Every DNS record in the Cloudflare dashboard has a small cloud icon. An orange cloud means "Proxied", a grey cloud means "DNS only". That icon makes a big difference: proxied, visitors connect to Cloudflare, which forwards requests to your server; DNS only, Cloudflare simply returns your IP like any DNS provider. Many problems come from having the proxy on or off on the wrong record.
What the proxy does
For a proxied record, DNS returns Cloudflare addresses instead of your server's IP. The browser connects to Cloudflare, which answers from cache or forwards the request. That is why the proxy works only for web traffic over HTTP and HTTPS; mail, FTP, SSH and database connections cannot pass through it. A proxied site shows Cloudflare IPs and the headers server: cloudflare and cf-ray.
dig misol-dokon.uz A +short
curl -sI https://misol-dokon.uz | grep -iE "server|cf-ray"When to turn the proxy on
The main site and www are natural candidates. If the site is hit by bots, serves lots of images and static files, or has visitors in many countries, the proxy caches static content, stops floods before they reach the server, enables security rules and hides the origin IP behind proxied names. During sales it can cut server load noticeably, although dynamic pages, carts and accounts are usually not cached.
Keep in mind that the proxy is not a replacement for a properly sized server. It shields the origin from floods and serves cached copies of images, styles and scripts, but every checkout, search and login still reaches your server. If the site is slow because of heavy database queries or an overloaded plugin, the proxy will hide only part of the problem, so measure server response time separately before deciding that Cloudflare alone will make the site fast.
Records that must stay grey
Anything mail-related must be DNS only. If the mail host used by your MX is proxied, it resolves to Cloudflare and other servers cannot deliver mail. The proxy also passes only specific ports: 80, 8080, 8880, 2052, 2082, 2086, 2095 for HTTP and 443, 2053, 2083, 2087, 2096, 8443 for HTTPS. The ISPmanager panel listens on port 1500 by default, so a proxied panel hostname will not open.
misol-dokon.uz A 203.0.113.25 ; Proxied
www CNAME misol-dokon.uz ; Proxied
mail A 203.0.113.25 ; DNS only
panel A 203.0.113.25 ; DNS only
@ MX 10 mail.misol-dokon.uz.Cloud platforms and SaaS tools that verify your domain or issue their own certificates usually need to see their CNAME directly and recommend DNS only in their documentation. Follow that advice; stacking two proxies and two caches tends to produce confusing errors.
Errors that come from the proxy
With the proxy on, some errors come from Cloudflare: 521 means it could not connect to your server, 522 is a connection timeout, 525 and 526 are SSL problems, and 524 means your server took too long to respond. Upload size per request is also limited by plan. Check exact values in Cloudflare's documentation.
Example: an online shop and its 1C sync
An appliance shop in Tashkent ran its site behind the proxy, but the nightly 1C stock sync started failing with 524 because processing the catalogue took minutes, and managers could not reach the server panel. The fix was two subdomains, sync.misol-dokon.uz and panel.misol-dokon.uz, both set to DNS only. The storefront stayed protected while service connections went straight to the server.
Local speed and quick diagnosis
For a site hosted in Uzbekistan with a local audience, measure speed with and without the proxy. Without it, users reach the server over Tas-IX; with it, requests first go to a Cloudflare edge chosen by the user's ISP, which can add latency. When something breaks, switch the record to DNS only for a moment: if the problem disappears, look at Cloudflare settings; if not, look at the server. If your server is at sayt.uz, support can help with server-side logs.