Hosting and DNS management decides whether anyone can reach your website, your email or your APIs. A fast application is useless if the domain expired overnight, DNS still points at a server you cancelled, or the SSL certificate stopped renewing weeks ago. Visitors get a browser warning or a blank page, and you usually hear about it from a customer.
Contents
At CodeWiz we take that layer on: where the site is hosted, how the DNS zone is structured, who controls the domain, and how certificates stay valid. We put Cloudflare in front of the origin, remove leftover records, automate renewals, and leave a short document so the setup does not live in one person’s inbox.
This is for companies still on a registrar’s shared package, agencies with many client domains, and teams that have outgrown one control panel. If you are unsure who can renew the domain, or a certificate has already expired on a Friday, this work removes that class of incident.
Cloudflare Hosting in Front of the Origin
Cloudflare hosting, as we set it up, means visitors connect to Cloudflare’s network while your application runs on an origin you control. A nearby data centre serves what it can from cache, and junk traffic is filtered before it reaches your machine. Cloudflare is the public address. It is not a replacement for the server where PHP, Node.js or the database actually runs.
Why it matters to the business
- Cached static files, and HTML where it is safe, hide a slow origin or a brief hosting blip.
- Changing servers is a change of one origin address. It takes effect in seconds, with an equally fast way back.
- TLS, DDoS absorption and a web application firewall come with the same setup that speeds the site up.
- Web records can be proxied. Mail records must not be, because the proxy speaks HTTP, not SMTP.
How we set it up
- Nameservers move to Cloudflare, or we use a partial setup when a partner has to keep serving DNS.
- The website and
wwware proxied. MX, mail hostnames and anything that is not HTTP stay DNS-only. - SSL mode is Full (strict), with a real certificate on the origin, so both hops are encrypted and checked.
- The origin accepts web traffic only from Cloudflare, or it has no inbound ports when we connect it with a Cloudflare Tunnel.
- Cache rules, compression and redirects live at the edge and survive the next server move. Details are in our guide to professional Cloudflare configuration.
DNS Configuration That Matches the Real System
DNS is the address book for the website, mail, staging, an API and every verification token a provider asks you to add. Each record has to point at something that still exists. Old projects leave stale A records, two MX records that disagree, and TXT entries nobody can explain.
| Record | Points to | Typical use | Where it goes wrong |
|---|---|---|---|
| A / AAAA | IPv4 or IPv6 address | Apex domain, mail server, an unproxied origin | Still aimed at a deleted server |
| CNAME | Another hostname | www, app subdomains, SaaS checks | Placed on the apex, which many providers reject |
| MX | Mail host and a priority | Inbound email | Two providers both set as the only primary |
| TXT | A text string | SPF, DKIM, DMARC, domain checks | More than one SPF record, which is invalid |
| CAA | A certificate authority | Who may issue certificates | Missing, so any CA may issue for the domain |
| NS | Nameservers | Which host serves the zone | Split between the registrar and Cloudflare |
We export the live zone before changing anything. A day or two before a move we lower TTLs, usually to 300 seconds, and raise them again once the new setup is stable. Cloudflare’s DNS documentation is the reference for proxied records, CNAME flattening on the apex and DNSSEC.
; example.com — website proxied at the edge, mail sent direct
example.com. 300 IN A 192.0.2.10
www.example.com. 300 IN CNAME example.com.
example.com. 300 IN MX 10 mail.example.com.
mail.example.com. 300 IN A 192.0.2.20
example.com. 300 IN TXT "v=spf1 include:_spf.example.net -all"What a cleaned zone includes
- One authoritative host. If Cloudflare serves the zone, the registrar’s old records are not a second copy.
- A note on every record that is not obvious: a verification token, a legacy subdomain, a partner’s IP.
- Mail and web separated, so the proxy never swallows email.
- Staging and admin hostnames that are not public by default.
Domain Management: Renewals, Transfers and Ownership
The domain is the asset you cannot rebuild from a backup. Hosting can be replaced in a day. A domain that expires and is taken by someone else is slow to recover, and sometimes impossible. We treat the registrar account like a production server.
What we look after
- Inventory: every domain, where it is registered, the expiry date, and a registrant contact that belongs to the company.
- Auto-renew on a company payment method, plus a reminder that does not depend on the registrar’s email.
