Pointing a domain to a Hetzner server requires DNS configuration, optional proxy services, and verification. This guide covers setting up DNS records at Cloudflare, using the free proxy layer for security and caching, and testing connectivity with standard command line tools.
Prerequisites
The following items are required:
- A registered domain name
- A free Cloudflare account
- A Hetzner server with a public IPv4 address
- Basic command line familiarity
Configure DNS Records at Cloudflare
A Hetzner server provides a public IPv4 address such as 192.0.2.42. To access the server via a domain name, create DNS records that point the domain to this address.
Log into the Cloudflare dashboard and select the domain. Navigate to DNS > Records and click Add record.
Create an A record for the root domain:
- Type: A
- Name: @ (represents the root domain)
- IPv4 address: the Hetzner server public IP
- TTL: Auto
- Proxy status: see next section
Click Save.
Create a second A record for subdomains:
- Type: A
- Name: * (wildcard for all subdomains)
- IPv4 address: the Hetzner server public IP
- TTL: Auto
Click Save.
Cloudflare Proxy Status
Each DNS record in Cloudflare has a Proxy status toggle, represented by an orange or grey cloud icon.
Grey cloud (DNS only) means traffic hits Cloudflare nameservers but passes directly to the server IP. The real IP address is visible to anyone querying DNS.
Orange cloud (proxied) means traffic hits Cloudflare edge servers first. Cloudflare acts as a reverse proxy, caching static content, filtering malicious traffic, and terminating SSL before forwarding clean traffic to the origin server.
Benefits of Cloudflare Proxy
The free proxy tier provides several advantages:
- IP masking hides the origin server address behind Cloudflare edge IPs, preventing direct attacks against the server
- Automatic SSL certificates provide HTTPS encryption between visitors and the domain
- Web application firewall rules and bot mitigation block common exploits before they reach the server
The proxy works for HTTP and HTTPS traffic on ports 80 and 443. Raw TCP protocols such as SSH or game servers must use grey cloud (DNS only) mode. For web applications, Nextcloud, and similar HTTP services, use the orange cloud.
Verify DNS Propagation
DNS changes take time to propagate. Verify that records resolve correctly before attempting to connect.
Using MXToolbox
Navigate to mxtoolbox.com and select DNS Lookup from the dropdown. Enter the domain name and click DNS Lookup.
Check that the returned IP address matches the Hetzner server IP. If Cloudflare proxy is enabled, the result shows Cloudflare IP ranges (104.x.x.x or 172.x.x.x ranges). If proxy is disabled, the result shows the raw Hetzner IP.
Using Command Line Tools
Verify DNS resolution from a terminal:
dig horsefreeglue.com +shortThis returns the resolved IP addresses immediately.
Connect via SSH
Test secure shell access using the domain name instead of the IP address:
ssh root@horsefreeglue.comIf Cloudflare proxy is enabled (orange cloud), SSH connections will fail when routed through the domain. Cloudflare proxies HTTP and HTTPS traffic only. For SSH access with a proxied domain, create a separate subdomain for management (such as ssh.horsefreeglue.com) and set it to grey cloud. Alternatively, connect directly via the server IP address.
If connecting via raw IP or a grey-clouded management subdomain, the SSH key or password prompt appears, confirming network connectivity.
Scan for Open Ports
Use nmap to verify which ports are exposed to the public internet. Run the scan from an external network or local machine.
Standard SYN scan on common ports:
sudo nmap -sS -v horsefreeglue.comScan specific ports:
nmap -p 22,80,443,8080 horsefreeglue.comExpected output:
Starting Nmap 7.94 ( https://nmap.org )
Initiating SYN Stealth Scan against horsefreeglue.com
Discovered open port 80/tcp on 192.0.2.42
Discovered open port 443/tcp on 192.0.2.42
Discovered open port 22/tcp on 192.0.2.42
Nmap scan report for horsefreeglue.com (192.0.2.42)
Host is up (0.012s latency).
PORT STATE SERVICE
22/tcp open ssh
80/tcp open http
443/tcp open https
Nmap done: 1 IP address (1 host up) scanned in 0.45 secondsIf the scan shows only SSH (22) and web ports (80, 443), firewall configuration is correct and unnecessary ports are closed.
AI assistance is used on this site for language, formatting, and turning research into a consistent template. It is not used to perform the underlying research or verify technical claims. Every command, configuration, and step in this post is tested by hand before publication.