Skip to content
Sign in
Buy Nuxter

Cloudflare & database

Cloudflare Custom Hostnames Checker for SaaS Domains

Check a Cloudflare for SaaS custom hostname from your browser. Reads its CNAME, ownership TXT, DCV records, CAA and certificates, and explains each error.

  • Asks Cloudflare DNS
  • Falls back to Google DNS
  • Searches crt.sh

Checked

01Tool

Tool

Or a URL
The host customers point at
Certificate validation

Cloudflare serves the CA's token itself once the hostname points at your target.

Enterprise only. Adds the wildcard of the hostname to its certificate, which HTTP validation can't cover.

Optional
ownership_verification.value from the API. Only pre-validation needs it.

Enter your customer's hostname and the CNAME target you gave them. The checker reads the records Cloudflare validates and explains each result.

Nothing leaves your browser until you press Check. Then the hostname, your target and the names under the hostname that Cloudflare reads go to Cloudflare's DNS resolver, or to Google's if Cloudflare's doesn't answer, and the hostname goes to crt.sh. The ownership value and the tokens you paste are compared on this page and never sent. The hostname, the target, the validation method and the wildcard setting go in the page address so you can share the result.

Explain a Cloudflare error

From verification_errors, ssl.validation_errors, the dashboard or a page your visitors see.

02Guide

How it works

How a custom hostname goes live

Cloudflare for SaaS runs two checks on every custom hostname, and they use different records. Hostname validation proves your customer controls the name. It passes when the hostname is a CNAME to your SaaS zone, or, before the customer changes DNS, when the TXT record from ownership_verification sits at _cf-custom-hostname.<hostname>. It sets the hostname's status.

Certificate validation, or DCV, proves the same thing to the certificate authority, and it sets ssl.status. Cloudflare treats a hostname as ready when both read active and the hostname's DNS points at your target (Cloudflare docs).

The CNAME, the apex and O2O

Your customer adds a CNAME from their hostname to your CNAME target, such as customers.yoursaas.com, and your target is a proxied record that points at your fallback origin. The checker follows the chain and says whether it reaches your target, and whether your target answers with Cloudflare's addresses.

Some setups hide the CNAME. At the apex of a zone most DNS providers refuse a CNAME, and those that offer CNAME flattening answer with the target's addresses instead. A customer whose own domain is on Cloudflare can proxy the CNAME, which Cloudflare calls O2O, and public DNS then shows only Cloudflare addresses. The checker can't see past either, so it says so rather than guessing. For apex domains Cloudflare also offers apex proxying, where customers add A records for IP addresses assigned to your account (Cloudflare docs).

Three ways to validate the certificate

Automatic HTTP validation needs nothing from your customer: once the hostname points at your target, Cloudflare serves the certificate authority's token itself. It can't cover a wildcard, and it can't finish before the DNS change.

TXT validation puts each token from ssl.validation_records at _acme-challenge.<hostname>. It works before the DNS change, but the tokens expire, sooner for some certificate authorities than others, so a customer who waits too long needs new ones. A wildcard certificate needs two tokens.

Delegated DCV replaces the tokens with one CNAME, from _acme-challenge.<hostname> to <hostname>.<your delegation hostname>, which Cloudflare shows on the Custom Hostnames page. Cloudflare then places the tokens for every renewal. An existing _acme-challenge TXT record stops it from working, so the checker looks for one (Cloudflare docs).

CAA records

A CAA record names the certificate authorities allowed to issue for a domain. The authority reads CAA at the hostname, following any CNAME, and climbs one label at a time until a name has records; that set decides (RFC 8659). The checker walks the same path and tests the set against the three authorities Cloudflare uses for custom hostnames. When it blocks one, it writes the records that would allow it.

03Rates

The numbers it uses

Cloudflare for SaaS plans and limits
ItemLimitSource
Custom hostnames included Free, Pro and Business100developers.cloudflare.com
Each additional hostname Free, Pro and Business$0.10developers.cloudflare.com
Custom hostnames, at most Free, Pro and Business50,000developers.cloudflare.com
Apex proxying Enterprise add-ondevelopers.cloudflare.com
Wildcard custom hostnames Enterprisedevelopers.cloudflare.com
Hostname validation attempts 75 over 7 daysdevelopers.cloudflare.com
A Moved hostname is deleted after 7 daysdevelopers.cloudflare.com
Certificate validity 90 daysdevelopers.cloudflare.com
Renewal opens before expiry 30 daysdevelopers.cloudflare.com
Certificates issued 15 a minutedevelopers.cloudflare.com
Common Name length, at most 64 charactersdevelopers.cloudflare.com
DCV tokens and CAA values per certificate authority
ItemValueSource
Google Trust Services, DCV token lifetime 14 daysdevelopers.cloudflare.com
Google Trust Services, CAA value pki.goog; cansignhttpexchanges=yesdevelopers.cloudflare.com
Let's Encrypt, DCV token lifetime 7 daysdevelopers.cloudflare.com
Let's Encrypt, CAA value letsencrypt.orgdevelopers.cloudflare.com
SSL.com, DCV token lifetime 14 daysdevelopers.cloudflare.com
SSL.com, CAA value ssl.comdevelopers.cloudflare.com

