Getting Error 1014: CNAME Cross-User Banned on domains pointing CNAME to my account

[frozen silo]

I understand that domains pointing CNAME records to my domain are blocked if the domains are not set up in the same cloudflare account, and I understand that if I upgrade to PRO then I can contact support to lift this restriction.

My question is: can this restriction be lifted for all domains at once, or does it have to be done for each domain individually?

I will upgrade if it can be done for all domains.

I run a url shortening service and there will be new domains with CNAME record pointing to my domain every time a new user adds a domain.

Thanks!

It specifies here this:

To allow CNAME 41 record resolution to a domain in a different Cloudflare account, the domain owner of the CNAME 41 target must contact Cloudflare Support 89 and specify the domains allowed to CNAME 41 to their target domain. A Cloudflare Pro, Business, or Enterprise plan is required on the target domain for Cloudflare Support to change default CNAME 41 restrictions.

https://community.cloudflare.com/t/error-1014-cname-cross-user-banned-how-to-resolve/324935

However, I need it to allow any domain, not just the ones I manually ask to be allowed.

Can this be done?

[frozen silo]

hello?

[cedar yacht]

what you're looking for is CF for SaaS: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/
It takes care of certificate issuing as well, and lets people CNAME to your account, and traffic flows to the fallback origin you set up. It's what Cloudflare Pages uses under the hood for Custom Domains for example, as well as Shopify and a few other companies

[frozen silo]

Thank you @cedar yacht I'm looking into it.

According to the documentation this is available on free plans, but when I try to enable it I'm presented with a payment form. What gives?

[cedar yacht]

available on free plans as an addon

Free, Pro, and Business Plan: Free for the first 100 hostnames and $0.10 a month for each additional custom hostname.

(hostname referring to the customer hostname, ex one customer sets up link.theirsite.com to point to you, = one hostname. If they had link2.theirsite.com, would be another)

[frozen silo]

thank you!

[frozen silo]

@cedar yacht I have added one hostname manually to test. One weird thing is that it seems that domain has now inherited TXT records from the main domain.

How can I avoid that?

[cedar yacht]

That's how cnames work, but you can CNAME to anything in that domain proxied. For example, make a record called links.yourdomain.com, type: AAAA, value: 100::, proxied. Won't work to visit directly, but you can cname to it from another domain, and if it's added in your Custom hostnames tab, it'll follow the fallback origin set there instead.
You could also cname directly to your fallback origin if it's proxied, doesn't really matter. It's like an entry to CF, and the route is determined by the custom hostname link existing, just important that it's to your domain

https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/start/getting-started/
Guide here recommends using a wildcard *.customers.domain.com, not a bad idea, and you could ask them to cname to theircompanyname.customers.yourdomain.com

[frozen silo]

Thanks @cedar yacht that worked. Do you know is there's any way that my customers can simply add the CNAME record to their domain name but not have to add a TXT record for validation of the certificate?

[cedar yacht]

You can do it with just the CNAME -- called HTTP Validation: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/http/
via the API you just pass http validation method, and you can select it under cert. validation via the dash as well

[frozen silo]

That worked great thanks. So when a hostname is added and verified with HTTP method, how are the certificates renewed? I've added two domains but the certificates expire after one year. Do I need to do anything to renew them, or they renew automatically?

[cedar yacht]

automatic, they use the /.well-known/acme-challenge path, can find more info on http challenges here: https://letsencrypt.org/docs/challenge-types/

[autumn belfry]

@cedar yacht Hi, I also met this issue when I access R2 bucket objects, using custom domian linked to the bucket. It's weired that I can't active/disable/delete the domain from the R2 setting dashboard. It's current status is "unknown". (1) Click active/disable the domain in R2 setting, nothing happened. (2) Click delete, it would report error: "We encountered an internal error. Please try again. (Code: 10001)".

[cedar yacht]

Hey 👋
Can you continue this in #r2 or a new #1104040620948992090 post?

[autumn belfry]

The zone has Edge Certificates cover it and it's subdomain (wildcard).