Sayan Pal

Why this site's DNS had to move to Cloudflare

When I moved this site from Vercel to Cloudflare Pages, the www part was easy. The bare domain, sayan.cyou, was not.

Why the apex wouldn’t verify

Pages wants to see a CNAME before it’ll serve your custom domain. But you can’t put a CNAME on the apex (the root of the domain). It has to hold the SOA and NS records, and a CNAME can’t sit next to anything else.

Namecheap, where my DNS was, gets around this with an ALIAS record. You set it like a CNAME, but their nameserver resolves it and hands out plain A records instead, so Pages never sees a CNAME. I checked against their nameserver directly to be sure:

dig @dns1.registrar-servers.com sayan.cyou CNAME
dig @dns1.registrar-servers.com www.sayan.cyou CNAME

The apex gave back the SOA, www gave back the CNAME. Waiting wasn’t going to fix that.

Try 1: just use www

So I made www the main address and pointed the apex at it with Namecheap’s URL redirect. That broke in a new way. The redirect only listens on port 80 (plain HTTP), and the old Vercel deployment had sent an HSTS header with a two-year max-age. HSTS tells a browser “HTTPS only, never fall back”. So any browser that had been to the site before went straight to HTTPS on the apex, found nothing there, and gave up. And that sticks around till 2028.

Try 2: move the whole zone

Cloudflare does CNAME flattening on its own side, so you can put a real CNAME on the apex and Pages is happy with it. I moved the nameservers over, Namecheap just holds the registration now, and the site’s back on the bare domain.

One catch.. when you add a zone, Cloudflare scans your old DNS and copies what it finds. It quietly skipped four records: www itself, statmux, the Railway verification TXT for it, and my mail host’s domain-verified TXT. Missing www of all things.

If you’re doing this

  • Check whether whatever you’re pointing at needs a real CNAME before you trust ALIAS.
  • Know what HSTS max-age you’ve shipped. It outlives the deploy that sent it.
  • Dump every record from the old nameserver and diff it before you switch, not after.
All notes