If you have ever opened the Cloudflare DNS dashboard and noticed an orange cloud beside one record and a grey cloud beside another, you may have wondered what the difference actually means. The grey cloud is not simply a visual setting. It determines whether Cloudflare acts as a reverse proxy for that hostname or only answers DNS queries.
In Cloudflare terminology, a grey cloud means the DNS record is set to DNS-only. Instead of sending web traffic through Cloudflare’s network, the DNS response points the visitor toward the record’s actual destination, such as your origin server. Cloudflare explains that DNS-only records can expose the origin IP address and do not receive the same proxy-based performance and security features as proxied records.
This distinction matters for website owners, developers, system administrators, and anyone managing domains through Cloudflare. Choosing the wrong setting can affect caching, DDoS protection, origin visibility, application compatibility, email services, and troubleshooting.
This guide explains exactly what a grey cloud means, how it compares with the orange cloud, when DNS-only is appropriate, when it creates unnecessary risk, and how to troubleshoot common configuration problems.
What Does a Grey Cloud Mean in Cloudflare?
A grey cloud means that a supported DNS record is configured as DNS-only rather than proxied. When someone requests the hostname, Cloudflare provides the DNS record value instead of acting as an intermediary between the visitor and your origin server.
For example, imagine that example.com has an A record pointing to an origin IP address. With the grey cloud enabled, a DNS lookup can return that origin destination directly. The visitor can then connect to the origin without the request first passing through Cloudflare’s reverse-proxy network.
Cloudflare’s documentation specifically identifies the grey cloud icon as the DNS-only state for A, AAAA, and CNAME records. It also explains that DNS-only records are commonly appropriate for services that do not use Cloudflare’s HTTP proxy, including certain email, verification, and non-HTTP services.
The important point is that DNS and web traffic are different things. DNS tells a device where a service is located, while a reverse proxy can sit between the visitor and the origin server and handle HTTP or HTTPS traffic before it reaches the origin.
Grey Cloud vs Orange Cloud
The easiest way to understand the difference is to compare the two Cloudflare states.
| Feature | Grey Cloud | Orange Cloud |
| Cloudflare status | DNS-only | Proxied |
| Origin IP visibility | Generally visible through the DNS record | Usually hidden behind Cloudflare IPs |
| Web traffic through Cloudflare | No | Yes |
| Cloudflare caching | No proxy caching | Available for eligible traffic |
| Proxy-based DDoS protection | No | Available |
| WAF and proxy security features | No | Available |
| DNS resolution | Yes | Yes |
| Common use | Email, verification, unsupported services | Websites and web applications |
Cloudflare recommends proxying A, AAAA, and CNAME records that serve HTTP or HTTPS traffic because proxied records can benefit from caching, DDoS protection, WAF capabilities, and other Cloudflare features.
That does not mean every DNS record should use the orange cloud. Some services are not compatible with Cloudflare’s HTTP proxy, so forcing them through the proxy can cause connectivity problems.
Why Does a Cloudflare Grey Cloud Exist?
The grey cloud exists because not every DNS record represents a website that should pass through a reverse proxy. DNS is used for many services, including email, domain verification, application integrations, and other protocols.
Suppose you have a mail.example.com hostname that points to a mail server. Sending that record through an HTTP reverse proxy would not necessarily make sense because email protocols such as SMTP are different from normal web traffic.
Cloudflare therefore allows individual records to remain DNS-only. Its documentation notes that MX records cannot be proxied and that records used exclusively for email may need to remain DNS-only.
The same principle applies to certain third-party verification records. If a service tells you to create a DNS record specifically for verification, you should follow the service’s instructions rather than automatically turning every record orange.
A grey cloud can therefore be completely normal. The mistake is assuming that either grey or orange is universally correct.
DNS-Only Does Not Mean the Record Is Broken
One common misunderstanding is that seeing a grey cloud means Cloudflare is not working. That is not necessarily true.
Cloudflare can still host and answer DNS queries for a DNS-only record. The difference is that Cloudflare is not sitting in the HTTP traffic path as a reverse proxy.
