Cloudflare’s ordinary orange-cloud proxy handles supported web traffic. Mailbox and FTP connections need an appropriate directly reachable hostname unless you have a separate product specifically designed for that protocol.
IN THIS ARTICLE
What you need before you begin
Obtain the correct mail and FTP server names from your provider. Review MX targets and client settings before changing a hostname that may also serve a website.
01 Keep mail and FTP hostnames outside Cloudflare’s web proxy
- Open DNS > Records for the domain and find the A, AAAA or CNAME records used by mail or FTP clients.
- Set the relevant service hostname to DNS only. Do not proxy the address record behind an MX target through the ordinary web proxy.
- Verify that MX records point to the intended mail-server hostname and that the hostname resolves to the correct reachable service.
- Check certificate coverage for the actual hostname used by clients. Use the provider’s supported server name if it supplies the appropriate mail certificate.
- Test incoming and outgoing mail or a secure file transfer with the real client protocol and configured port.
Confirm the expected result
Clients should connect directly to the intended service rather than Cloudflare’s web proxy. A successful website request does not validate SMTP, IMAP or FTP.
Troubleshoot unexpected results
If the same hostname must serve both proxied web content and direct mail, create a suitable separate service hostname and update clients deliberately. DNS-only records can expose an origin IP, so discuss architecture with the provider if origin isolation is required.
Should the MX record itself have an orange-cloud option?
MX records are DNS records rather than proxied web endpoints. Check the address record for the hostname used as the MX target, which is where an incorrect proxy choice can break delivery.
.png)
 (1).jpg)
 (1) (1).png)
 (1).png)
.jpg)
.jpg)
 (1).jpg)
.jpg)
