Should every DNS record be proxied?

Records that represent the public website generally should be. Mail and other non-web services need the right record types—and should not publish the origin if hiding it is the goal.

Hide your origin IP behind Cloudflare and nginx

If the real server address is public, Cloudflare alone is optional for whoever found it. Origin IP protection for DMCA-ignore reverse-proxy stacks means keeping that address out of DNS and reachable only from your nginx shield—whether that shield sits on Offshore Hosting or Fully Managed capacity.

Common ways origins show up

Old DNS records that still point at the backend.

Subdomains left unproxied—staging, “direct,” or forgotten panels.

Apps or error pages that print internal addresses.

What the shield is for

The shield is the only public-ish hop after Cloudflare. It speaks TLS the way Cloudflare expects and forwards to the origin on a private path.

ShieldProxy’s panel is there so adding or removing a domain updates DNS and reverse-proxy config in one workflow instead of a checklist you maintain by hand.

What you still own on the origin

Firewall rules so only the shield can connect on the ports you proxy.

No public DNS for the origin hostname.

Sensible app config so you are not advertising the backend yourself.

FAQ

Should every DNS record be proxied?: Records that represent the public website generally should be. Mail and other non-web services need the right record types—and should not publish the origin if hiding it is the goal.

Hide your origin IP behind Cloudflare and nginx

Common ways origins show up

What the shield is for

What you still own on the origin

FAQ

Keep reading

More in Guides

Explore topics