Custom domain on Cloudflare
If your domain’s DNS is on Cloudflare, setup is two records in the DNS app. The one rule that matters: both records must be “DNS only” (grey cloud). Proxying the CNAME routes traffic through your own Cloudflare zone first, which breaks verification and TLS issuance.
The records you’ll create
Your exact names and values are generated on the server’s Deployments tab → Custom domain card. They follow this shape:
| Type | Name | Value | Purpose |
|---|---|---|---|
| CNAME | mcp.acme.com | connect.mcp-dns.com | Routes traffic to MCPCloud |
| TXT | _cf-custom-hostname.mcp.acme.com | ce2337e3-…-c789c237d377 | Proves you own the domain |
Setup on Cloudflare
- Open dash.cloudflare.com, select the domain, and go to DNS → Records.
- Add a CNAME record: Name is your subdomain (e.g. `mcp` — Cloudflare appends the domain), Target is the CNAME value from your MCPCloud domain card. Click the orange cloud so Proxy status reads “DNS only” before saving.
- Add a TXT record: paste the ownership name from the card into Name (Cloudflare trims the domain suffix automatically) and the token into Content.
- Back in MCPCloud, hit Recheck on the domain card. Cloudflare-hosted DNS usually propagates in under a minute.
Verify and go live
Back on the Custom domain card, hit Recheck. The status walks from Verifying DNS to Issuing certificate to Active — usually within minutes of the records propagating. Once Active, your server answers at https://mcp.acme.com/mcp and the certificate renews automatically.
Troubleshooting
Status stays “Verifying DNS” and the error mentions the CNAME.
Almost always the proxy toggle: edit the CNAME record and switch it to “DNS only” (grey cloud). Orange-cloud proxying intercepts the hostname before it reaches MCPCloud.
Cloudflare rejects the TXT name as invalid.
Enter only the left-hand labels (e.g. `_cf-custom-hostname.mcp`) — Cloudflare appends your domain. Pasting the fully-qualified name usually also works; double suffixes like `.acme.com.acme.com` do not.
Calls through the custom domain get a 403 (often “browser_signature_banned” or a challenge page) while the platform URL works.
Your DNS zone’s WAF or bot-protection rules apply to the custom hostname, and MCP clients send unusual or minimal user agents. Exempt the hostname (or the path) from bot fight / managed challenge rules in your zone, or point clients at the platform URL until you do. The 403 comes from your zone, not from MCPCloud.
Other DNS providers