CNAME setup: a CDN in front of one hostname, DNS where it is

You change the domain’s nameservers at the registrar to the CDN’s. The CDN then answers DNS for the whole domain, every record is managed there, and any hostname can be proxied with a switch. This is the default on Cloudflare and the route on Set up Cloudflare from scratch. It works on the free plan. Its cost is organisational: DNS control moves, and the email and verification records must be carried across exactly.

Your DNS provider stays authoritative. For each hostname you want fronted, usually just www, you change its record to a CNAME pointing at the CDN, and the CDN proxies that hostname only. Nothing else in the zone is touched. On Cloudflare this is a Business-plan feature; on Fastly it is the only model there is.

1. Add the domain to a Cloudflare account on the Business or Enterprise plan. Ignore the instruction to change nameservers.
2. On the zone’s Overview page choose Convert to CNAME DNS Setup, and save the Verification TXT Record it shows.
3. At your DNS provider add that TXT record (name cloudflare-verify, under your domain). Cloudflare confirms by email, usually within hours. The record must stay in place for as long as the zone is on CNAME setup.
4. In Cloudflare DNS create a proxied record for each hostname to front (for example www, pointing at your host as today). At your DNS provider replace that hostname’s existing record with a CNAME to {hostname}.cdn.cloudflare.net, for example www.example.com CNAME www.example.com.cdn.cloudflare.net.
5. Wait for the Universal SSL certificate for that hostname, then deploy the NORG worker and attach its route to the fronted hostname as on the Cloudflare Worker install page.

A CNAME is not allowed at the zone apex (example.com), so the apex can only be fronted if your DNS provider offers CNAME flattening (sometimes called ALIAS or ANAME). Otherwise leave the apex pointed at your host and have the host redirect it to www, which most already do. AI agents follow that redirect like any client, so the worker on www still sees them.

• DNS-level DDoS protection does not apply: Cloudflare is not answering your DNS.
• Cloudflare documents that on a partial zone a Worker can only fetch hostnames that have a record in Cloudflare DNS; a hostname without one fails with a 530. The fronted hostname has its record from the steps above. The install’s verification step confirms that the worker’s fetches to your origin and to the two NORG hosts succeed before anything is served.
• Universal SSL is issued per proxied hostname once its CNAME resolves. A site sensitive to a certificate gap can pre-issue an advanced certificate with delegated validation instead.
• The verification TXT record is permanent while the zone is on CNAME setup.

1. Create the Fastly service for the hostname, with your current host as its origin. NORG’s Fastly adapter is a Compute service and is provisioned with your Site ID and Site Key.
2. Create a Fastly-managed TLS subscription for the hostname. Fastly shows a CNAME record for domain verification; add it at your DNS provider and wait for the subscription to activate.
3. The TLS configuration then shows the CNAME host for the hostname, for example dualstack.e.sni.global.fastly.net. At your DNS provider replace the hostname’s existing record with a CNAME to that host.
4. Verify, as on the white paper: a browser request returns your site unchanged, a simulated agent request returns the mirror.

For the apex Fastly supplies anycast IPv4 and IPv6 addresses, shown beside the CNAME host on the TLS configuration, to use as A and AAAA records. Fastly advises against ALIAS-style flattening. As with Cloudflare, a host-side redirect from the apex to www is the simplest arrangement.

• Full-site delivery. 100 GB bandwidth and 1 million requests free; then from US$0.12 per GB and US$0.01 per 10,000 requests, by region.
• Compute. 10 million requests and 100 million vCPU-milliseconds free; usage-billed beyond that.
• TLS. Five domains free on Fastly-managed TLS or Certainly; US$20 per domain per month beyond that.

Once www is CNAMEd to Fastly, all of that hostname’s traffic flows through it, not only AI agents, so bandwidth is billed on the whole site. For most small and medium business sites the free allowance covers it; a high-traffic site should estimate from its own analytics before agreeing.

• Fastly becomes a new service in your estate with its own account, billing and access controls, added for this purpose alone unless you planned to adopt a CDN anyway.
• The NORG Fastly adapter’s own bounds (its 5-second budget and the MCP path going to your origin rather than being relayed) are on the white paper’s CDN comparison.
• TLS at the edge is a Fastly-managed subscription; your host’s existing certificate keeps serving the origin behind it.

Use it. The worker goes on the existing zone or distribution and no DNS change is needed at all; see the integration patterns on the solution architecture page.

Cloudflare CNAME setup works but carries the Business plan cost. Fastly CNAME setup is inexpensive but adds a service to run. In either case all of www’s traffic now flows through a new party. For a WordPress site the in-application pattern avoids all three: the plugin runs inside the existing host, with one rule on WP Engine or the equivalent cache bypass elsewhere, and DNS is not involved. For a Vercel site the middleware does the same.

The NORG-hosted mirror serves the same pages from a hostname NORG runs; see hosting options.