Infra Notes

Test a Cloudflare origin without changing proxied DNS

Separate Cloudflare edge failures from origin failures using DNS inspection, curl --resolve, the correct Host header, and controlled origin access.

Published · Updated

CloudflareDNSProxyOriginDebugging

Problem

A service works through Cloudflare but direct origin behavior is unclear, or the opposite happens.

Why it happens

Proxied DNS sends traffic through Cloudflare, while DNS-only exposes the origin directly.

Recommended approach

Test the edge and origin as separate paths. Record the expected DNS answer, TLS endpoint, request host, and security controls for each path before comparing results.

Useful checks

Useful checks:

bash

dig example.com
curl -I https://example.com
curl -H "Host: example.com" http://ORIGIN_IP

Direct origin requests can bypass Cloudflare protections. Run them only from an authorized network and avoid exposing a private origin merely for debugging convenience.

Use this when

  • Debugging Cloudflare
  • Nginx
  • Ingress
  • SSL
  • Origin routing
  • WAF behavior

Avoid this when

  • Services intentionally accessible only through Cloudflare Access or WAF rules

Identify whether DNS is proxied

bash

dig +short example.com A
dig +short example.com AAAA
curl -sSI https://example.com

A proxied record normally resolves to Cloudflare anycast addresses and the response often contains Cloudflare headers. That proves the edge path, not the origin path.

Test the origin with the correct hostname and TLS SNI

Use curl --resolve instead of temporarily switching the DNS record to DNS-only:

bash

curl -sv --resolve example.com:443:203.0.113.10 https://example.com/health

This sends the request to the selected origin IP while preserving example.com in the URL, Host header, and TLS Server Name Indication. It is more accurate than requesting https://203.0.113.10, which can select the wrong virtual host or certificate.

For a plain HTTP origin:

bash

curl -sv -H 'Host: example.com' http://203.0.113.10/health

Compare edge and origin results

Record the same request through both paths and compare:

  • HTTP status and redirect location
  • Response headers
  • TLS certificate and protocol
  • Response body or health result
  • Latency
  • Origin and Cloudflare logs using a shared request identifier

If origin succeeds but edge fails, inspect Cloudflare DNS, SSL mode, WAF, Access, Transform Rules, redirects, and origin reachability from Cloudflare. If origin fails directly, fix the load balancer, ingress, web server, certificate, application, or firewall first.

Do not expose the origin to debug it

Keep origin firewall rules restricted to Cloudflare IP ranges or an authorized diagnostic network. A temporary DNS-only record can reveal the origin address and bypass WAF, bot protection, rate limits, and Access controls.

References