In other words, DNS can still work perfectly while the hostname remains DNS-only.
DNS-Only Does Not Mean No Security Anywhere
Another important distinction is that a grey cloud does not automatically mean your entire server has no security.
Your origin server may still have a firewall, intrusion prevention, access controls, operating-system security, application security, rate limiting, and other protections. The problem is that the request is not receiving Cloudflare’s proxy-based protection before reaching that origin.
This distinction becomes especially important when you are deciding whether to expose a public web application directly.
What Is the Difference Between Grey and Orange Cloud?
The practical difference between a grey cloud and an orange cloud is whether Cloudflare is acting as a reverse proxy for the hostname.
With a proxied orange-cloud record, Cloudflare can sit between the visitor and the origin. DNS responses for the proxied hostname resolve to Cloudflare’s network rather than directly exposing the configured origin IP. Cloudflare describes this architecture as a way to place its network between users and the origin server.
With a grey-cloud record, the DNS response contains the actual DNS destination. For an A or AAAA record, that can mean the origin IP address is visible to someone performing DNS lookups.
This difference can affect both security and performance.
Security Difference
For a public website, a grey cloud can expose the origin IP address. Cloudflare warns that DNS-only web records can expose origin IP addresses and potentially make the server easier to target directly.
An orange-cloud configuration can instead place Cloudflare between the public visitor and the origin. That allows eligible traffic to benefit from Cloudflare’s proxy-based security features.
This is particularly relevant for public websites, login pages, APIs, and applications that need protection against unwanted traffic.
Performance Difference
A grey cloud does not provide Cloudflare’s reverse-proxy caching and optimization features for that hostname. The visitor connects to the destination represented by the DNS record.
An orange-cloud configuration can allow Cloudflare to process eligible HTTP and HTTPS traffic through its edge network. Depending on the site’s configuration and content, this can support caching and other performance features.
However, proxying a record does not automatically make every website fast. Server response time, page weight, database queries, JavaScript, images, hosting quality, and application architecture still matter.
When Should You Use a Grey Cloud?
A grey cloud is often appropriate when the service should resolve through DNS but should not be routed through Cloudflare’s HTTP proxy.
The most obvious examples are email-related services and certain third-party verification records. Cloudflare specifically lists email and domain verification as common DNS-only use cases.
Email Records
Email infrastructure is one of the clearest examples. MX records cannot be proxied, and an A or AAAA record used exclusively for mail may also need to remain DNS-only.
For example, if your email provider requires mail.example.com to point directly to a mail server, changing that hostname to a proxied state without checking compatibility could interfere with the service.
Always follow your email provider’s DNS documentation before changing mail-related records.
Domain Verification
Some services ask you to create a DNS record to prove domain ownership. Depending on the record type and service requirements, DNS-only may be necessary.
A verification record does not need to serve website traffic. Its job is simply to allow another system to confirm that you control the domain.
Non-HTTP Services
Cloudflare’s HTTP proxy has specific compatibility requirements. Cloudflare states that only A, AAAA, and CNAME records serving HTTP or HTTPS traffic can be proxied. Other DNS record types cannot simply be switched into proxy mode.
If a service uses a protocol or configuration that is incompatible with Cloudflare’s HTTP proxy, keeping the appropriate record DNS-only may be the correct approach.
Special Application Requirements
Some applications have strict networking requirements or depend on direct connections to a particular endpoint. In these situations, developers should test the service carefully before enabling proxying.
The correct decision depends on the application architecture rather than the color of the cloud icon alone.
When Should You Avoid a Grey Cloud?
For a normal public website that serves HTTP or HTTPS traffic, leaving the hostname permanently on a grey cloud can remove useful Cloudflare protections.
Cloudflare recommends proxying A, AAAA, and CNAME records that serve web traffic. Proxied records can receive benefits such as DDoS protection, caching, WAF functionality, and other proxy-based features.
Imagine a website hosted on a single VPS. If its main DNS record is DNS-only, someone can potentially discover the origin IP through DNS and connect directly to the server.
