Managing DNS records
If you provide a Cloudflare API token, the installer creates and updates records automatically. This page covers what you need when using it without a token, and when moving an address already in use.
Entering records manually
During installation, you are shown values in the form "this name → this address". Enter them as-is in your domain management screen.
The installer then checks by lookup that the name actually resolves to that address. If it hasn't propagated yet, it shows "waiting for propagation"; if a different value comes back, it reports it along with the expected value.
Two limitations without a token
- You can't get a wildcard certificate. A separate certificate is issued for each address.
- So you may hit the issuance rate limit — certificate authorities limit weekly issuances per domain. If you plan to run many systems and keep adding addresses, using a token is safer.
Before moving an address — lower the old TTL first
Before changing a record for a name already in use, lower that record's TTL first.
How quickly a change takes effect is decided by the old record's TTL, not the new record's TTL. The already-propagated old value has to expire before the new value is seen, so giving the new record a TTL of 60 doesn't help.
We have actually seen it fail to connect for a few minutes and then suddenly work in between. The symptom is "address not found", so you can't tell whether the settings are wrong or you just need to wait.
The order is:
- Lower the TTL of the old record (e.g. 60 seconds)
- Wait for the original TTL — the time for already-propagated values to expire
- Then change the record
What not to delete
Don't delete the _acme-challenge record
If you delete it once the certificate is issued, everything looks fine for now, then renewal silently fails. It is used not only at issuance but at every renewal.
If you use Cloudflare, gray cloud (DNS only)
If you turn on the orange cloud (proxy), Cloudflare receives connections on your behalf. Don't do that in a setup that exposes through the tunnel — it defeats the reason you chose that path.