How to Connect Cloudflare Custom Domains to GoHighLevel Funnels and Websites

You wire up a custom domain in GoHighLevel, point your DNS in Cloudflare, and get hit with an endless SSL pending spinner or an ERR_TOO_MANY_REDIRECTS loop. I run into this constantly on client setups because Cloudflare’s default proxy and SSL settings clash directly with how HighLevel provisions automated certificates.

Getting Cloudflare and HighLevel to play nicely takes about five minutes once you know which records to use and when to flip the proxy toggle. Here is the exact setup I use to hook up root domains, subdomains, and funnels without SSL hiccups.

The Cloudflare-to-HighLevel Setup Flow (and Why It Breaks)

Whenever you add a domain under Settings > Domains, HighLevel automatically provisions a free SSL certificate via Let’s Encrypt or Google Trust Services. To issue that certificate, HighLevel’s edge servers need to reach your domain directly to complete an ACME challenge.

If you add your DNS records with Cloudflare’s orange cloud proxy turned on right away, Cloudflare intercepts that incoming traffic through its own reverse proxy. HighLevel cannot see the bare DNS records directly during the handshake, so your domain gets stuck in an endless “SSL Pending” or “Verification Failed” state.

The fix is straightforward: configure the A and CNAME records, disable the proxy during initial verification, set your Cloudflare SSL mode properly, and then map the domain to your funnel inside HighLevel.

Step 1: Add DNS Records in Cloudflare (A Record and CNAME)

Log into Cloudflare, pick your domain, and head to DNS > Records. The records you add depend on whether you are routing the root apex domain (example.com), a www subdomain, or a dedicated subdomain (like pages.example.com).

HighLevel uses standard edge endpoints. For root domains, point an A record to HighLevel’s load balancer IP. For subdomains, point a CNAME to HighLevel’s funnel hostname.

Here are the exact records you need:

• Root Domain (@): Type A, Name @ (or example.com), Target 34.68.234.4.
• WWW Subdomain (www): Type CNAME, Name www, Target flash.funnels.msgsndr.com.
• Custom Subdomain (e.g., pages): Type CNAME, Name pages, Target flash.funnels.msgsndr.com.

If you want to verify DNS propagation from your terminal before touching HighLevel, run a quick dig query:

# Check your root A record
dig +short A example.com # Check your CNAME record
dig +short CNAME www.example.com

If you are setting up an isolated subdomain for a client site, our guide on how to connect a subdomain to a multi-page website in GoHighLevel covers subfolder routing patterns in detail.

Step 2: The Proxy Status Rule (Grey Cloud vs. Orange Cloud)

This is where almost every domain issue starts. When you add an A or CNAME record in Cloudflare, it defaults the Proxy status to Proxied (the orange cloud icon).

During setup, change the Proxy status to DNS only (the grey cloud icon). Click the orange cloud next to each HighLevel record until it turns grey.

Why? HighLevel needs a direct line to your DNS to verify ownership and generate its SSL certificate. If Cloudflare sits in the middle before HighLevel finishes verification, the check fails every single time.

You can reference the official GoHighLevel Help Center guidelines or check the Cloudflare DNS record documentation for details on toggling proxy statuses across record types.

Step 3: Configure Cloudflare SSL/TLS Encryption Mode

If you plan to switch Cloudflare back to the orange cloud later (to take advantage of Cloudflare WAF, caching, or DDoS protection), you need to set your SSL/TLS encryption mode properly. If this mode is misconfigured, your visitors hit an ERR_TOO_MANY_REDIRECTS loop.

In your Cloudflare dashboard, go to SSL/TLS > Overview.

Set the encryption mode to Full (strict) or Full:

• Off: Breaks HTTPS entirely. Don’t use it.
• Flexible: Cloudflare talks to HighLevel over unencrypted HTTP (port 80), but HighLevel immediately forces a redirect back to HTTPS (port 443). That creates an infinite 301 loop. Never use Flexible with HighLevel.
• Full: Cloudflare connects to HighLevel over HTTPS on port 443 and accepts HighLevel’s cert.
• Full (strict): Best option. Cloudflare validates HighLevel’s SSL certificate directly over encrypted port 443.

