# Set DNS with Cloudflare

If your domain is hosted at Cloudflare, you connect an API token once and MainPath writes the A and CNAME records into your zone itself.

> Source: https://www.mainpath.ai/en/docs/dns-cloudflare/

If your domain's DNS zone is hosted at [Cloudflare](https://www.cloudflare.com/), you connect an API token to your organization, and MainPath writes the records from the domain detail into the zone. The manual procedure under [Configure DNS]({{< relref "domain-how-to" >}}) remains available, for example for domains with other providers.

## Create the token in Cloudflare

1. In Cloudflare, open **My Profile → API Tokens**. Alternatively, an account token works.
2. Create a token with the permissions **Zone → DNS → Edit** and **Zone → Zone → Read**. MainPath needs no further rights, in particular no Global API Key.
3. Copy the token.

## Create the connection in MainPath

1. Open [**Connections**]({{< relref "connections" >}}) in the sidebar and click **Add connection**.
2. Choose **Cloudflare**.
3. Paste the API token and save. MainPath checks whether the token is valid.

An organization can have several Cloudflare connections. If a domain matches more than one zone, MainPath uses the most specific one, for `shop.example.com` the zone `shop.example.com` if it exists, otherwise `example.com`.

## What MainPath writes into the zone

MainPath sets exactly the hosts from **Domains** as `A` or `CNAME` records once the assigned server has an address. It keeps the orange Cloudflare proxy switched off so that Let's Encrypt reaches the server directly. Every time you save a project, it aligns missing or differing records; the verification status appears in the **Status** column of the domain overview.

## SSL via DNS-01 (optional)

If Let's Encrypt cannot reach the server (no public HTTP/443, firewall, internal IP), open this connection's details and tick the affected domains. MainPath then writes the `_acme-challenge` TXT record into this zone. Unticked domains keep the existing TLS-ALPN challenge on the server.

## If no check mark appears

If MainPath reports the token as invalid, check the **Zone → DNS → Edit** and **Zone → Zone → Read** permissions in Cloudflare and update the connection. If no record shows up in Cloudflare, the domain is not in any zone the token is allowed to see; check the Cloudflare account and zone name. If the check mark is missing despite the record in Cloudflare, the DNS change still needs time, or the server has no known address yet.