Cloudflare: CDN, reverse proxy and WAF

What Cloudflare is

Cloudflare sits in front of an origin server as a reverse proxy. Public traffic terminates at a Cloudflare data centre, which serves cached objects, applies firewall rules and forwards the remainder to the origin. Cloudflare also runs authoritative DNS, so a domain can use its nameservers without proxying any traffic.

How DNSTrace.dev detects it

Detection correlates independent public signals. A single match is reported as strong evidence; agreement between a response header and the announcing network is reported as confirmed.

cf-ray — A per-request identifier ending in the three-letter code of the data centre that answered.
server: cloudflare — Present on proxied responses.
AS13335 — The autonomous system that announces the address.
Published IPv4 and IPv6 ranges — Cloudflare publishes its edge ranges, so the answering address can be matched against them.
*.ns.cloudflare.com nameservers — Indicates Cloudflare DNS, which is a separate service from proxying.

What a detection proves

The address answering for the hostname belongs to Cloudflare's edge, and the response was produced by a Cloudflare data centre.

What it does not prove

Nothing about the origin. A proxied record deliberately hides the origin address, and DNSTrace.dev will not guess one. Cloudflare nameservers alone do not mean traffic is proxied; a record can be set to DNS-only.

Common questions

Can DNSTrace.dev find the real IP behind Cloudflare?

No. A proxied record returns a Cloudflare edge address by design. DNSTrace.dev reports the origin as unknown rather than presenting a historical or guessed address as fact.

Does using Cloudflare nameservers mean a site is proxied?

No. Cloudflare DNS can serve records with the proxy disabled, in which case the published address is the origin address and no cf-ray header appears.

What does the code at the end of cf-ray mean?

The trailing three letters are the IATA-style code of the Cloudflare data centre that handled the request, which indicates where the connection terminated, not where the origin is.