How to Add a Subdomain in Cloudflare DNS

A practical walkthrough for developers who manage their own servers and want clean DNS control without over-complication

Step 1: Open Cloudflare DNS Settings

No terminal needed here, but what you enter must match your server setup exactly.

Step 2: Decide the Subdomain Structure

Examples:

app.example.com
api.example.com
blog.example.com

You are only defining the left part (app, api, blog). The main domain is already implied.

Step 3: Add an A Record (Most Common)

Use this when the subdomain should point directly to a VPS IP.

Fill the fields as follows:

Type: A
Name: app
IPv4 address: YOUR_SERVER_IP
TTL: Auto
Proxy status: DNS only (recommended for backend services)

Save the record.

Step 4: Add a CNAME Record (If Needed)

Use this when the subdomain should point to another hostname.

Example:

Type: CNAME
Name: blog
Target: example.com
TTL: Auto

This is common for static sites or CDN-based setups.

Step 5: Verify DNS Resolution from Terminal

Wait 30–60 seconds, then run:

dig app.example.com +short

Or:

nslookup app.example.com

You should see the IP or target you configured. If nothing shows, Cloudflare hasn’t propagated yet.

Step 6: Configure the Server (Nginx Example)

DNS alone is not enough. Your web server must listen to the subdomain.

Create a new config file:

sudo nano /etc/nginx/sites-available/app.example.com

Minimal example:

server {
    listen 80;
    server_name app.example.com;

    root /var/www/app;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}

Enable it:

sudo ln -s /etc/nginx/sites-available/app.example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Step 7: Enable SSL (Optional but Recommended)

If Cloudflare proxy is enabled, set SSL mode to Full or Full (strict).

With Certbot:

sudo certbot --nginx -d app.example.com

Follow the prompts and let it auto-configure HTTPS. If the subdomain is for APIs, admin panels, or SSH-sensitive services, keep Cloudflare proxy off and firewall the port on the VPS. This avoids unnecessary latency and debugging pain