If your domain's DNS is managed by Cloudflare, you'll need to point it at your Raleway hosting from the Cloudflare dashboard, not from cPanel. This guide covers:
- pointing your website and email at our server
- creating a free Cloudflare Origin certificate and installing it in cPanel
- choosing the right Cloudflare SSL settings, so you don't get redirect loops or 52x errors
Note: Because Cloudflare is your DNS provider, changes made in cPanel's Zone Editor have no effect. Make all DNS changes in Cloudflare.
Step 1: Get your server details from cPanel
- Log in to cPanel. In the General Information panel on the right, copy the Shared IP Address.
- If this isn't your hosting account's main domain, add it first in Domains › Domains (see How to add another domain or subdomain in cPanel).
- If you'll use email on this domain, go to Email › Email Deliverability, click Manage next to the domain and keep the page open. You'll need the suggested DKIM and SPF records.
Step 2: Add the DNS records in Cloudflare
In the Cloudflare dashboard, select your domain and go to DNS › Records. Add or update these records, replacing 203.0.113.10 with your server's IP address:
| Type | Name | Content | Proxy status |
|---|---|---|---|
| A | @ |
Server IP | Proxied (orange cloud) |
| A | www |
Server IP | Proxied (orange cloud) |
| A | mail |
Server IP | DNS only (grey cloud) |
| A | ftp |
Server IP | DNS only (grey cloud) |
| A | cpanel, webmail |
Server IP | DNS only (grey cloud) |
| MX | @ |
mail.yourdomain.co.uk, priority 0 |
Not applicable |
| TXT | @ |
Your SPF record from Email Deliverability, e.g. v=spf1 +a +mx +ip4:203.0.113.10 ~all |
Not applicable |
| TXT | default._domainkey |
The DKIM value from Email Deliverability | Not applicable |
| TXT | _dmarc |
v=DMARC1; p=none; rua=mailto:[email protected] |
Not applicable |
Important: Anything that isn't a website must be set to DNS only (grey cloud). Cloudflare's proxy only handles web traffic, so email, FTP and SSH won't connect through an orange-clouded record.
Tip: If you use Microsoft 365 or Google Workspace for email, use their MX, SPF and DKIM records instead of the email rows above. Then set Email › Email Routing in cPanel to Remote Mail Exchanger. If your email is hosted with us, set it to Local Mail Exchanger. Also make sure Cloudflare Email Routing is switched off, as it replaces your MX records.
Updates are usually live within a few minutes. If you've only just moved the domain to Cloudflare, make sure your registrar is using the two Cloudflare nameservers shown under DNS › Records.
Step 3: Create a Cloudflare Origin certificate
An Origin certificate encrypts the connection between Cloudflare and our server. It's free and lasts up to 15 years, so there's nothing to renew.
- In Cloudflare, go to SSL/TLS › Origin Server and click Create Certificate.
- Choose Generate private key and CSR with Cloudflare, with key type RSA (2048).
- Check that the hostnames list includes
yourdomain.co.ukand*.yourdomain.co.uk. - Choose a Certificate Validity (the default, 15 years, is fine) and click Create.
- Leave the key format as PEM. Copy the Origin Certificate and the Private Key into two separate text files on your computer.
Important: Cloudflare shows the private key only once. If you close the page without copying it, you'll need to revoke the certificate and create a new one.
Step 4: Install the certificate in cPanel
- In cPanel, go to Security › SSL/TLS and, under Install and Manage SSL for your site (HTTPS), click Manage SSL sites.
- Select your domain from the Domain menu.
- Paste the Origin Certificate (including the
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----lines) into Certificate: (CRT). - Paste the private key into Private Key (KEY).
- Leave Certificate Authority Bundle: (CABUNDLE) empty. If cPanel asks for one, you can paste in Cloudflare's Origin CA RSA root certificate from Cloudflare's documentation.
- Click Install Certificate.
Note: cPanel may say the certificate is self-signed or not trusted. That's expected. Origin certificates are only trusted by Cloudflare, not by web browsers, and visitors will see Cloudflare's own public certificate.
Step 5: Stop AutoSSL from replacing it
cPanel's AutoSSL treats certificates it doesn't recognise as invalid and may overwrite your Origin certificate with its own. To prevent this:
- Go to Security › SSL/TLS Status.
- Tick your domain and its
wwwentry (plus any other proxied subdomains). - Click Exclude Domains from AutoSSL.
Leave mail, cpanel and webmail included, because they aren't proxied and still need a publicly trusted certificate.
Step 6: Set the SSL mode in Cloudflare
- In Cloudflare, go to SSL/TLS › Overview. If you see Configure, click it and choose Custom SSL/TLS.
- Select Full (strict) and save.
- Go to SSL/TLS › Edge Certificates and turn on Always Use HTTPS.
| Cloudflare mode | Use it? |
|---|---|
| Full (strict) | Yes. Encrypted all the way, and Cloudflare checks the certificate on our server. |
| Full | Works, but doesn't check the certificate, so it's less secure. |
| Flexible | No. Traffic to our server isn't encrypted, and it causes redirect loops if HTTPS is forced in cPanel or WordPress. |
| Off | No. |
Step 7: Test
- Visit
https://yourdomain.co.ukandhttps://www.yourdomain.co.ukin a private or incognito window. - If you use WordPress, check that Settings › General uses
https://for both addresses. - Send and receive a test email.
- If you still see old content, go to Caching › Configuration in Cloudflare and click Purge Everything.
Connecting to the server (email, FTP and cPanel)
Because your main domain is proxied, yourdomain.co.uk points to Cloudflare, not directly to our server. When connecting to the server itself:
- Email apps: use the server hostname shown in cPanel under Email › Email Accounts › Connect Devices. See How to set up your email on a phone or computer.
- FTP: use
ftp.yourdomain.co.uk(DNS only) or the server hostname, notyourdomain.co.uk. - cPanel: use the Login to cPanel button in your client area, or
https://cpanel.yourdomain.co.ukorhttps://server-hostname:2083.
Note: The
mail and ftp records reveal your server's IP address. This is normal on shared hosting and can't be avoided if your email is hosted with us.Troubleshooting
| Error | Cause and fix |
|---|---|
| ERR_TOO_MANY_REDIRECTS | Cloudflare is set to Flexible. Change it to Full (strict) (Step 6). |
| Error 525: SSL handshake failed | There's no certificate for the domain on our server. Install the Origin certificate (Step 4). |
| Error 526: Invalid SSL certificate | The certificate on our server doesn't cover this hostname or has been replaced. Check that it includes both yourdomain.co.uk and *.yourdomain.co.uk, reinstall it and exclude the domain from AutoSSL (Step 5). |
| Error 521 or 522 | Cloudflare can't reach our server. Check that the A record uses the right IP address. If it's correct, contact support. |
| Email or FTP won't connect | The mail or ftp record is proxied (orange cloud). Switch it to DNS only. |
| Emails not arriving | Check the MX record points to mail.yourdomain.co.uk, that Cloudflare Email Routing is off, and that cPanel Email Routing is set to Local Mail Exchanger. |
| Certificate warning on webmail or cPanel | Use the server hostname, or make sure cpanel/webmail are DNS only and still included in AutoSSL. |
Still stuck? Contact Raleway support and our team will be happy to help.
