For teams that want to manage a Shopify store through Cloudflare, the first question often sounds simple: Should we move our domain records to Cloudflare?
The real issue is broader than moving the domain. You need to consider where DNS will be managed, which records should point to Shopify, where the Cloudflare proxy should be involved, and how email records will be protected.
An incorrect DNS change can make the store unreachable. A smaller mistake can affect www redirects, SSL validation, or email deliverability. For this reason, it is better to treat Cloudflare not as a “speed button” placed in front of Shopify, but as a separate DNS and network layer.
First, separate the two systems: what does Shopify manage and what does Cloudflare manage?
Shopify is the ecommerce platform where the store is hosted. Product pages, checkout, the theme, and Shopify’s CDN infrastructure run on Shopify.
Cloudflare is a separate layer that can manage the domain’s DNS records and, in supported scenarios, provide proxy, security, and performance services for traffic.
Using Cloudflare therefore does not mean moving Shopify hosting to Cloudflare. The store still runs on Shopify; on the DNS side, Cloudflare can determine which service the domain points to.
Which DNS records does a Shopify domain connection expect?
According to Shopify’s current documentation, when manually connecting a third-party domain to Shopify, the A record for the root domain points to Shopify’s IPv4 address 23.227.38.65, the AAAA record points to 2620:0127:f00f:5::, and the www CNAME record points to shops.myshopify.com.
Shopify also recommends removing additional A or AAAA records that might conflict with the records Shopify expects. If your DNS provider does not automatically terminate hostnames, keep in mind that the use of a trailing dot in the CNAME target can depend on how the DNS panel behaves.
The important point here is not to copy Shopify DNS guides written years ago. For IP addresses and verification requirements, check Shopify’s current domain documentation for every setup.
Should the Cloudflare proxy be enabled?
In Cloudflare, the orange cloud means a record is proxied, while the gray cloud means it is set to DNS only.
Cloudflare explains that HTTP/HTTPS traffic for proxied records passes through its network and that the origin IP can be hidden. With DNS-only records, DNS queries return the actual target directly.
However, during Shopify domain verification and connection, the safest approach is to first create the DNS records Shopify requires correctly and confirm that the domain appears connected and secure in Shopify Admin.
If proxying, redirect rules, or other Cloudflare features will be enabled later, test them individually. The goal is not simply to say “we use Cloudflare,” but to add the required layer without breaking the store’s domain and SSL flow.
Does Cloudflare automatically make a Shopify store faster?
A common assumption is that adding Cloudflare will automatically make a Shopify store faster.
Shopify already uses a global CDN. Shopify’s performance documentation explains that its CDN infrastructure serves store assets from locations close to users.
For this reason, putting Cloudflare in front of Shopify is not the same scenario as placing a slow origin server behind a CDN.
If a Shopify store has performance issues, review theme JavaScript, third-party apps, large images, fonts, tracking scripts, and section architecture first. Cloudflare cannot make a poorly prepared theme fast on its own.
Remember that SSL has two separate layers
Shopify provides TLS certificates free of charge for correctly connected domains, and certificate provisioning proceeds automatically after the domain is connected. Shopify states that TLS certificate provisioning can take up to 48 hours.
When the Cloudflare proxy is used, the connection between the visitor and Cloudflare and the connection between Cloudflare and the origin also need to be considered separately. Cloudflare’s SSL/TLS encryption modes determine how these two connections are established.
Therefore, when troubleshooting an SSL issue, it might not be enough to look only at the domain status in Shopify Admin. The DNS record’s proxy status and the Cloudflare SSL/TLS configuration should also be checked.
Do not delete email records when changing DNS
One of the most critical operational risks in Shopify + Cloudflare migrations is forgetting email records.
When you move nameservers to Cloudflare, you begin managing not only website records but the domain’s entire DNS zone.
This zone can contain email-related records such as MX, SPF, DKIM, and DMARC. If zone records from the previous DNS provider are not migrated completely, the website may continue to work while corporate email breaks or sender authentication is affected.
Before changing nameservers, take a complete inventory of the existing DNS zone. Mark web, email, verification, and third-party service records separately.
Where should redirect rules be managed?
Cloudflare redirect rules are powerful, but moving every redirect to Cloudflare is not always the right approach.
For example, when migrating from an older ecommerce platform to Shopify, redirects from old product and category URLs to their new Shopify equivalents can usually be managed through Shopify’s URL Redirect structure.
Domain-level redirects can be different. If an old domain needs to redirect entirely to a new domain, or if you need specific host-based rules, the Cloudflare layer may be appropriate.
The important thing is to define a single owner for each redirect. Layering the same redirect logic across the registrar, Cloudflare, and Shopify can create redirect chains that are difficult to track.
A controlled Shopify + Cloudflare migration sequence
In projects, the following sequence is generally easier to control:
1. Export or document the existing DNS zone records.
2. Separately verify MX, SPF, DKIM, DMARC, and third-party verification records.
3. Add the domain to Cloudflare and compare the imported records with the previous DNS provider.
4. Apply Shopify’s current A, AAAA, and www CNAME requirements.
5. Connect the domain in Shopify Admin and verify the connection status.
6. Test HTTPS, www, and root-domain behavior in a real browser.
7. Test sending and receiving corporate email.
8. If Cloudflare proxy, security, or redirect features will be used, enable them one by one and test again after each change.
This sequence makes it easier to identify which layer is causing a problem when something goes wrong.
When does Cloudflare actually make sense?
Cloudflare is not mandatory for every Shopify store.
However, it can become a useful architectural layer when multiple subdomains are managed, different services run under the same domain, centralized DNS management is required, or Cloudflare’s security and traffic-management features are needed.
For example, if the same brand has a Shopify store, a separate ERP-connected service, API endpoints, and country-specific subdomains, managing DNS from one place can simplify operations.
On the other hand, adding Cloudflare only because “Shopify should be faster” can mean the underlying problem has not been defined correctly.
Conclusion
Shopify and Cloudflare can be used together, but the correct setup involves more than simply “turning on Cloudflare and making the store faster.”
DNS records, Shopify domain verification, SSL, email records, and redirects are all parts of the same architecture.
The healthiest approach is to first document the domain’s current state, apply Shopify’s current DNS requirements, and enable Cloudflare features gradually as they are actually needed.
This allows Cloudflare to serve as a manageable infrastructure layer rather than an additional source of complexity for the store.
Digimaps note: If domain, Cloudflare, or DNS architecture has become complex in your Shopify project, we can review the current setup together and clarify which layers are actually necessary.