- Lock and privacy: the registrar lock stays on, and registration privacy is enabled where the registry allows it.
- Transfers use the auth code, with the lock lifted only for that window, and never at the same moment as a nameserver change.
- DNSSEC only when the registrar and the DNS host both support it cleanly. A half-finished setup takes the whole domain offline.
The registrar registers and renews. Cloudflare, or another DNS host, serves the records. Buying hosting bundled with the domain is how companies later find they cannot leave a poor host without risking the name. Hosting and DNS management starts by separating those two jobs.
SSL Certificates That Renew on Their Own
Browsers treat an expired or mismatched certificate as a hard stop. Customers will not click through a warning to pay you. The fix is certificates that renew themselves, and an alert if a renewal fails. The mechanisms are not interchangeable.
| Approach | Who renews it | Trusted by browsers | When we use it |
|---|---|---|---|
| Cloudflare edge certificate | Cloudflare | Yes | Any site proxied through Cloudflare |
| Let’s Encrypt on the origin | Certbot, Caddy or the panel | Yes | The origin, or a site that is not proxied |
| Cloudflare Origin CA | Issued for years, then replaced | Only Cloudflare | The hop from Cloudflare to your server |
| Commercial wildcard | You, or the CA’s automation | Yes | Many subdomains, or a client that cannot use Let’s Encrypt |
How we keep HTTPS honest
- The edge certificate covers the apex and the hostnames you actually serve. A wildcard is added only when you need one.
- Full (strict) mode makes Cloudflare refuse an origin with a broken certificate. Flexible mode, which talks plain HTTP to the origin, is a setting we remove.
- HTTP redirects to HTTPS at the edge. HSTS waits until every hostname people might type has a valid certificate.
- CAA records name the authorities you use. Expiry is monitored anyway, because a firewall change fails the renewal challenge quietly.
Where the origin terminates TLS, Caddy renews certificates with almost no configuration, and Certbot does the same for Nginx or Apache. Let’s Encrypt explains the HTTP-01 and DNS-01 challenges in the official documentation. A typical webroot issuance looks like this:
certbot certonly --webroot -w /var/www/html \
-d example.com -d www.example.com \
--agree-tos --non-interactive -m ops@example.comEmail DNS: SPF, DKIM and DMARC
The failure we see most often in a hosting move is mail. The website comes up on the new server, and invoices, password resets and contact forms quietly stop. Those flows depend on records that have nothing to do with the website’s A record.
- MX points at the real mail host: Google Workspace, Microsoft 365, or a mail server you run.
- SPF is one TXT record listing every system allowed to send, including the app server or its SMTP relay. Two SPF records do not merge. They fail.
- DKIM publishes the public key your provider gives you, under the selector they specify.
- DMARC starts at
p=nonewith a reporting address, then moves to quarantine or reject once legitimate mail is aligned. - Application mail leaves through a proper relay. The local mailer on a VPS is a common reason messages never arrive.
We do not set DMARC to reject on the first day. A forgotten plugin would start bouncing mail you still need, so we check real messages before the policy gets stricter.
Choosing the Origin Behind the Domain
Cloudflare does not remove the need for a place to run the application, unless the site is static or built on Workers. The origin should follow the workload, not whichever host sold you the domain.
- Shared hosting at the registrar can hold a simple brochure site. You get little control, noisy neighbours and a painful exit.
- A VPS with an open-source panel such as CloudPanel fits WordPress, Laravel and a handful of sites, with no panel licence. We have written about running production hosting on open-source panels.
- A server without a panel fits applications we deploy with Docker or CI, where a panel would only hide the real process.
- A managed platform fits a small team that wants less server work and accepts a higher price and less freedom to tune the stack.
We size the server to measured traffic, keep backups off that machine, and leave the database off the public internet. Domain and DNS stay put when the origin moves, which is why hosting and DNS management is its own piece of work.
Moving Hosting Without Losing Mail or Orders
A hosting move is a data copy plus a DNS or origin change. The safe order is dull, and that is why it works.
- Build the new origin and copy files and the database while the old site still serves traffic.
- Lower TTLs, and issue certificates on the new server.
- Test on a temporary hostname: login, checkout, forms, and a real email in both directions.
