Migrate to RunxBuild and earn up to $50 in hosting credit on your first deposit.

Calculate your savings
unxBuild
Log in Get Started
Back to Blog Operations

namecheap with cloudflare: The Three Modes and the One That Actually Saves Money

Sean

Platform Writer

Jun 18, 2026
7 min read

The fastest answer to “namecheap with cloudflare” is “change the nameservers at Namecheap to point at Cloudflare, then manage DNS at Cloudflare.” That is the most common setup. The honest version covers the three modes (full Cloudflare, hybrid, and CDN-only), which one is right for which situation, why the free tier is usually fine, and the four DNS records that almost every setup needs but nobody gets right the first time.

namecheap with cloudflare: The Three Modes and the One That Actually Saves Money

Table of contents

The short version: for most teams, the right answer is full Cloudflare (change nameservers, manage DNS there). It is free, the CDN is fast, and the DNS propagation is the easiest of the three modes. The hybrid mode is for teams that want Namecheap to keep the nameservers but still benefit from Cloudflare. The CDN-only mode is for teams that already have a managed DNS provider and only want Cloudflare’s edge caching.

namecheap with cloudflare: the three modes and the one that actually saves money

Table of contents

The direct answer

The most common setup:

  1. Sign up for Cloudflare (free plan is enough for most teams).
  2. Add your domain to Cloudflare. Cloudflare scans existing DNS records.
  3. Cloudflare gives you two nameservers (e.g. alice.ns.cloudflare.com, bob.ns.cloudflare.com).
  4. At Namecheap, change the nameservers for your domain from Namecheap’s defaults to Cloudflare’s two.
  5. Manage DNS records at Cloudflare going forward.

That is the full Cloudflare mode. It is free, the CDN is fast, and the setup takes 30 minutes.

The other two modes (hybrid and CDN-only) are for specific situations. The rest of this post covers which one to pick and the DNS records that break most setups.

The three modes at a glance

ModeWho runs DNSWho runs CDNWhen to use
Full CloudflareCloudflareCloudflareMost teams. Free, simple, fast.
HybridNamecheapCloudflareYou need Namecheap as the nameserver for some reason (compliance, multi-DNS, legacy).
CDN-onlyYour existing DNSCloudflare via CNAME setupYou have a managed DNS provider (Route 53, DNSimple) and want Cloudflare’s edge without changing nameservers.

The cost: free for the first mode, free for the second, free for the third but with more setup. Cloudflare’s paid plans add WAF, advanced DDoS protection, image optimization, and load balancing. Most teams do not need them.

Mode 1: full Cloudflare (the most common)

The setup:

  1. Create a Cloudflare account (free plan).
  2. Click “Add Site”, enter your domain (e.g. example.com).
  3. Cloudflare scans the existing DNS records. Review the scan; add anything missing.
  4. Cloudflare gives you two nameservers. Copy them.
  5. At Namecheap, go to Domain List → Manage → Nameservers → Custom DNS. Paste the two Cloudflare nameservers.
  6. Wait for propagation (5-30 minutes usually).
  7. Cloudflare emails you when the domain is active.

After activation, manage all DNS records at Cloudflare. Namecheap becomes the registrar (you still pay Namecheap for the domain annually), but the nameservers are Cloudflare’s.

The benefits:

  • Free CDN. Cloudflare’s edge network serves your static assets from 300+ cities worldwide.
  • Free DNS. Faster than Namecheap’s default DNS, with DNSSEC support.
  • Free SSL. Cloudflare issues a Let’s Encrypt certificate for your domain automatically.
  • DDoS protection. Cloudflare’s edge absorbs attacks before they reach your origin.
  • Analytics. Request volume, threat intelligence, performance metrics.

The trade-offs:

  • You depend on Cloudflare. If Cloudflare has an outage, your domain is offline. (This is rare but real — see the 2020 and 2022 Cloudflare outages.)
  • Some advanced DNS features require a paid plan. DNS load balancing, geo-routing, and zone-level DNSSEC are paid.
  • Cloudflare sees all your traffic. For most teams this is fine; for some compliance regimes (HIPAA, GDPR data residency), it is not.

Mode 2: hybrid (Namecheap nameservers, Cloudflare edge)

The setup:

  1. Sign up for Cloudflare (free plan).
  2. At Cloudflare, add a partial setup (CNAME setup) for your subdomain (e.g. www.example.com or app.example.com).
  3. Cloudflare gives you a CNAME target.
  4. At Namecheap, add a CNAME record pointing www to the Cloudflare target.
  5. The apex example.com stays on Namecheap’s DNS.

