DNS Architecture, ccTLD Engineering & Cloudflare Edge Infrastructure
A web application's availability and brand trust begin with DNS architecture. This technical guide covers domain acquisition strategies across global and local registries, authoritative record mapping, apex routing, and enterprise edge security configuration using Cloudflare.
1. Domain Registrars & TLD Taxonomy: Global (.com) vs Kenyan (.co.ke)
Choosing the right domain extension impacts search engine ranking, regional brand trust, and legal jurisdictions.
- Global gTLDs (.com, .org, .net, .io): Governed by ICANN. Use registrars that do not mark up renewal prices and provide free WHOIS privacy protection, such as Cloudflare Registrar or Namecheap. Global TLDs support standard automated DNSSEC and instant transfer authorization codes (EPP codes).
- Kenyan ccTLDs (.co.ke, .ke, .or.ke, .ac.ke): Governed by the Kenya Network Information Centre (KeNIC). Domains are provisioned through accredited Kenyan registrars (e.g., Truehost Cloud, Sasahost, EACdirectory, Kenya Web Experts).
- Registration requires verifying domain availability against KeNIC registry databases.
- Local Kenyan domains (.co.ke) offer significant SEO advantages for search queries originating within East Africa, building domestic buyer confidence and ensuring regional trademark compliance.
- Registrar lock must be managed through the registrar portal when transferring nameserver authority.
2. Authoritative DNS Records Matrix
DNS translates human-friendly hostnames into machine-routable network endpoints. Understand the role and configuration syntax of each record:
| Record | Target Name | Value / Destination | Purpose & Architectural Role |
|---|---|---|---|
| A | @ (apex) | 192.0.2.1 | Direct IPv4 address mapping. Used for standalone servers or dedicated VPS instances. |
| AAAA | @ (apex) | 2001:db8::1 | Direct IPv6 address mapping for modern dual-stack routing. |
| CNAME | www, fixit | cybertech-harry.github.io | Canonical alias. Maps subdomains to cloud providers (GitHub Pages, Vercel, Render). |
| MX | @ | aspmx.l.google.com (Priority 1) | Mail Exchanger. Routes organizational emails to Google Workspace, Zoho, or Microsoft 365. |
| TXT (SPF) | @ | v=spf1 include:_spf.google.com ~all | Sender Policy Framework. Authorizes specific mail servers to send on behalf of the domain. |
| TXT (DKIM) | google._domainkey | v=DKIM1; k=rsa; p=MIGfMA0GCS... | Cryptographic public key verifying outgoing email authenticity and preventing spoofing. |
| TXT (DMARC) | _dmarc | v=DMARC1; p=reject; rua=mailto:... | Enforces policy action when SPF/DKIM checks fail, protecting brand reputation from phishing. |
3. Nameserver Delegation & Cloudflare CNAME Flattening
To place Cloudflare in front of your web application:
- Nameserver Update: In your domain registrar portal (Truehost or Namecheap), locate "Custom Nameservers" and replace the registrar defaults with your Cloudflare assigned pair (e.g.,
ada.ns.cloudflare.comandburt.ns.cloudflare.com). - Apex CNAME Flattening: Standard DNS specifications (RFC 1034) prohibit CNAME records on the root apex domain (
@orcybertechcomps.com) because it conflicts with SOA and NS records. Cloudflare resolves this via CNAME Flattening: Cloudflare queries the target CNAME dynamically and returns authoritative A/AAAA records directly to requesting DNS resolvers. - Proxy Status (Orange vs Grey Cloud):
- Proxied (Orange Cloud): Requests pass through Cloudflare's edge CDN. Hides origin IP, mitigates DDoS attacks, enables Web Application Firewall (WAF), and serves cached assets globally.
- DNS Only (Grey Cloud): Bypasses Cloudflare proxy. Mandatory for mail servers (MX), FTP, SSH tunnels, or bare IP endpoints that do not operate on standard HTTP/HTTPS ports.
4. SSL/TLS Encryption: Full (Strict) Mode Setup
Never use Flexible SSL in production. Flexible mode encrypts traffic between the visitor and Cloudflare, but sends unencrypted plaintext HTTP between Cloudflare and your origin server, exposing user sessions and payment credentials to network sniffing.
- Full (Strict) Mode: Requires an end-to-end encrypted HTTPS handshake between the visitor, Cloudflare Edge, and your origin server with a valid, trusted SSL/TLS certificate.
- Cloudflare Origin CA Certificate: In the Cloudflare dashboard under SSL/TLS > Origin Server, generate a free 15-year Origin Certificate. Install the certificate (
origin.crt) and private key (origin.key) on your Nginx, Apache, or Docker reverse proxy. - Always Use HTTPS: Enable "Always Use HTTPS" and "Automatic HTTPS Rewrites" to upgrade all insecure HTTP requests to HTTPS with 301 redirects.
- Minimum TLS Version: Enforce TLS 1.3 or TLS 1.2 minimum. Disable deprecated TLS 1.0 and 1.1 ciphers to maintain strict PCI-DSS and security compliance.
5. Edge Caching & Web Application Firewall (WAF)
- Security Rules: Under Security > WAF, create custom firewall rules to block high-risk ASN networks, challenge automated scrapers, and rate-limit sensitive endpoints (such as
/api/v1/auth/loginand/api/v1/mpesa/process). - Page Rules & Cache Rules: Bypass cache for all dynamic API routes (
/api/*: Cache Level: Bypass). Enforce Edge Cache TTL for static assets (/_next/static/*: Cache Level: Cache Everything, Edge Cache TTL: 1 month).