What the DNS, CDN/Proxy, and SSL Results Mean on Check for Cloudflare

Check for Cloudflare by Selesti reports three separate signals — DNS, CDN/Proxy, and SSL — and each answers a different question. DNS tells you whether the domain's name servers or DNS records point at Cloudflare. CDN/Proxy tells you whether traffic is actually routed through Cloudflare's network. SSL tells you whether Cloudflare is terminating or fronting the TLS certificate. A domain can pass one check and fail another, so read the three results together rather than treating any single one as the final answer.

Why the tool splits the result into three checks

Cloudflare is not one product. A domain can use Cloudflare DNS without using the CDN/proxy, and it can use the proxy without Cloudflare managing its DNS. The tool's own output reflects this: it reports "is using Cloudflare DNS," "is using Cloudflare CDN/Proxy," and "is using Cloudflare SSL" as independent statements, each with a positive and negative form.

That separation is the point. If you only asked "is this site on Cloudflare?", you would get a misleading answer for any domain that uses Cloudflare for one layer but not others.

DNS results: "is using Cloudflare DNS"

This check looks at whether the domain's DNS is served by Cloudflare. The page describes it as checking global locations and finding DNS entries for Cloudflare, then reporting either "Found in:" or "Not found in:" a set of locations.

What it means when it's positive: the domain's authoritative DNS is Cloudflare's. Name resolution for that domain happens on Cloudflare's infrastructure.

What it means when it's negative: the domain resolves through some other DNS provider. That does not rule out Cloudflare being used elsewhere in the stack — it only rules out Cloudflare DNS.

Why the "global locations" wording matters: DNS answers can differ by resolver location, especially during propagation or with geo-steering. Checking from multiple locations reduces the chance of a false negative caused by one resolver returning a cached or regional answer.

CDN/Proxy results: detection vs. CNAME configuration

This is the check with the most nuance, because the tool distinguishes three outcomes rather than two:

Proxy detected is the strong signal. When a domain is proxied through Cloudflare, requests resolve to Cloudflare edge IPs and Cloudflare sits between the visitor and the origin server. That is what "CDN/Proxy" means here — the two are grouped because the proxy is what delivers the CDN behavior.

"Could be using a CNAME configuration" is the one people misread. It is not a confirmation and not a denial. A CNAME configuration is a setup where the domain points at Cloudflare via a CNAME record rather than by moving its name servers — common with partial (CNAME) setups on business or enterprise plans. Because the visible DNS signature overlaps with non-Cloudflare CNAMEs, the tool cannot commit to a yes or no. Treat this result as "needs a closer look," not as an answer.

Practical consequence: if you are auditing whether a site is protected by Cloudflare's proxy, a "could be using a CNAME" result means you should verify by other means — for example, inspecting response headers or the resolved IP ranges — rather than concluding either way.

SSL results: "is using Cloudflare SSL"

This check reports whether Cloudflare is involved in serving the TLS certificate for the domain.

Positive: Cloudflare is fronting SSL — typically because the domain is proxied and Cloudflare presents the edge certificate.

Negative: the certificate seen is not being served through Cloudflare.

SSL detection is the most downstream of the three. It generally follows from the proxy being active, so a positive SSL result alongside a negative CDN/Proxy result is worth re-checking, since it may point to a partial or recently changed configuration.

Reading the three results together

The combinations are more informative than any single line:

• DNS positive, CDN/Proxy negative, SSL negative — Cloudflare manages DNS only. The origin is exposed directly; no proxy protection.
• DNS positive, CDN/Proxy positive, SSL positive — full Cloudflare stack: DNS, proxy/CDN, and edge SSL.
• DNS negative, CDN/Proxy positive — possible with CNAME setups where DNS lives elsewhere but traffic still routes through Cloudflare.
• "Could be using a CNAME configuration" — inconclusive on the proxy question; confirm separately before drawing a conclusion.

What the tool does not tell you

The results describe configuration, not security posture. "Using Cloudflare CDN/Proxy" does not mean a site is well configured, and "NOT using Cloudflare" does not mean a site is unprotected — it may sit behind a different CDN or WAF. Use the output as a factual signal about which Cloudflare layers are in play, then interpret that in the context of what you actually need to know.