This mode is for teams that want Cloudflare’s CDN for specific subdomains but do not want to change the nameservers for the whole domain. The CNAME setup is sometimes called “partial setup” or “CNAME setup” in Cloudflare’s docs.

The benefits:

  • Most of your DNS stays at Namecheap (you keep your existing setup).
  • The subdomains you point at Cloudflare get the CDN, DDoS protection, and SSL.
  • Smaller blast radius if Cloudflare has an issue.

The trade-offs:

  • Apex records do not get the CDN (CNAMEs are not allowed at the apex without ALIAS support, which Namecheap does not have).
  • More complex to manage. Two DNS providers, two sets of records.
  • Slightly slower DNS resolution because of the CNAME chain.

Most teams do not pick this mode unless they have a specific reason. The most common reason: the apex domain is managed by an internal DNS server (corporate network, internal tooling) and only public-facing subdomains should go through Cloudflare.

Mode 3: CDN-only (keep your current DNS)

The setup:

  1. Sign up for Cloudflare (free plan).
  2. At Cloudflare, add a partial setup (CNAME) for your domain or subdomain.
  3. Cloudflare gives you a CNAME target.
  4. At your existing DNS provider (Route 53, DNSimple, Namecheap, anywhere), add a CNAME pointing at Cloudflare’s target.
  5. The rest of your DNS stays where it is.

This mode is identical to mode 2 in setup. The difference is the “keep your current DNS” part — your existing DNS provider stays the source of truth for all records, and only the specific CNAMEs you add go through Cloudflare.

This is the right answer when:

  • You have a managed DNS provider (Route 53, DNSimple) that you cannot or will not leave.
  • You want Cloudflare for specific subdomains only (e.g. cdn.example.com for static assets, not for the whole site).
  • You are doing an incremental migration from another CDN and want to test Cloudflare on one subdomain first.

The four DNS records that break most setups

  1. The apex A record. example.com should point at your origin server’s IP (or your hosting platform’s IP). On Cloudflare, this is an A record with the proxy option enabled (orange cloud). On Namecheap’s default DNS, this is an A record without proxying.

  2. The www CNAME. www.example.com should CNAME to example.com (or directly to your hosting platform). On Cloudflare, set the proxy option to match the apex (usually DNS-only for the apex if you want to avoid extra proxying, Proxied for www if you want CDN).

  3. The mail records. mail.example.com should A-record to your mail server. Cloudflare’s proxy does not proxy SMTP — set the proxy option to “DNS only” (grey cloud) for mail records. Otherwise mail delivery breaks.

  4. The verification records. Some hosting platforms (Google Workspace, Microsoft 365) require TXT records for verification. Add these at Cloudflare (or your DNS provider); they do not affect traffic.

A common failure mode: enabling Cloudflare’s proxy on a mail record. SMTP traffic is unencrypted by default; Cloudflare’s proxy is HTTP/HTTPS. Mail stops delivering. The fix is to set the mail records to “DNS only” (grey cloud).

The SSL/TLS mode that actually works

Cloudflare offers four SSL modes for your origin connection:

  • Off. No SSL. Origin connection is HTTP. Do not use.
  • Flexible. Cloudflare → user is HTTPS, Cloudflare → origin is HTTP. The user sees a valid cert; traffic between Cloudflare and the origin is plaintext.
  • Full. Cloudflare → user is HTTPS, Cloudflare → origin is HTTPS but the cert can be self-signed. Good for staging or self-hosted origins.
  • Full (Strict). Cloudflare → user is HTTPS, Cloudflare → origin is HTTPS with a valid cert. The right answer for production.

For most production setups, Full (Strict) is the answer. The origin needs a valid TLS certificate (from Let’s Encrypt or a paid CA). Cloudflare verifies the cert chain before proxying traffic.

The cost of Flexible: traffic between Cloudflare and your origin is unencrypted. Anyone on the path between Cloudflare and your origin sees plaintext. This is sometimes acceptable for static sites but rarely acceptable for APIs.

The migration checklist from Namecheap DNS to Cloudflare DNS

For teams moving from “Namecheap does everything” to “Namecheap is the registrar, Cloudflare does DNS”:

  1. Document current records. Screenshot or copy every DNS record in Namecheap. Cloudflare’s scan usually catches them but you want a reference.

  2. Lower TTL before the move. At Namecheap, set TTL to 300 seconds (5 minutes) for every record. Wait for the old TTL to expire (24-48 hours) before making changes.

  3. Add the domain at Cloudflare. Review the scanned records. Add anything missing (especially TXT records for verification, mail records).