That can make it harder to rely on Cloudflare as the public security layer.
Public Websites
A primary website such as example.com or www.example.com will commonly benefit from being proxied when its hosting setup is compatible.
Before making the change, confirm that your origin server is correctly configured for Cloudflare traffic and that your SSL/TLS configuration is appropriate.
Public Web Applications
Web applications can also benefit from proxying, particularly when they handle login forms, APIs, dashboards, or other sensitive traffic.
However, application developers should test authentication, headers, WebSockets, redirects, cookies, API behavior, and caching after changing proxy status.
APIs
An API that accepts HTTP or HTTPS requests may also be eligible for proxying. Cloudflare lists API endpoints that accept HTTP/HTTPS requests as a use case for proxied records, provided the endpoint does not require direct origin IP validation.
The exact configuration should depend on how the API authenticates users, handles caching, and validates requests.
How to Change a Grey Cloud to an Orange Cloud
Changing a grey cloud to an orange cloud is straightforward when the record is eligible for Cloudflare proxying.
Step 1: Open Your Cloudflare DNS Settings
Sign in to your Cloudflare account and select the relevant domain. Open the DNS records section where your A, AAAA, CNAME, MX, and other records are listed.
Cloudflare’s current DNS management documentation explains that A, AAAA, and CNAME records have a proxy-status option that determines whether hostname traffic is proxied through Cloudflare.
Step 2: Find the Correct Record
Locate the hostname you want to change. Do not change records simply because their cloud icon looks different from the others.
First identify what the record actually does.
For example, an A record for the main website may be suitable for proxying, while an MX record for email is not.
Step 3: Check Compatibility
Before enabling the orange cloud, verify that the service handles HTTP or HTTPS traffic and that its application architecture supports Cloudflare proxying.
This step can prevent avoidable outages.
Step 4: Switch Proxy Status
If the record is eligible, use the proxy-status control to change the DNS-only state to proxied.
The orange cloud indicates that Cloudflare will proxy eligible traffic for that hostname.
Step 5: Test the Website
Open the website in a private browser window and test important pages. If you operate an application, test login, forms, API requests, uploads, redirects, and other important functions.
Do not assume that a successful homepage load proves the entire application is working correctly.
How to Troubleshoot Grey Cloud Problems
A grey cloud can be intentional, but sometimes users discover it while troubleshooting a website or DNS configuration. The following checks can help identify the problem.
Problem: The Origin IP Is Visible
If your web record is DNS-only, its DNS destination can reveal the origin IP. Cloudflare specifically warns that DNS-only web records can expose origin addresses.
If your goal is to hide the origin behind Cloudflare, check whether the relevant HTTP or HTTPS record should be proxied.
Also look for other DNS records or services that may unintentionally reveal the same origin IP. Cloudflare notes that a DNS-only record pointing to the same origin as a proxied record can expose that origin.
Problem: The Website Stops Working After Proxying
If the site works with a grey cloud but fails after switching to orange, investigate the origin configuration.
Check SSL/TLS settings, firewall rules, supported ports, application headers, redirects, and server access controls. A hosting firewall may also be blocking Cloudflare’s traffic.
Cloudflare’s documentation explains that proxying changes the network path between visitors and the origin, so origin configurations may need adjustment.
Problem: SSL Errors Appear
SSL configuration deserves special attention when changing proxy status.
Cloudflare’s current documentation recommends Full or Full (strict) when possible. Full (strict) validates the origin certificate and requires an unexpired certificate that matches the hostname and is issued by a trusted CA or Cloudflare Origin CA.
If your origin does not have the correct certificate, switching proxy modes can reveal certificate or redirect problems that were previously hidden.
Problem: Email Stops Working
If email breaks after DNS changes, check your MX records and any hostnames used by your mail provider.
Email-related records generally need DNS-only treatment because Cloudflare’s standard HTTP proxy is not an email proxy. Cloudflare specifically states that MX records cannot be proxied.