- Run a final sync. If the site takes orders, a short read-only window stops writes on the old server after the copy.
- Switch the Cloudflare origin, or the DNS records if the domain is not proxied yet.
- Watch the logs and leave the old server up for a few days, long enough to notice a forgotten cron job.
If the domain is already proxied, changing the origin address is the whole public cutover, which is why DNS moves to Cloudflare before the server does.
Common Hosting and DNS Management Mistakes
- Auto-renew is off, and the only expiry notice goes to someone who left the company.
- Records are split between the registrar and Cloudflare, and nobody is sure which zone is live.
- The mail hostname is proxied, or the MX points at a proxied name, and email disappears.
- A tool adds a second SPF record, and sending starts to fail.
- Cloudflare SSL is left on Flexible, which hides an HTTP origin and can loop redirects.
- The old server is deleted the same day, before mail and forms have been checked.
- A wildcard record sends every typo and every forgotten subdomain to production.
What Drives the Cost of Hosting and DNS Management
We estimate after a short look at the zones and the servers. The expensive part is almost never the DNS edits themselves.
- How many domains there are, and how many registrars and old panels they are scattered across.
- Whether email, several applications and a shop share one zone that has to be untangled.
- A one-time cleanup versus ongoing care: renewals, certificate alerts, and someone to call when a record must change.
- Whether the origin only needs DNS and TLS, or the server has to be rebuilt and the data moved.
The VPS, the domain and any paid Cloudflare plan are billed by those providers. We choose them so the monthly cost stays predictable.
How We Work
- Discovery: domains, registrars, DNS hosts, mail, certificates, and where the code runs.
- Plan: DNS host, origin, certificate method, and a sequence that never moves mail and the website in one untested step.
- Build: the zone, cleaned records, a locked-down origin, certificates, backups and uptime checks.
- Test: the site off public DNS, real mail both ways, forms and checkout.
- Launch: cut over with TTLs already lowered. The old server stays until you are satisfied.
- Support: a renewal list, alerts for certificates and downtime, and a note on every record that is not obvious.
Why CodeWiz
- We build what we host. WordPress, Laravel, Node.js and online shops are daily work, so a DNS change is made by someone who knows which hostname the application calls.
- Open-source first. Let’s Encrypt, an open-source panel, and Cloudflare’s free tier where it is enough. A paid plan only when a feature earns it.
- Sized to the site. A short brochure does not get a cluster. A shop that takes orders gets backups, monitoring and a rehearsed way back.
- Performance in the same hands. Hosting, Cloudflare and the work behind a 100/100 PageSpeed result are one practice.
- Fair pricing, remote by default. CodeWiz was founded in Banja Luka in 2023 and works with clients locally and internationally. Read more about CodeWiz.
Frequently Asked Questions
How much does hosting and DNS management cost?
One domain with a clear zone and working email is a small engagement. Several domains, a shop and a server rebuild take longer. You get an estimate after we see the zones. The VPS and the domain are billed separately.
Should DNS live at Cloudflare or at the registrar?
For almost every site we manage, DNS lives at Cloudflare and the registrar only renews the domain. Changes are fast, and a later server move does not need a transfer. DNS stays at the registrar only when a contract or a registry rule requires it.
How long does an SSL certificate last, and what if renewal fails?
A Let’s Encrypt certificate lasts 90 days and should renew on its own. Cloudflare renews its edge certificates. We still monitor expiry, because a blocked challenge fails silently, and the alert fires while the current certificate is valid.
Will changing nameservers take the website and email offline?
Not when the new zone is a complete copy of the old one. We build that copy, lower TTLs, and only then switch. During propagation both zones give the same answers.
Can you manage a domain registered somewhere else?
Yes. Access to the registrar, for nameservers and auto-renew, and to the DNS host is enough. A transfer is worth it when you want one account for many domains.
What should we do if a domain is about to expire?
Renew it before any other change. After expiry, a grace period and then a redemption period may apply, and redemption costs more and is not guaranteed. Do not transfer the domain or change nameservers while it is inside expiry.
Ready to Put Hosting and DNS in Order?
Tell us where the domain is registered and what broke the last time something changed. We will look at the zone, the certificate and the origin, and propose a setup your site and your email can both survive. Contact us to start, or see our hosting and DNS services.