CNAME setup (Partial)

---

• How to
• Availability
• Reference
• DNS resolution
• CNAME flattening
• DDoS protection
• Domain ownership
• HTTPS records

---

import { Render, GlossaryTooltip } from "~/components";

:::note[Availability] A CNAME setup (partial) is only available to customers on a Business or Enterprise plan. Partial setups are not supported on Cloudflare Registrar domains. :::

Once you are on a CNAME setup (partial), the actual resolution of your records to Cloudflare depends on CNAME records added at your authoritative DNS provider. Check your authoritative DNS provider to know which records are pointing to {your-hostname}.cdn.cloudflare.net.

How to

• Set up a partial zone (CNAME setup)
• Convert a CNAME setup (partial) to a primary setup (full)
• Convert a CNAME setup (partial) to a secondary setup
• Create DNS records of other types

Availability

	Free	Pro	Business	Enterprise
Availability	No	No	Yes	Yes

Reference

DNS resolution

When you have a partial zone (CNAME setup), Cloudflare resolves DNS records differently than for primary zones (full setup).

CNAME flattening

A CNAME setup (partial) requires the proxied hostname to be pointed to Cloudflare via a CNAME record. Since CNAME records are not allowed on the zone apex (example.com), you can only proxy your zone apex to Cloudflare if your authoritative DNS provider supports CNAME Flattening.

If your authoritative DNS provider does not support CNAME Flattening, redirect its traffic — for example, with an .htaccess file — to a subdomain proxied to Cloudflare. Alternatively, you can use static IPs or BYOIPs.

DDoS protection

DDoS protection for attacks against DNS infrastructure is only available for domains on primary setup (full). Domains on the CNAME setup (partial) are not using Cloudflare authoritative nameservers.

Domain ownership

Enterprise customers can use zone holds to prevent other teams in the organization from adding zones that are already active in another Cloudflare account. For CNAME setups (partial), if the same zone is added to different accounts, the last account to complete the setup will gain ownership.

HTTPS records

Cloudflare automatically generates HTTPS records for proxied hostnames when Universal SSL is enabled. If Universal SSL is disabled on your partial zone, Cloudflare will not generate HTTPS records for proxied names, even if you have a custom certificate in place. Refer to SVCB and HTTPS records for details.