How to Point Cloudflare DNS to Contabo VPS and Hostinger (Fast Anycast Routing)

Why Cloudflare DNS is an Essential Layer

Domain registrar DNS servers (such as GoDaddy or Namecheap) are notoriously slow, taking between 50ms and 200ms just to resolve a domain name before a visitor even downloads a single byte. Cloudflare operates the world's fastest Anycast DNS network (1.1.1.1) with global resolution times under 12ms. Furthermore, routing traffic through Cloudflare masks your Contabo VPS or Hostinger server IP, making targeted DDoS attacks virtually impossible.

Step 1: Adding Your Domain to Cloudflare

1. Create a free account at Cloudflare.com.
2. Click Add a Site and enter your root apex domain (e.g. example.com).
3. Select the Free Plan and click Continue.
4. Cloudflare will automatically scan and import your existing DNS records.

Step 2: Pointing Records to Your Server

Scenario A: Pointing to a Contabo VPS

Create an A Record pointing your root domain and www to your Contabo public IPv4 address:

• Type: A | Name: @ | IPv4: YOUR_CONTABO_IP | Proxy status: Proxied (Orange Cloud)
• Type: CNAME | Name: www | Target: example.com | Proxy status: Proxied

Scenario B: Pointing to Hostinger Web Hosting

Find your Hostinger server IP under hPanel -> Hosting -> Details:

• Type: A | Name: @ | IPv4: YOUR_HOSTINGER_IP | Proxy status: Proxied
• Type: CNAME | Name: www | Target: @ | Proxy status: Proxied

Step 3: Updating Nameservers at Your Domain Registrar

Cloudflare will assign you two unique nameservers (e.g. eva.ns.cloudflare.com and tom.ns.cloudflare.com):

1. Log in to your domain registrar (Namecheap, GoDaddy, Porkbun, or Google Domains).
2. Navigate to DNS Management and change the nameserver mode from "Default" to "Custom DNS".
3. Paste the two Cloudflare nameservers and save changes.

Step 4: Configuring Cloudflare SSL/TLS Encryption Mode

Crucial Security Step: In the Cloudflare dashboard, navigate to SSL/TLS -> Overview. Ensure encryption mode is set to Full (Strict). Never select "Flexible," as "Flexible" leaves traffic between Cloudflare edge and your Hostinger/Contabo origin unencrypted, triggering infinite redirect loops.

Step 5: Restoring Real Visitor IPs in Nginx

When Cloudflare proxies traffic, your server access logs will show Cloudflare's edge IPs rather than actual visitor IPs. On Ubuntu Nginx, add Cloudflare's IP ranges to /etc/nginx/conf.d/cloudflare.conf so $remote_addr reflects true visitor identities:

sudo nano /etc/nginx/conf.d/cloudflare.conf

# Cloudflare IPv4 ranges
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;

real_ip_header CF-Connecting-IP;

Reload Nginx: sudo systemctl reload nginx.