Set up a subdomain on Cloudflare for Vercel
22 October 2025
In this post, I'll share the steps I followed to configure Cloudflare and Vercel with a subdomain for my blog.
🧭 Step 1: Add Subdomain in Vercel
- Open your Vercel Dashboard.
- Go to your project → Settings → Domains.
- Click Add and enter your subdomain (e.g.,
blog.sallydou.dev). - Keep the DNS instruction page open — we’ll use it in Cloudflare next.
⚙️ Step 2: Add a CNAME Record in Cloudflare
Open the Cloudflare Dashboard → select your domain → DNS tab.
Add a new record like this:
| Type | Name | Target | Proxy Status |
|---|---|---|---|
CNAME |
blog |
cname.vercel-dns.com |
DNS only (grey cloud) |
Important: Turn off Cloudflare’s proxy (orange cloud).
The record must be DNS only so that Vercel can manage SSL and routing correctly.
Once saved, this tells browsers:
“When someone visits
blog.sallydou.dev, send the traffic directly to Vercel’s network.”
🔍 Step 3: Verify the Domain in Vercel
Go back to your Vercel project → Settings → Domains.
Follow the recommendation displayed by Vercel:
- Use the target value Vercel provides and paste it into the Target field in Cloudflare.
- Refresh the page, and it should show Valid Configuration.
🧠 Understanding cname.vercel-dns.com
cname.vercel-dns.com is Vercel’s universal DNS endpoint.
It automatically handles:
- Global load balancing
- SSL certificate management
- Routing requests to the correct project
This approach is preferred over older project-specific URLs like my-app.vercel.app, which can break if you move the domain between projects.
⚠️ Common Issues and Fixes
Even small DNS misconfigurations can cause major headaches.
Here are the three most common issues — and how to fix them.
1️⃣ Proxy Is On (Orange Cloud)
When Cloudflare’s proxy is ON, traffic passes through Cloudflare first before reaching Vercel.
❌ Problem
Both Cloudflare and Vercel try to handle SSL, which can cause:
- “Too many redirects”
- “SSL handshake failed”
- Endless redirect loops
✅ Fix
Click the orange cloud in Cloudflare to turn it grey (DNS only).
Vercel will then handle HTTPS directly and reliably.
2️⃣ Using an A Record Instead of a CNAME
Some older guides recommend using Vercel’s IP address (76.76.21.21) with an A record.
That works for root domains, but not for subdomains.
❌ Problem
- SSL may not issue correctly
- Vercel may fail to route traffic properly
- The setup might break after redeployments
✅ Fix
Always use a CNAME record pointing to cname.vercel-dns.com.