04Questions

Questions

Why does Cloudflare say the custom hostname does not CNAME to this zone?
Cloudflare looked up the hostname and found no CNAME to your SaaS zone, and your zone has no apex proxying. Usually the customer hasn't added the record yet, pointed it at the wrong name, or uses a DNS provider that hides the CNAME behind flattening. The checker shows where the hostname points now. Publishing the ownership TXT record lets Cloudflare validate the hostname before the CNAME is in place, except when the customer's own domain is on Cloudflare too.
Can my customers use an apex domain as a custom hostname?
Most DNS providers don't allow a CNAME at the apex. A customer whose provider offers CNAME flattening, as Cloudflare does, can still add one, but it answers with addresses, so public DNS shows A records instead of the CNAME. Otherwise Cloudflare's answer is apex proxying, where the customer adds A records for IP addresses Cloudflare assigns your account. It's an Enterprise add-on.
What's the difference between hostname validation and certificate validation?
Hostname validation proves the customer controls the hostname, through the CNAME or the _cf-custom-hostname TXT record, and moves the hostname's status to Active. Certificate validation proves it to the certificate authority, through HTTP, TXT tokens at _acme-challenge or a delegation CNAME, and moves ssl.status to Active. The hostname serves your app only once both are Active and its DNS points at your target.
Which CAA records does Cloudflare for SaaS need?
None, if the customer publishes no CAA records. If they do, the records must allow the CA that issues the hostname's certificate, and Cloudflare uses Google Trust Services, Let's Encrypt and SSL.com for custom hostnames. A CA reads CAA at the hostname first, following any CNAME, then at each name above it, and the first name with records decides. The values to publish are in the table on this page.
How much do Cloudflare custom hostnames cost?
Free, Pro and Business zones include some custom hostnames and charge a flat fee for each one past that, up to a ceiling, while Enterprise pricing is set by contract. The table on this page has the current numbers. Every hostname counts until you delete it, including ones still waiting for validation.
Why does the checker search crt.sh?
crt.sh searches the public Certificate Transparency logs, where publicly trusted certificates are recorded. Its results show whether a certificate for the hostname exists, who issued the latest one and when it expires. crt.sh is often slow, and when it doesn't answer, the DNS checks still stand on their own.

05Sources

Sources

Every fact on this page was read from these pages on .

  1. Cloudflare for SaaS docs, Configuring Cloudflare for SaaSdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/
  2. Cloudflare for SaaS docs, Plansdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/plans/
  3. Cloudflare for SaaS docs, Quotas and billingdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/quotas-and-billing/
  4. Cloudflare for SaaS docs, Create custom hostnamesdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/create-custom-hostnames/
  5. Cloudflare for SaaS docs, Hostname validationdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/
  6. Cloudflare for SaaS docs, Pre-validationdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/pre-validation/
  7. Cloudflare for SaaS docs, Real-time validationdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/realtime-validation/
  8. Cloudflare for SaaS docs, Backoff scheduledevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/backoff-schedule/
  9. Cloudflare for SaaS docs, Validation statusdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/validation-status/
  10. Cloudflare for SaaS docs, Error codesdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/error-codes/
  11. Cloudflare for SaaS docs, Validate certificatesdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/
  12. Cloudflare for SaaS docs, HTTP validationdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/http/
  13. Cloudflare for SaaS docs, TXT validationdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/txt/
  14. Cloudflare for SaaS docs, Delegated DCVdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/delegated-dcv/
  15. Cloudflare for SaaS docs, Troubleshooting certificate validationdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/troubleshooting/
  16. Cloudflare for SaaS docs, Renew certificatesdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/renew-certificates/
  17. Cloudflare for SaaS docs, Token validity periodsdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/reference/token-validity-periods/
  18. Cloudflare for SaaS docs, Troubleshootingdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/reference/troubleshooting/
  19. Cloudflare for SaaS docs, Custom hostname status codesdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/reference/status-codes/custom-hostnames/
  20. Cloudflare for SaaS docs, Apex proxyingdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/advanced-settings/apex-proxying/
  21. Cloudflare for SaaS docs, How O2O worksdevelopers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/saas-customers/how-it-works/
  22. Cloudflare SSL/TLS docs, Certificate authoritiesdevelopers.cloudflare.com/ssl/reference/certificate-authorities/
  23. Cloudflare DNS docs, CNAME flatteningdevelopers.cloudflare.com/dns/cname-flattening/
  24. Cloudflare IP rangescloudflare.com/ips/
  25. Cloudflare blog, Introducing DCV Delegationblog.cloudflare.com/introducing-dcv-delegation/
  26. RFC 8659, DNS Certification Authority Authorization (CAA) Resource Recordrfc-editor.org/rfc/rfc8659
  27. crt.sh, Certificate Searchcrt.sh/
  28. Cloudflare 1.1.1.1 docs, DNS over HTTPS with JSONdevelopers.cloudflare.com/1.1.1.1/encryption/dns-over-https/make-api-requests/dns-json/
  29. Google Public DNS, JSON API for DNS over HTTPSdevelopers.google.com/speed/public-dns/docs/doh/json

Found something out of date? Tell us.

06Related

Related tools

All tools

Nuxter

Building a SaaS on Nuxt?

Nuxter is a Nuxt 4 starter kit for Cloudflare Workers, with Postgres through Hyperdrive, Queues for background jobs and wrangler cron triggers. Put Cloudflare for SaaS in front of it when your customers bring their own domains.

See what Nuxter includesFrom $249, one-time.