec doesn't allow a CNAME to coexist with those. So www.yourdomain.com can be a CNAME freely, but yourdomain.com on its own usually can't be.

Cloudflare works around this at the DNS resolution layer: you enter a CNAME-looking record for the apex, and Cloudflare "flattens" it into the correct record types behind the scenes before answering DNS queries. To you, it looks and behaves like a normal CNAME.

Setting it up

  1. In the Cloudflare dashboard, go to your domain's DNS settings.
  2. Add a record: Type CNAME, Name @ (this represents the apex — not your full domain name), Target the CNAME value your redirect service gives you.
  3. Set the proxy status to Proxied (orange cloud). This is the step that trips people up — for an apex domain on Cloudflare, the proxy has to be enabled. That's what actually routes traffic through your redirect service; a grey-cloud (DNS-only) record at the apex will not work the same way.
  4. Add the domain in your redirect service's dashboard (in RedirectIQ, ownership verification is handled automatically once the proxied CNAME is live — no separate TXT record needed).

The common failure mode

Grey cloud (DNS-only) looks correct in the DNS table — the record is there, the target is right — but it won't route traffic through the redirect network the way a proxied record does. If your apex redirect isn't working and everything else above looks right, this is the first thing to check: click the cloud icon next to the record and confirm it's orange, not grey.

Pairing with www

Most setups want both yourdomain.com and www.yourdomain.com working. www is the easy half — a normal CNAME, no flattening needed, works on any DNS provider. Add both as separate hostnames in your redirect service; RedirectIQ automatically groups a matched www/apex pair onto a single plan slot once both exist in your account, so covering both costs nothing extra.

Verifying it worked

Run the domain through the free redirect checker — you should see a valid certificate, a 301 (or 302, if that's what you configured) status, and the correct destination. If you're troubleshooting a multi-hop setup, the redirect chain analyzer shows every hop along the way.

RedirectIQ auto-detects when your domain is on Cloudflare DNS and shows the exact record — including the proxy setting — in the dashboard once you add it. Start free →