Cloudflare DNS Helper
Create the DNS records the dashboard route catalog expects for direct hostnames and verified E2EE hostnames.
When to use this
Use this guide when the dashboard route catalog shows Direct Hostname or Verified E2EE Hostname in configure state. The fix is usually a wildcard DNS record that points a hostname family at the NFLTR relay.
Choose the hostname family
| Dashboard link | Server setting | Example DNS name |
|---|---|---|
| Direct Hostname | http.share_domain | *.apps.example.com |
| Verified E2EE Hostname | e2ee.tls_passthrough.base_domain | *.secure.example.com |
Find your assigned target hostname
Open the route catalog row for Direct Hostname or Verified E2EE Hostname on nfltr.xyz/dashboard. It shows the NFLTR-assigned target your custom domain needs to point at, for example your-agent.share.nfltr.xyz or your-agent.secure.nfltr.xyz.
Add the Cloudflare record
In your own Cloudflare DNS zone, add a record for your custom hostname pointing at that assigned target. Use DNS only for verified E2EE hostnames so Cloudflare does not terminate the TLS session before it reaches your agent.
| Type | Name | Target | Proxy status |
|---|---|---|---|
CNAME | apps.example.com | your-agent.share.nfltr.xyz | Proxied or DNS only |
CNAME | secure.example.com | your-agent.secure.nfltr.xyz | DNS only |
Use a wildcard name (*.apps.example.com) instead if the dashboard assigned you a wildcard target.
Confirm in the dashboard
Once DNS propagates, refresh the dashboard route catalog. The matching hostname row moves from configure to ready automatically — no separate action needed on your end.
Check from your terminal
dig +short apps.example.com
dig +short secure.example.comBoth commands should resolve to the target hostname shown in the dashboard. If the verified hostname still fails, confirm the Cloudflare record is DNS only and that the route catalog row still shows ready for that agent.