Problem: A Third-Party Service Cannot Connect
Some third-party applications require a direct DNS response and are not compatible with Cloudflare’s HTTP proxy.
If a vendor specifically tells you to disable proxying, verify the requirement in its documentation before making the record DNS-only. Cloudflare also maintains documentation on proxying limitations and incompatible configurations.
Common Grey Cloud Myths You Should Know
The grey cloud setting is simple, but several misconceptions can lead to poor DNS decisions.
Myth 1: Grey Cloud Means Cloudflare Is Disabled
Not exactly. Cloudflare can still provide DNS hosting and answer DNS queries even when an individual record is DNS-only.
What changes is the proxy status for that record.
Myth 2: Orange Cloud Is Always Better
Orange is not automatically better for every DNS record.
Email and certain verification or non-HTTP services may need DNS-only configuration. Cloudflare itself recommends DNS-only for several services that are not compatible with its HTTP proxy.
The right configuration depends on the purpose of the record.
Myth 3: Grey Cloud Makes a Website More Private
A DNS-only web record can actually reveal the origin IP rather than hiding it.
If the goal is to conceal your origin server from ordinary public DNS resolution, proxying the web record may be more appropriate.
Myth 4: Changing the Cloud Color Fixes Every Security Problem
It does not.
A proxied record can add an important security layer, but your origin server still needs proper authentication, patching, firewall configuration, secure passwords, application security, backups, and monitoring.
Cloudflare should be part of a broader security strategy, not a replacement for one.
Grey Cloud and SSL/TLS Security
SSL/TLS is another area where DNS-only and proxied configurations can create confusion.
When a hostname is proxied, there are effectively two connections to consider: the visitor-to-Cloudflare connection and the Cloudflare-to-origin connection. Cloudflare’s SSL/TLS documentation describes these as separate connections controlled by the selected encryption mode.
With DNS-only, the visitor connects directly to the destination represented by DNS. That means the origin server itself is responsible for presenting the appropriate certificate to the visitor.
With a proxied configuration, Cloudflare can provide the edge connection while separately connecting to your origin according to the selected SSL/TLS mode.
For strong configurations, Cloudflare recommends Full or Full (strict), with Full (strict) providing certificate validation at the origin.
This is one reason you should not change a grey cloud to orange without checking your origin certificate and HTTPS configuration first.
Best Practices for Managing Grey Cloud Records
Good DNS management is less about choosing one cloud color everywhere and more about understanding what each record does.
Before changing a DNS record, ask these questions:
- Does this hostname serve HTTP or HTTPS traffic?
- Does the service require the visitor to connect directly to the origin?
- Does the record contain an origin IP that should remain private?
- Is the service email-related?
- Does the third-party provider require DNS-only?
- Is the origin server configured to accept Cloudflare traffic?
- Is the SSL/TLS configuration correct?
- Have you tested the application after changing the proxy status?
For website records, proxying is generally worth considering when the service is compatible with Cloudflare. For email and other services that cannot use the HTTP proxy, DNS-only is often necessary.
It is also useful to document why a record is DNS-only. This can save considerable time later when another administrator sees a grey cloud and assumes it was accidentally left that way.
How Grey Cloud Fits Into a Broader Website Strategy
Cloudflare DNS is only one part of a modern website infrastructure. A secure website also needs reliable hosting, HTTPS, application security, backups, sensible permissions, software updates, and monitoring.
For example, if you are building or maintaining a site around web development, you may also want to understand the fundamentals covered in Sharpener Tech’s Web Development guide. For broader security topics, related resources such as Cyber Security Job guide on Sharpener Tech can provide additional context around the wider cybersecurity field.
Your cloud configuration should also fit the rest of your infrastructure. If you use a cloud security approach, the existing Prevention Cloud guide on Sharpener Tech provides a useful related topic for understanding why proactive protection matters.
The key lesson is that a DNS setting should support your architecture rather than being changed simply because another website uses a particular configuration.
Grey Cloud vs Direct Origin Access
One of the biggest practical considerations is whether users should be able to reach the origin directly.
