The Architecture Rationale
Domain registration often bundles “default” DNS services—most of which are slow, lack global propagation speed, and offer zero advanced security features. For a virtualized infrastructure, DNS is not just a phonebook; it is the first line of defense. I standardized on Cloudflare for DNS management, migrating away from registrar-based records and rejecting the temptation of self-hosting a BIND/DNS server in Proxmox, which introduces unnecessary complexity and latency.
Phase 1: The Decision Matrix
Why Cloudflare over shared hostings or manual DNS?
- Propagation Speed: Changes to records propagate globally in seconds, not hours.
- API-First Infrastructure: Cloudflare’s API is the industry standard, allowing seamless integration with tools like
certbotfor DNS-01 challenges (as used in my Nginx and Stalwart configurations). - Security Layer: Built-in DDoS protection, IP reputation blocking, and granular record control that standard registrar panels lack.
The Evolution: From AWS to Autonomous DNS
Before centralizing on Cloudflare, my infrastructure journey included an exploration of AWS Route53. While Route53 is an incredibly powerful, enterprise-grade DNS solution, my evaluation led to a transition for several strategic reasons:
- Why I moved away from AWS DNS: While Route53 offers deep integration with AWS services, it often feels like “overkill” for a Proxmox-based ecosystem. Managing costs and complex IAM permissions for simple DNS records created unnecessary friction.
- The Benefit of Neutrality: Moving to Cloudflare decoupled my DNS management from my cloud provider. Whether I am running on a VPS, an AWS EC2 instance, or bare metal, my DNS infrastructure remains consistent, provider-agnostic, and centrally managed.
- The Lesson: This experience taught me that the “best” tool is often the one that provides the most utility without locking you into a single vendor’s ecosystem.
Phase 2: Why I Avoided the “Orange Cloud” (Proxy Mode)
Many users enable Cloudflare’s “Orange Cloud” (Proxy) to gain CDN caching and masked IPs. However, for my infrastructure, I opted for DNS-Only (Grey Cloud) mode.
The Strategy: Control over Convenience
- End-to-End SSL (E2EE): By bypassing the proxy, I maintain full control over the SSL termination at my Nginx edge. If I used the Orange Cloud, the connection would be
User -> Cloudflare -> My Server, meaning Cloudflare holds the keys to the kingdom. By using DNS-Only, the connection is encrypted purely between the user and my Nginx LXC. - Predictable Headers: Cloudflare’s proxy often strips or modifies HTTP headers in ways that can break specific WebSocket or custom auth configurations. Direct DNS routing ensures that the traffic hitting my proxy is “raw,” giving me 100% predictable behavior for my internal services.
- True Origin Verification: I rely on my Nginx proxy’s
Basic AuthandFail2Banto verify and secure visitors. By avoiding the proxy, I can ensure that my security logs reflect the visitor’s actual IP (when properly forwarded), rather than a Cloudflare edge-node IP.
Phase 3: High-Quality DNS Hygiene
Managing DNS at this level requires rigorous hygiene:
- Descriptive Records: Every record includes a comment or prefix linking it to the relevant host (e.g.,
pve,stalwart,n8n). - Clean TXT Records: DKIM, SPF, and DMARC are managed centrally, ensuring that the Stalwart mail relay is highly trusted by receiving mail servers.
- Minimal TTLs: Strategic use of TTLs allows for fast failover if I need to migrate an LXC from one node to another or switch providers.
Evaluation: DNS Architecture
| Approach | Performance | Security | Control |
| Registrar Default | Low | Low | Low |
| Self-Hosted (Proxmox) | Moderate | High (Complexity) | High |
| Cloudflare (DNS-Only) | High | High | High |
Operational Summary
By utilizing Cloudflare as a dedicated DNS controller while maintaining a “DNS-Only” posture, I have created a stable, high-performance foundation. This setup ensures that my infrastructure remains reachable, performant, and—most importantly—under my direct cryptographic control. It bridges the gap between professional-grade external DNS and the flexibility of a private, self-hosted edge.