[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"tools-page-cloudflare-custom-hostname-checker":3},{"page":4,"related":241,"variants":260},{"path":5,"name":6,"title":7,"description":8,"checkedAt":9,"sources":10,"faq":98,"related":117,"nuxter":121,"body":124,"tool":239,"preset":240},"\u002Ftools\u002Fcloudflare-custom-hostname-checker","Cloudflare custom hostname checker","Cloudflare Custom Hostnames Checker for SaaS Domains","Check a Cloudflare for SaaS custom hostname from your browser. Reads its CNAME, ownership TXT, DCV records, CAA and certificates, and explains each error.","2026-10-06",[11,14,17,20,23,26,29,32,35,38,41,44,47,50,53,56,59,62,65,68,71,74,77,80,83,86,89,92,95],{"label":12,"url":13},"Cloudflare for SaaS docs, Configuring Cloudflare for SaaS","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fstart\u002Fgetting-started\u002F",{"label":15,"url":16},"Cloudflare for SaaS docs, Plans","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fplans\u002F",{"label":18,"url":19},"Cloudflare for SaaS docs, Quotas and billing","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fquotas-and-billing\u002F",{"label":21,"url":22},"Cloudflare for SaaS docs, Create custom hostnames","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fcreate-custom-hostnames\u002F",{"label":24,"url":25},"Cloudflare for SaaS docs, Hostname validation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fhostname-validation\u002F",{"label":27,"url":28},"Cloudflare for SaaS docs, Pre-validation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fhostname-validation\u002Fpre-validation\u002F",{"label":30,"url":31},"Cloudflare for SaaS docs, Real-time validation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fhostname-validation\u002Frealtime-validation\u002F",{"label":33,"url":34},"Cloudflare for SaaS docs, Backoff schedule","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fhostname-validation\u002Fbackoff-schedule\u002F",{"label":36,"url":37},"Cloudflare for SaaS docs, Validation status","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fhostname-validation\u002Fvalidation-status\u002F",{"label":39,"url":40},"Cloudflare for SaaS docs, Error codes","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fdomain-support\u002Fhostname-validation\u002Ferror-codes\u002F",{"label":42,"url":43},"Cloudflare for SaaS docs, Validate certificates","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsecurity\u002Fcertificate-management\u002Fissue-and-validate\u002Fvalidate-certificates\u002F",{"label":45,"url":46},"Cloudflare for SaaS docs, HTTP validation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsecurity\u002Fcertificate-management\u002Fissue-and-validate\u002Fvalidate-certificates\u002Fhttp\u002F",{"label":48,"url":49},"Cloudflare for SaaS docs, TXT validation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsecurity\u002Fcertificate-management\u002Fissue-and-validate\u002Fvalidate-certificates\u002Ftxt\u002F",{"label":51,"url":52},"Cloudflare for SaaS docs, Delegated DCV","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsecurity\u002Fcertificate-management\u002Fissue-and-validate\u002Fvalidate-certificates\u002Fdelegated-dcv\u002F",{"label":54,"url":55},"Cloudflare for SaaS docs, Troubleshooting certificate validation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsecurity\u002Fcertificate-management\u002Fissue-and-validate\u002Fvalidate-certificates\u002Ftroubleshooting\u002F",{"label":57,"url":58},"Cloudflare for SaaS docs, Renew certificates","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsecurity\u002Fcertificate-management\u002Fissue-and-validate\u002Frenew-certificates\u002F",{"label":60,"url":61},"Cloudflare for SaaS docs, Token validity periods","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Freference\u002Ftoken-validity-periods\u002F",{"label":63,"url":64},"Cloudflare for SaaS docs, Troubleshooting","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Freference\u002Ftroubleshooting\u002F",{"label":66,"url":67},"Cloudflare for SaaS docs, Custom hostname status codes","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Freference\u002Fstatus-codes\u002Fcustom-hostnames\u002F",{"label":69,"url":70},"Cloudflare for SaaS docs, Apex proxying","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fstart\u002Fadvanced-settings\u002Fapex-proxying\u002F",{"label":72,"url":73},"Cloudflare for SaaS docs, How O2O works","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fcloudflare-for-platforms\u002Fcloudflare-for-saas\u002Fsaas-customers\u002Fhow-it-works\u002F",{"label":75,"url":76},"Cloudflare SSL\u002FTLS docs, Certificate authorities","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fssl\u002Freference\u002Fcertificate-authorities\u002F",{"label":78,"url":79},"Cloudflare DNS docs, CNAME