  4. At Namecheap, change nameservers to Cloudflare’s two. Save. Wait for Cloudflare to email “active” (5-30 minutes).

  5. Verify resolution. dig example.com +short from a terminal. The answer should match what Cloudflare shows.

  6. Verify SSL. curl -v https://example.com. The cert should be Cloudflare’s.

  7. Verify mail. Send a test email to an address on the domain. Confirm delivery. If mail is broken, check the mail records’ proxy status (DNS only, grey cloud).

  8. Raise TTL at Cloudflare. Now that the domain is at Cloudflare, you can set TTL to 1 hour or longer. Lower TTLs cost more queries but propagate faster on changes.

The whole process takes about an hour plus the propagation wait.

For a domain that hosts a SaaS app with API traffic, the CDN and DDoS protection from Cloudflare are usually worth the extra dependency. For a domain that hosts a personal blog with no API, the choice is less clear — the CDN helps for global readers, but the dependency is still real. For internal domains or staging environments, Namecheap’s default DNS is fine; no need for Cloudflare.

If you are deploying an app to a platform like RunxBuild’s backend services and pointing a custom domain at it via Cloudflare DNS, the integration is straightforward — set the A and CNAME records at Cloudflare, point them at the platform’s IPs or hostname, enable the proxy (orange cloud) for CDN and DDoS protection. For the cost of running the app + the CDN + the DNS at production scale, the RunxBuild hosting calculator gives you the per-month number.

FAQ

Is Cloudflare’s free plan enough?

For most teams, yes. The free plan includes DNS, CDN, DDoS protection, and a shared SSL certificate. Paid plans add WAF, advanced DDoS, image optimization, and load balancing.

What is the difference between “DNS only” and “Proxied” in Cloudflare?

DNS only (grey cloud) means Cloudflare resolves the DNS but does not proxy the traffic — the user connects directly to the origin. Proxied (orange cloud) means Cloudflare proxies the traffic through its CDN, providing caching, DDoS protection, and SSL.

Do I need to keep paying Namecheap?

Yes. Namecheap is your registrar — you pay annually for the domain. Cloudflare is the DNS/hosting (free or paid) but does not sell the domain itself.

Can I use Cloudflare with a .io or .dev domain?

Yes. Cloudflare supports every TLD that Namecheap supports. The setup is identical.

What happens if Cloudflare goes down?

Your domain is unreachable. Cloudflare has had two notable outages (2020, 2022) that took down significant fractions of the internet. The risk is real. For mission-critical domains, run a secondary DNS provider (NS1, Dyn, Route 53) and set up DNS failover.

Can I move back to Namecheap’s DNS after moving to Cloudflare?

Yes. Change the nameservers at Namecheap back to Namecheap’s defaults, restore your records, wait for propagation. The whole process is reversible.

How long does DNS propagation take?

5-30 minutes usually. Up to 24 hours if your TTL was set very high. Lower TTL to 300 seconds before making changes to speed propagation.

Can I use Cloudflare Workers with Namecheap domains?

Yes. Cloudflare Workers run on the same nameservers. Add a Worker route in Cloudflare’s dashboard pointing at your domain or path. The Worker runs at the edge before the request hits your origin.

FAQ

Is Cloudflare’s free plan enough?

For most teams, yes. The free plan includes DNS, CDN, DDoS protection, and a shared SSL certificate. Paid plans add WAF, advanced DDoS, and load balancing.

What is the difference between “DNS only” and “Proxied” in Cloudflare?

DNS only (grey cloud) means Cloudflare resolves the DNS but does not proxy. Proxied (orange cloud) means Cloudflare proxies the traffic through its CDN.

Do I need to keep paying Namecheap?

Yes. Namecheap is your registrar. Cloudflare is the DNS/hosting but does not sell the domain itself.

Can I use Cloudflare with a .io or .dev domain?

Yes. Cloudflare supports every TLD that Namecheap supports.

What happens if Cloudflare goes down?

Your domain is unreachable. For mission-critical domains, run a secondary DNS provider and set up DNS failover.

Can I move back to Namecheap’s DNS after moving to Cloudflare?

Yes. Change the nameservers back to Namecheap’s defaults, restore your records, wait for propagation.

How long does DNS propagation take?

5-30 minutes usually. Up to 24 hours if your TTL was set very high. Lower TTL to 300 seconds before making changes.

Can I use Cloudflare Workers with Namecheap domains?

Yes. Cloudflare Workers run on the same nameservers. Add a Worker route in Cloudflare’s dashboard pointing at your domain or path.

#Namecheap#Cloudflare#DNS#Domain Registrar#CDN