Programmer’s Reference
Understand DNS, proxying, TLS, caching, and Tunnel troubleshooting.
Public examples use reserved demo hostnames. DNS and security changes need the correct zone and existing organizational policy. No credentials or private origins are shown.
Select a term for its definition, syntax, example, and common mistakes.
Query a reserved example hostname and a domain’s mail-routing records using dig.
dig demo.example.com A
dig example.com MXPractical useCheck a demo hostname’s DNS before troubleshooting a website.
Common mistakesdig requires DNS tools. Proxied A/AAAA responses normally show Cloudflare addresses rather than the origin. MX records route mail, not web traffic.
Proxy supported web records through Cloudflare for its HTTP services; DNS-only records resolve to their configured target.
⚠ Caution: Changing proxy state changes routing and may expose the origin address.
Demo web record: A or CNAME → Proxied
Demo mail-host record: A → DNS only
MX record: mail routing (not an HTTP proxy record)Practical useKeep web hosting and mail routing separate in a demo architecture.
Common mistakesDo not proxy a mail host that needs direct SMTP/IMAP access. Changing proxy state affects routing and can expose a previously hidden origin.
Request response headers from a reserved demo URL to investigate status and caching.
curl -I https://demo.example.com/Practical useCheck a staging page’s headers after a release.
Common mistakesHEAD may behave differently from GET. Headers alone do not prove application health, and cache status can vary by request.
Validate the origin certificate when Cloudflare connects to the origin under Full (strict).
⚠ Caution: Changing encryption mode can make a site unavailable if the origin does not satisfy its requirements.
Dashboard → SSL/TLS → Overview → Full (strict)
Prerequisite: origin HTTPS with a valid, matching, unexpired certificate.Practical useDocument a demo public web origin’s TLS requirements.
Common mistakesThis is a configuration plan, not a command. Check existing routing; Tunnel has its own connection model. An unsuitable origin certificate can cause errors.
For an already configured Access-protected SSH hostname, connect through cloudflared as the SSH proxy.
ssh -o ProxyCommand="cloudflared access ssh --hostname %h" [email protected]Practical useModel the established access pattern using public placeholders.
Common mistakesThis assumes existing Access policy, tunnel routing, host keys, and authorized SSH keys. Do not disable authentication to avoid a login prompt.
Create narrowly scoped tokens only when an authorized integration requires API access. Store the value outside public files.
Token scope example: one demo zone
Permission example: Zone → DNS → Read
Storage: private secret store, never a browser scriptPractical useDesign a read-only demo DNS inventory integration.
Common mistakesDo not use a global API key for routine automation. Never paste real tokens into reference examples, logs, or Git.
Inspect the installed connector version and, on a systemd host with that unit, its service state.
cloudflared --version
systemctl status cloudflared --no-pager
journalctl -u cloudflared -n 30 --no-pagerPractical useA application should distinguish locally managed services from externally managed connectors.
Common mistakesThe connector may run elsewhere or under a different unit. Do not label it stopped based only on a missing local service. Logs can reveal private details.
For an existing locally managed tunnel configuration, validate its ingress rules and test which rule matches a demo URL.
cloudflared tunnel ingress validate
cloudflared tunnel ingress rule https://demo.example.comPractical useCheck routing in a sanitized local tunnel prototype.
Common mistakesThese commands are for locally managed ingress configuration, not dashboard-managed routes. Do not print or share credential files.
Purge only a changed demo URL through the dashboard, then fetch the page again to verify the new content.
⚠ Caution: Invalidates cached content and can increase origin traffic.
Dashboard → Caching → Configuration → Purge Cache
Choose Custom Purge → URL
Example: https://demo.example.com/reference/Practical useVerify a demo reference update after its origin deployment.
Common mistakesA purge does not deploy new content or clear every browser cache. Avoid a zone-wide purge when a small URL set is sufficient.