Prerequisites:

• DNSSEC must be disabled at the current NS provider before switching
• NS records must only include the Cloudflare name servers; remove all existing NS records

Tips:

• The activation process may take up to 24 hours, so allocate buffer time. Don't wait until the last minute to add the domain.
• For partial (CNAME) zones, DNS TXT records may not be fully populated. Clearing DNS cache at 1.1.1.1 Purge and Google DNS Cache might speed up the process.

💡 Recommendation: Use Full Zone whenever possible for the best experience and full feature support.

Yes. Cloudflare supports wildcard (*) DNS records. On Enterprise plans, wildcard records can be proxied (orange-clouded). On Free/Pro/Business plans, wildcard DNS records are supported but will be DNS-only (grey-clouded).

Cloudflare only proxies traffic on specific ports by default:

HTTP: 80, 8080, 8880, 2052, 2082, 2086, 2095
HTTPS: 443, 2053, 2083, 2087, 2096, 8443

For non-standard ports, options include:

1. Cloudflare Spectrum (Enterprise) — proxy any TCP/UDP port
2. Origin Rules — rewrite the destination port at Cloudflare's edge
3. Workers — programmatically route to custom origin ports

A standard POC usually runs 2–4 weeks, depending on scope:

💡 Cloudflare's SE team can assist throughout the POC process.

No. Cloudflare operates as a reverse proxy — traffic flows through Cloudflare to the existing origin. The origin server configuration stays the same. The only change required is pointing DNS to Cloudflare.

💡 Best practice: Enable Managed Rules as baseline + add Custom Rules for specific business needs.

No. Cloudflare's DDoS protection is always-on and automatic. With a network capacity of 321+ Tbps, Cloudflare can absorb even the largest attacks. L3/L4 DDoS mitigation is included in all plans. L7 DDoS mitigation is available on all plans with configurable sensitivity levels.

Yes, via Magic Transit (for IP-level / network protection) and Spectrum (for individual TCP/UDP applications). These are Enterprise-level products designed to protect gaming servers, mail servers, custom protocols, and more.

By default, Cloudflare caches static resources based on file extension (e.g., .js, .css, .png, .jpg, .gif, .ico, .svg, .woff2).

HTML pages are NOT cached by default. To cache HTML or dynamic content, use:

• Cache Rules — fine-grained control over what to cache
• Page Rules (legacy) — Cache Everything setting
• Workers — programmatic cache control via the Cache API

💡 Use Cache-Control and CDN-Cache-Control headers from origin to fine-tune TTL behavior.

Tiered Cache adds an intermediate caching layer between Cloudflare edge and origin. Instead of every edge data center requesting content from origin on a cache miss, the request goes to a regional hub first.

Benefits:

• Reduces origin load significantly
• Improves cache hit ratio
• Lowers bandwidth costs

💡 Recommendation: Always enable Tiered Cache — especially for origins with high bandwidth costs (e.g., AWS, GCP).

Yes. Cloudflare supports WebSocket connections on all plans. WebSocket traffic is proxied through Cloudflare and benefits from DDoS protection. On Enterprise plans, Spectrum can also proxy WebSocket on custom ports.

💡 They work together as parts of Cloudflare One (SASE platform).

Yes. Cloudflare Access + WARP client can replace traditional VPN for most use cases:

• Per-app access control (vs. full network access)
• Identity-based policies (IdP integration)
• No inbound connections to corporate network
• Better performance (no hairpinning through a VPN concentrator)
• Works for both web apps and non-HTTP resources (SSH, RDP, SMB)

💡 Most partner deals focus on Enterprise plans with annual contracts.

Each zone (domain) on Cloudflare counts as a separate billable unit. Subdomains under the same zone do not incur additional zone charges. However, some add-on features (e.g., Rate Limiting, Argo) may be billed based on usage (requests, bandwidth).

Yes. Enterprise contracts often cover multiple zones under a single agreement. The pricing is typically based on total traffic volume and feature set rather than per-zone pricing.