Using zone9 with Cloudflare

Cloudflare appears in zone9 in two different roles, and confusing them is the source of most questions here.

1. As the DNS host. When you move a domain’s DNS to the platform, the zone is created in the platform’s Cloudflare account and the panel manages the records through Cloudflare’s API.
2. As a proxy in front of your origin. The per-record Proxy’li toggle, exactly as in Cloudflare’s own interface: traffic goes to Cloudflare’s edge, which hides your origin address.

Role 1 is what makes TLS certificates automatic. Role 2 is your decision, per record.

Three controls, three independent jobs

Control	Governs	Written by
DNS hosting	Whether the panel can manage this domain’s records at all	You, once, per domain
LB column	Where the record points — which load balancer serves this name	You, per record
Proxy’li toggle	How the record is served — direct, or through Cloudflare’s edge	You, per record

The important rule: the panel never writes the proxy flag. When the LB control points a record at a load balancer, it reads your existing proxy setting and writes it back unchanged. A new record is created unproxied and turning it on is your move.

So enabling load balancing internally and also turning on Cloudflare’s proxy to hide the address is a supported combination. Nothing in the platform tries to stop you, and nothing silently reverts your choice.

Why certificates survive the proxy

The platform uses the DNS-01 ACME challenge: a TXT record in your zone. Cloudflare does not proxy TXT records — proxying applies to A, AAAA and CNAME. So issuance and renewal work identically whether the proxy is on or off.

This was a deciding factor in choosing DNS-01. With an HTTP challenge, turning the proxy on would break renewal at Cloudflare’s edge, and you would be forced to choose between hiding your address and having a certificate.

Settings that matter when the proxy is on

SSL/TLS mode: Full (strict). Cloudflare must connect to your origin over HTTPS and validate the certificate. Your load balancer presents a real Let’s Encrypt certificate, so strict passes. Flexible would have Cloudflare speak plain HTTP to a listener expecting TLS.

Proxying an internal load balancer does not work, and the reason is not subtle: the record points at a private address Cloudflare cannot reach. The certificate is still obtained — the challenge is a DNS record — but there is nothing for the edge to connect to. The panel notes this rather than blocking you.

The client address arrives in a header. With the proxy on, connections come from Cloudflare’s network. Read the client address from CF-Connecting-IP, or from X-Forwarded-For which the load balancer also sets.

If your DNS is in your own Cloudflare account

That is the external state. The panel records that the domain is yours and deliberately shows none of its records — a half-view is how “I changed it in the panel but nothing happened” begins.

You keep full control and you manage records in your own Cloudflare panel. What you lose is automatic TLS, because the challenge record has to be written into a zone the platform controls. Two options:

• Move the domain’s DNS to the platform (guide), or
• Terminate TLS yourself — a tcp listener passing traffic to your own termination point inside the cluster or on a server.

Support for externally-hosted domains through an HTTP challenge is planned.

Quick answers

Does the LB control turn the proxy on? No. It never writes that field.

Does turning the proxy on break my certificate? No. The challenge is a TXT record and those are not proxied.

Can I use Cloudflare’s proxy with an internal load balancer? The certificate works; the proxy has nothing to reach. Use a public load balancer if you want the edge in front.

Do I have to use Cloudflare at all? For DNS hosting today, yes — it is the one DNS adapter implemented. For proxying, no; it is off by default.