With DNS-only, the hostname can resolve toward the actual destination. If that destination is your web server, users can potentially connect directly to it.
With proxying, Cloudflare becomes the public-facing layer for supported traffic. Cloudflare explains that proxied DNS records resolve to Cloudflare anycast IPs instead of the original origin destination.
This distinction can be important during attacks or traffic spikes. If an attacker discovers a direct origin address that remains publicly reachable, they may attempt to bypass the proxy and target the server directly.
For this reason, website owners who use Cloudflare as their security layer should carefully review whether the origin can be discovered through another DNS record.
What Should Beginners Do With a Grey Cloud?
If you are new to Cloudflare, do not start by changing every grey cloud to orange.
Instead, create a simple inventory of your DNS records. Identify which records belong to the website, email, verification services, APIs, and other applications.
For the main website and HTTP or HTTPS services, check whether proxying is supported and whether the origin is correctly configured. For email and services that explicitly require DNS-only, leave them alone.
A cautious approach is better than making multiple DNS changes at the same time. If something breaks, changing one record at a time makes the cause much easier to identify.
You should also keep a backup or written record of the original DNS configuration before making major changes. DNS mistakes can affect websites, email, authentication, and third-party integrations, so documentation is valuable even for small websites.
Frequently Asked Questions About Grey Cloud
What does a grey cloud mean in Cloudflare?
A grey cloud means the DNS record is set to DNS-only. Cloudflare answers the DNS query but does not act as the HTTP reverse proxy for that hostname.
Is a grey cloud bad for a website?
Not necessarily. A grey cloud can be correct for email, verification, and certain non-HTTP services, but a public website may lose proxy-based Cloudflare protections when its web record is DNS-only.
Does a grey cloud expose my IP address?
If the DNS-only record points directly to your origin server, the record can reveal the origin IP address. Cloudflare warns that DNS-only web records can expose origin addresses.
Should my main website use a grey or orange cloud?
For an HTTP or HTTPS website that is compatible with Cloudflare proxying, the orange cloud is generally the configuration to consider because it allows Cloudflare’s proxy-based services to sit between visitors and the origin.
Should email records use a grey cloud?
Yes, email-related records commonly need DNS-only treatment. Cloudflare states that MX records cannot be proxied, and mail-specific hostnames may also need to remain DNS-only.
Can I switch from grey cloud to orange cloud?
Yes, eligible A, AAAA, and CNAME records can generally be switched from DNS-only to proxied through Cloudflare’s DNS settings. Always check compatibility and test the application afterward.
Does orange cloud automatically make my website secure?
No. Proxying can provide important Cloudflare security features, but it does not replace secure hosting, software updates, strong authentication, server hardening, backups, and application-level security.
What should I check if my website breaks after enabling the orange cloud?
Check your SSL/TLS mode, origin certificate, firewall rules, supported ports, redirects, application headers, and server configuration. Cloudflare recommends Full or Full (strict) when possible, with Full (strict) providing origin certificate validation.
Conclusion
A grey cloud in Cloudflare means that a DNS record is operating in DNS-only mode rather than being routed through Cloudflare’s reverse proxy. This can be exactly what you need for email, domain verification, and certain services that are not compatible with HTTP proxying.
For public websites and web applications, however, a grey cloud can mean that the origin server is directly exposed through DNS and that the hostname is not receiving Cloudflare’s proxy-based caching, WAF, and DDoS protection features. Cloudflare recommends proxying eligible A, AAAA, and CNAME records that serve HTTP or HTTPS traffic.
The safest approach is not to treat the grey cloud or orange cloud as universally good or bad. Understand what each DNS record does, check whether the service supports proxying, review your SSL/TLS configuration, protect your origin, and test changes carefully.
Once you understand the difference between DNS resolution and reverse proxying, the Cloudflare cloud icons become much easier to manage. The grey cloud is simply a signal that Cloudflare is answering for the DNS record without sitting in the traffic path, while the orange cloud indicates that eligible web traffic is being proxied through Cloudflare.