flattening","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fdns\u002Fcname-flattening\u002F",{"label":81,"url":82},"Cloudflare IP ranges","https:\u002F\u002Fwww.cloudflare.com\u002Fips\u002F",{"label":84,"url":85},"Cloudflare blog, Introducing DCV Delegation","https:\u002F\u002Fblog.cloudflare.com\u002Fintroducing-dcv-delegation\u002F",{"label":87,"url":88},"RFC 8659, DNS Certification Authority Authorization (CAA) Resource Record","https:\u002F\u002Fwww.rfc-editor.org\u002Frfc\u002Frfc8659",{"label":90,"url":91},"crt.sh, Certificate Search","https:\u002F\u002Fcrt.sh\u002F",{"label":93,"url":94},"Cloudflare 1.1.1.1 docs, DNS over HTTPS with JSON","https:\u002F\u002Fdevelopers.cloudflare.com\u002F1.1.1.1\u002Fencryption\u002Fdns-over-https\u002Fmake-api-requests\u002Fdns-json\u002F",{"label":96,"url":97},"Google Public DNS, JSON API for DNS over HTTPS","https:\u002F\u002Fdevelopers.google.com\u002Fspeed\u002Fpublic-dns\u002Fdocs\u002Fdoh\u002Fjson",[99,102,105,108,111,114],{"question":100,"answer":101},"Why does Cloudflare say the custom hostname does not CNAME to this zone?","Cloudflare looked up the hostname and found no CNAME to your SaaS zone, and your zone has no apex proxying. Usually the customer hasn't added the record yet, pointed it at the wrong name, or uses a DNS provider that hides the CNAME behind flattening. The checker shows where the hostname points now. Publishing the ownership TXT record lets Cloudflare validate the hostname before the CNAME is in place, except when the customer's own domain is on Cloudflare too.",{"question":103,"answer":104},"Can my customers use an apex domain as a custom hostname?","Most DNS providers don't allow a CNAME at the apex. A customer whose provider offers CNAME flattening, as Cloudflare does, can still add one, but it answers with addresses, so public DNS shows A records instead of the CNAME. Otherwise Cloudflare's answer is apex proxying, where the customer adds A records for IP addresses Cloudflare assigns your account. It's an Enterprise add-on.",{"question":106,"answer":107},"What's the difference between hostname validation and certificate validation?","Hostname validation proves the customer controls the hostname, through the CNAME or the _cf-custom-hostname TXT record, and moves the hostname's status to Active. Certificate validation proves it to the certificate authority, through HTTP, TXT tokens at _acme-challenge or a delegation CNAME, and moves ssl.status to Active. The hostname serves your app only once both are Active and its DNS points at your target.",{"question":109,"answer":110},"Which CAA records does Cloudflare for SaaS need?","None, if the customer publishes no CAA records. If they do, the records must allow the CA that issues the hostname's certificate, and Cloudflare uses Google Trust Services, Let's Encrypt and SSL.com for custom hostnames. A CA reads CAA at the hostname first, following any CNAME, then at each name above it, and the first name with records decides. The values to publish are in the table on this page.",{"question":112,"answer":113},"How much do Cloudflare custom hostnames cost?","Free, Pro and Business zones include some custom hostnames and charge a flat fee for each one past that, up to a ceiling, while Enterprise pricing is set by contract. The table on this page has the current numbers. Every hostname counts until you delete it, including ones still waiting for validation.",{"question":115,"answer":116},"Why does the checker search crt.sh?","crt.sh searches the public Certificate Transparency logs, where publicly trusted certificates are recorded. Its results show whether a certificate for the hostname exists, who issued the latest one and when it expires. crt.sh is often slow, and when it doesn't answer, the DNS checks still stand on their own.",[118,119,120],"spf-dkim-dmarc-checker","cloudflare-workers-pricing-calculator","cloudflare-cron-generator",{"body":122,"to":123},"Nuxter is a Nuxt 4 starter kit for Cloudflare Workers, with Postgres through Hyperdrive, Queues for background jobs and wrangler cron triggers. Put Cloudflare for SaaS in front of it when your customers bring their own domains.","\u002Ffeatures",{"type":125,"value":126,"toc":231},"minimark",[127,132,149,167,171,178,184,188,191,202,219,223],[128,129,131],"h2",{"id":130},"how-a-custom-hostname-goes-live","How a custom hostname goes live",[133,134,135,136,140,141,144,145,148],"p",{},"Cloudflare for SaaS runs two checks on every custom hostname, and they use different records. Hostname validation proves your customer controls the name. It passes when the hostname is a CNAME to your SaaS zone, or, before the customer changes DNS, when the TXT record from ",[137,138,139],"code",{},"ownership_verification"," sits at ",[137,142,143],{},"_cf-custom-hostname.