Direct Answer
If your domain's DNS is on Cloudflare, set the records that point to RedirHub to DNS only (grey cloud), not Proxied (orange cloud). While the record is proxied, RedirHub cannot issue an HTTPS certificate for your domain, and your visitors are served by Cloudflare instead of RedirHub's global edge, ranked #4 of 27 redirect providers in our public benchmark.
You will usually notice this through an email titled "HTTPS is blocked on yourdomain.com", or a domain marked HTTPS blocked on the Hostnames page of your dashboard.
What you lose while the record is proxied#
A proxied redirect often still works, because Cloudflare answers the visitor first and presents its own certificate. That hides two problems.
1. No RedirHub certificate. Our certificate check has to reach RedirHub directly. With the proxy in front, Cloudflare answers it instead, so the check fails every time and no certificate is issued for your domain. Your HTTPS then depends entirely on Cloudflare's certificate and settings. If they change, visitors see a browser error or cannot open the domain at all.
2. No RedirHub global edge. RedirHub answers redirects from 130 points of presence worldwide. In our public redirect speed benchmark, it ranks #4 of 27 providers with a 16 ms median time to first byte. Cloudflare measured 56 ms in the same test. With the proxy on, every visit goes through Cloudflare first, so your visitors do not get that speed.
| Provider | Rank (of 27) | Median time to first byte |
|---|---|---|
| Fastly | #1 | 10 ms |
| Microsoft Azure | #2 | 14 ms |
| RedirHub | #4 | 16 ms |
| Akamai | #6 | 21 ms |
| Cloudflare | #10 | 56 ms |
The benchmark measures redirects from Washington, D.C., Frankfurt and Tokyo with a fresh connection each time, updated hourly. See the live numbers on the RedirHub redirect speed test.
How to fix it in Cloudflare#
- In your RedirHub dashboard, open Hostnames and select the domain. Note the records it asks for, for example an A record for
@pointing to3.33.236.10plus a TXT verification record, or a CNAME for@. Always use the values shown for your own domain. - In the Cloudflare dashboard, open the domain and go to DNS → Records.
- Find the record for the name you redirect (
@for the root domain,wwwor another subdomain if you redirect those too). - Set its content to the value RedirHub shows, then click the orange cloud so it turns grey and reads DNS only. Save.
- Remove any other A, AAAA or CNAME record for the same name that still points elsewhere. One leftover proxied record is enough to keep the domain behind Cloudflare.
- Leave the TXT verification record in place.
RedirHub retries the certificate on its own once DNS reaches us. You do not need to do anything else on the dashboard.
If you redirect many domains, change one first and confirm it turns healthy before you change the rest.
How to check it worked#
- Hostnames page: the domain moves from HTTPS blocked to a valid certificate after the next automatic retry. DNS changes can take a few minutes to be seen.
- DNS lookup: look up the A record of your domain with any DNS lookup tool. It should return the RedirHub address from step 1, not Cloudflare addresses (Cloudflare proxy addresses usually start with 104.21., 172.67. or 188.114.).
- Response header: a response served through the proxy carries
server: cloudflare. Once the record is DNS only, that header is gone.
Still blocked an hour after the change? Reply to the alert email or contact support with the domain name, and we will check the live DNS for you.
Related help: How to Redirect a Cloudflare Domain to Another URL for Free and What DNS Changes Are Needed for a Domain Redirect?
Frequently asked questions
Yes. It works only because Cloudflare presents its own certificate in front of us. RedirHub has no certificate of its own for the domain, so if that Cloudflare certificate or its SSL settings change, visitors can no longer open the domain over HTTPS, and there is nothing on our side to fall back on.
No. Keep Cloudflare as your DNS provider. Only the records that point to RedirHub need to be DNS only; other records in the zone can stay as they are.
No. Mail records (MX, SPF and other TXT records) are not proxied by Cloudflare and are not touched by this change.
We retry the certificate regularly and alert the domain's owners and managers while it keeps failing. The emails stop once the record is DNS only and the certificate is issued.
Not together with RedirHub on the same record. Choose one service to answer the domain; for a redirect domain, RedirHub gives you the certificate, the analytics and the faster edge.
Reviewed By
Krisbo
Krisbo is the founder of RedirHub, a modern URL redirection platform built for marketers, developers, and growing businesses. He writes about SaaS, growth, AI, infrastructure, and the systems behind building internet products at scale.