Domains
Citadel DNS stays in Cloudflare
Keep Cloudflare nameservers and point protected web records at Citadel.
A-record mode
Citadel does not host your DNS zone. Manage DNS in Cloudflare and point proxied orange-cloud web records to the Citadel ingress IP.
- Do not grey-cloud hostnames you expect Citadel to protect.
- Apex and
wwwcan both point to the same ingress IP. - Mail, TXT, and other non-web records can stay as they are.
See Cloudflare setup.