\u003Chostname>",". It sets the hostname's ",[137,146,147],{},"status",".",[133,150,151,152,155,156,159,160,166],{},"Certificate validation, or DCV, proves the same thing to the certificate authority, and it sets ",[137,153,154],{},"ssl.status",". Cloudflare treats a hostname as ready when both read ",[137,157,158],{},"active"," and the hostname's DNS points at your target (",[161,162,165],"a",{"href":37,"rel":163},[164],"nofollow","Cloudflare docs",").",[128,168,170],{"id":169},"the-cname-the-apex-and-o2o","The CNAME, the apex and O2O",[133,172,173,174,177],{},"Your customer adds a CNAME from their hostname to your CNAME target, such as ",[137,175,176],{},"customers.yoursaas.com",", and your target is a proxied record that points at your fallback origin. The checker follows the chain and says whether it reaches your target, and whether your target answers with Cloudflare's addresses.",[133,179,180,181,166],{},"Some setups hide the CNAME. At the apex of a zone most DNS providers refuse a CNAME, and those that offer CNAME flattening answer with the target's addresses instead. A customer whose own domain is on Cloudflare can proxy the CNAME, which Cloudflare calls O2O, and public DNS then shows only Cloudflare addresses. The checker can't see past either, so it says so rather than guessing. For apex domains Cloudflare also offers apex proxying, where customers add A records for IP addresses assigned to your account (",[161,182,165],{"href":70,"rel":183},[164],[128,185,187],{"id":186},"three-ways-to-validate-the-certificate","Three ways to validate the certificate",[133,189,190],{},"Automatic HTTP validation needs nothing from your customer: once the hostname points at your target, Cloudflare serves the certificate authority's token itself. It can't cover a wildcard, and it can't finish before the DNS change.",[133,192,193,194,197,198,201],{},"TXT validation puts each token from ",[137,195,196],{},"ssl.validation_records"," at ",[137,199,200],{},"_acme-challenge.\u003Chostname>",". It works before the DNS change, but the tokens expire, sooner for some certificate authorities than others, so a customer who waits too long needs new ones. A wildcard certificate needs two tokens.",[133,203,204,205,207,208,211,212,215,216,166],{},"Delegated DCV replaces the tokens with one CNAME, from ",[137,206,200],{}," to ",[137,209,210],{},"\u003Chostname>.\u003Cyour delegation hostname>",", which Cloudflare shows on the Custom Hostnames page. Cloudflare then places the tokens for every renewal. An existing ",[137,213,214],{},"_acme-challenge"," TXT record stops it from working, so the checker looks for one (",[161,217,165],{"href":52,"rel":218},[164],[128,220,222],{"id":221},"caa-records","CAA records",[133,224,225,226,230],{},"A CAA record names the certificate authorities allowed to issue for a domain. The authority reads CAA at the hostname, following any CNAME, and climbs one label at a time until a name has records; that set decides (",[161,227,229],{"href":88,"rel":228},[164],"RFC 8659","). The checker walks the same path and tests the set against the three authorities Cloudflare uses for custom hostnames. When it blocks one, it writes the records that would allow it.",{"title":232,"searchDepth":233,"depth":233,"links":234},"",2,[235,236,237,238],{"id":130,"depth":233,"text":131},{"id":169,"depth":233,"text":170},{"id":186,"depth":233,"text":187},{"id":221,"depth":233,"text":222},"cloudflare-custom-hostname-checker",null,[242,248,254],{"path":243,"tool":118,"name":244,"title":245,"description":246,"summary":247,"checkedAt":9},"\u002Ftools\u002Fspf-dkim-dmarc-checker","SPF, DKIM and DMARC checker","SPF DKIM DMARC Checker for Resend and Cloudflare","A free SPF DKIM DMARC checker with presets for Resend, Cloudflare Email, Google and Microsoft 365. Reads the right hosts, counts SPF lookups, explains fixes.","Look up and grade a domain's SPF, DKIM and DMARC, with presets that read the hosts Resend, Cloudflare and others use.",{"path":249,"tool":119,"name":250,"title":251,"description":252,"summary":253,"checkedAt":9},"\u002Ftools\u002Fcloudflare-workers-pricing-calculator","Cloudflare Workers pricing calculator","Cloudflare Workers Pricing Calculator for a SaaS","Cloudflare Workers pricing calculator for a SaaS. Turn monthly users into a bill for Workers, D1, KV, R2, Queues and AI, and find the first Free limit you hit.","Turn monthly users into a Workers, D1, KV, R2, Queues and AI bill, and find the first Free plan limit you hit.",{"path":255,"tool":120,"name":256,"title":257,"description":258,"summary":259,"checkedAt":9},"\u002Ftools\u002Fcloudflare-cron-generator","Cloudflare cron trigger generator","Cloudflare Cron Triggers Generator and Tester","Build and test Cloudflare Cron Triggers: plain-English meaning, the next runs in UTC and your time zone, and the Wrangler and Nitro scheduledTasks config.","Build a cron trigger, read it in plain English, see its next runs and copy the Wrangler and Nitro config.",[]]