Cloudflare Proxy On or Off for a Subdomain Orange Cloud vs Grey Cloud Explained
Next to every DNS record sits a little cloud icon, and it is the most consequential toggle in Cloudflare. This page turns it into a simple decision: what each colour really does to your traffic, and which subdomains must never be orange.
🎥 Watch the complete video guide on the Technical Anshu YouTube channel
The toggle decides the road your visitors travel. Orange (Proxied): the visitor's browser connects to Cloudflare, and Cloudflare connects to your server — your server's real IP address disappears from public view, and Cloudflare can cache content, block attacks and present its free SSL certificate on the way. Grey (DNS only): Cloudflare merely answers “this name lives at that IP” and steps out of the road — the visitor connects straight to your server, sees its real IP, and gets no Cloudflare protection at all. Neither colour is “on” or “off” for Cloudflare as a whole; the choice is per record, so one domain normally runs both colours at once.
Same subdomain, two different journeys
ORANGE (Proxied) Visitor -> Cloudflare -> Your server
Server IP hidden, cache + free SSL + shield
GREY (DNS only) Visitor -> Your server (direct)
Server IP public, no shield, all protocols work
👆 Orange inserts Cloudflare into the path. Grey removes it. Everything else follows from that
1
Choose Orange for Websites and Web Dashboards
Your origin IP stays hidden — attackers cannot aim at your server directly by looking up the name
Free SSL at the edge — visitors get a valid https connection via Universal SSL even before you arrange a certificate on the server (still set SSL mode to Full and put a certificate on the origin for real end-to-end encryption)
Protection and speed — DDoS absorption, caching of static files and firewall rules all exist only on the orange path
Set TTL becomes automatic on proxied records — Cloudflare manages it; that is normal, not a bug
2
Choose Grey for Anything That Is Not a Website
The proxy speaks web protocols — HTTP and HTTPS on a defined set of ports. Everything else breaks or behaves strangely behind orange:
FTP and SFTP subdomains (like the FTP/NAS names in the video) — file transfer is not web traffic; grey only
SSH names, game servers, custom app ports and most “connect a tool to my server” cases — grey
The hostname your mail server uses — mail records are never proxied; a mail hostname must be DNS only or mail delivery fails
Verification and third-party records — when a service says “add this record and keep it DNS only”, obey them; some checks fail if the answer comes from Cloudflare's IPs
3
Two Honest Limitations of the Orange Cloud
It is not a magic invisibility cloak. Orange hides the IP for that record. If another grey subdomain, an old record, or your email headers reveal the same server's IP, determined attackers can find it. Real protection also means a server firewall that only accepts connections from Cloudflare for web ports
Very large uploads can struggle. Cloudflare documents plan-based limits on single request and upload sizes through the proxy, and free-plan limits are the tightest. If a subdomain exists mainly to upload huge files (backup tools, big media), test it orange — and if uploads fail, grey cloud for that one name is the standard answer
4
The 30-Second Decision Checklist
Opens in a browser as a page or dashboard? → Orange
Used by FTP, SSH, a mail server, a game or a non-web tool? → Grey
A service provider told you a required setting? → Follow the provider, they know their checks
It worked grey and broke when turned orange? → You just proved it is non-web traffic. Back to grey, no guilt — that is the toggle doing its diagnostic job
🔴 The classic beginner disaster: turning every record orange “for security” and instantly breaking email and FTP. Mail and file-transfer names are grey by design. Security comes from the records that carry web traffic — those are the ones to proxy.
🎥 Watch the Proxy vs DNS Only Toggle in the Video
Proxy vs DNS only is one of the video's named topics — watch it switched and explained on the real dashboard.
It can: Cloudflare caches static files close to visitors and its network is fast. But it is not guaranteed — a nearby, well-run server may feel the same. Treat speed as a possible bonus; the certain gains are IP hiding, protection and free edge SSL.
My FTP subdomain stopped working after I enabled the proxy. Why?
Because the Cloudflare proxy only carries web traffic (HTTP/HTTPS). FTP is a different protocol, so connections to a proxied name go nowhere useful. Set that record to DNS only (grey) and FTP will connect directly again.
Can I change the proxy setting later without downtime?
Yes — the toggle takes effect like any DNS edit, usually within minutes, and you can switch a record back and forth freely. Only remember visitors may hold the old answer briefly from cache while it changes.
This guide is based on the Technical Anshu Cloudflare subdomain tutorial video • Stuck on a step? Ask in the video comments — you will get a reply 🙏