Setup and operations
Setting Up Cloudflare in Front of a Routing Domain
An edge layer changes the network path and can affect headers, TLS, caching, and origin reachability, so every assumption needs a test.
Establish DNS and zone ownership
Identify the zone, public hostname, current records, certificate state, and person authorized to change them. Lower change risk with a documented previous value and a dedicated campaign hostname when appropriate.
Protect the origin contract
Configure the record and TLS mode according to the deployed origin, then verify which visitor IP and scheme headers reach DuckRoute. Do not trust arbitrary forwarded headers unless they come through the controlled edge path.
Keep dynamic decisions out of accidental cache
Review cache rules, redirects, Workers, and page rules that apply to the campaign hostname. A cached White Page or Target response can make correct router decisions appear inconsistent across visitors.
Check overlapping edge logic
Multiple canonical redirects, forced host changes, path rewrites, or an origin pointing back to the public hostname can create cycles. Trace the request with and without the edge proxy before adding more rules.
Verify and monitor cutover
Confirm DNS resolution, TLS, public responses, request context, both destinations, and rollback from independent clients. Retest after edge configuration changes because they can alter routing inputs without any DuckRoute edit.