Creating a subdomain in Cloudflare

A subdomain can give a presentation site, customer portal or test environment its own address. portal.example.com belongs to example.com, but it can point to a separate application. A Cloudflare DNS record initially configures name resolution. It does not install an application or create a website. Hosting and HTTPS must be configured as well.

Confirm the destination and hosting first

Create the subdomain at your hosting provider or assign its hostname to the appropriate application. Check which directory or virtual host should serve the content. Obtain the destination IP address or hostname from the provider. It is not necessarily the same destination as the main domain: a customer portal may run on another server. The addresses in this article are examples, not settings for your own hosting.

Choose the correct DNS record

Use an A record for an IPv4 address and an AAAA record for IPv6. If the provider supplies a hostname, you may need a CNAME record. A CNAME target is a hostname rather than a complete web address. Do not include https://, a path or a port number. A CNAME cannot coexist with A or AAAA records at the same name. Do not change verification or email records without understanding their purpose.

A CNAME target is a hostname, not a URL or path

Create the record in Cloudflare

1. Open the appropriate domain in Cloudflare and go to its DNS records page.
2. Select Add record and choose the type that matches your provider’s instructions.
3. Enter the subdomain label in Name, for example portal. Enter the actual destination in the IP address or Target field.
4. Choose the proxy status and TTL appropriate for the service, check the values and save the record.

Before saving, check whether a record already uses that name. The DNS zone must be active, and the domain’s actual nameservers must correspond to the zone you are editing. Saving a record at Cloudflare does not redirect traffic if another active DNS provider is authoritative for the domain. This is especially worth checking after a provider change.

Understand Proxied and DNS only

With Proxied enabled, web traffic reaches the origin server through Cloudflare. With DNS only, name resolution returns the server’s actual address and the browser connects directly to the hosting. Proxying is not suitable for every service. Follow the provider’s requirements for ownership-verification records or email-related hostnames. Do not enable the proxy merely because the option is available.

DNS only: the visitor connects directly to the server

Check HTTPS separately

For a proxied record, the visitor-to-Cloudflare connection and the Cloudflare-to-origin connection are separate stages. Full (strict) requires a valid certificate covering the hostname on the origin server too. With DNS only, the browser checks the hosting server’s certificate directly. A Cloudflare certificate therefore does not automatically provide HTTPS for a server that visitors access directly.

In a full DNS zone setup, Universal SSL generally covers the root domain and first-level subdomains. portal.example.com and dev.portal.example.com are different cases. For deeper hostnames, check the certificate coverage and the Cloudflare setup separately. Disabling certificate validation is not a sound permanent solution to a certificate problem.

Verify the setup in stages

Use nslookup portal.example.com to check name resolution, then open the HTTPS address in a browser. Cloudflare IP addresses are expected for a proxied record; a difference from the hosting IP is not itself an error. Check that the correct content loads, inspect the certificate and test the application’s redirects. Successful DNS resolution alone does not prove that the intended website is being served.

Working DNS alone does not create a working website

TTL controls how long a DNS answer can be cached. For proxied records, Auto corresponds to 300 seconds. Previously cached answers and local caches can still make a change appear at different times for different visitors. If resolution fails, check the zone and record name first. If the wrong content loads, check the hostname assignment at the hosting provider. For HTTPS errors, investigate the certificate and SSL/TLS mode.

Official documentation

• Cloudflare · Subdomain records
• Cloudflare · Manage DNS records
• Cloudflare · Proxy status
• Cloudflare · TTL
• Cloudflare · Records with the same name
• Cloudflare · Full (strict)
• Cloudflare · Universal SSL limitations

Technical guidance checked on 13 October 2026. The interface and available features may change.