For more edge-case validation issues, check out our guide on how to fix GoHighLevel domain SSL pending and DNS errors.

Step 4: Add and Verify Domain Inside GoHighLevel Settings

With your DNS records set to DNS-only (grey cloud) in Cloudflare, jump over to your GoHighLevel sub-account.

1. Head to Settings > Domains.
2. Click Add New Domain in the top right.
3. Enter your domain name (like www.example.com or example.com).
4. HighLevel shows a confirmation modal with the expected records. Since you already added them in Cloudflare, click Continue or Verify Records.

HighLevel will run a verification check against your nameservers. It usually takes 10 to 60 seconds to detect the records and issue the SSL certificate. Once verified, HighLevel gives you a dropdown to link the domain directly to a funnel or website step.

If you’re also setting up custom portal URLs for agency branding, take a look at our walkthrough on how to set up a custom whitelabel domain in GoHighLevel.

Step 5: Assign the Custom Domain to Funnels and Websites

Adding the domain under sub-account settings makes it available to your account, but it won’t publish your pages automatically. You still have to link the domain to the actual funnel or site.

Here is how to map it:

1. Go to Sites > Funnels (or Websites).
2. Select the funnel you want to publish.
3. Click the Settings tab in the top navigation bar of that funnel.
4. In the Domain dropdown, select your newly verified domain.
5. Pick your default Step (usually your opt-in or sales page).
6. Click Save at the bottom.

Open an incognito window and test the URL. Your funnel should load immediately over HTTPS with a valid padlock.

Step 6: Handle Root Domain to WWW Redirects in Cloudflare

Most people type example.com without the www. If your funnel is mapped to www.example.com, visitors hitting the apex domain will land on an error page unless you set up an automated redirect.

You can configure root redirects in HighLevel under domain settings, or let Cloudflare handle it at the edge using Redirect Rules so it never even touches your origin server.

To create a Single Redirect in Cloudflare:

1. In Cloudflare, go to Rules > Redirect Rules.
2. Click Create Rule.
3. Name it Redirect Apex to WWW.
4. Under When incoming requests match, choose Custom filter expression.
5. Set the expression to: Hostname equals example.com.
6. Under Then, set Type to Dynamic.
7. Set the target expression to redirect traffic while preserving the full URL path:

// Cloudflare Dynamic Redirect Target Expression
concat("https://www.example.com", http.request.uri.path)

Set the status code to 301 (Moved Permanently) and click Deploy. Now, anyone heading to example.com/checkout gets bounced to https://www.example.com/checkout instantly.

For a deeper dive into redirection strategies across the platform, read our guide on how to set up root domain and WWW redirects in GoHighLevel.

Troubleshooting Common Cloudflare and HighLevel Domain Errors

If your domain throws an error or refuses to resolve, run through these common fixes:

• Error 521 / Web Server is Down: Cloudflare is set to Proxied (orange cloud) and pointing to a dead or incorrect IP. Make sure your A record points to 34.68.234.4.
• SSL Handshake Failed (Error 525): Cloudflare SSL mode is set to Full (strict), but HighLevel hasn’t finished provisioning its certificate. Switch Cloudflare to DNS only (grey cloud) for 10-15 minutes so HighLevel’s cert can finalize, then flip the proxy back on.
• ERR_TOO_MANY_REDIRECTS: Your Cloudflare SSL mode is on Flexible. Switch it to Full (strict) under SSL/TLS Overview per the Cloudflare SSL Modes documentation.
• Domain shows a HighLevel 404 page: The domain is verified under Settings > Domains, but you haven’t linked it inside Sites > Funnels > [Your Funnel] > Settings > Domain.

Frequently Asked Questions

Can I leave Cloudflare proxy (orange cloud) turned on with GoHighLevel?

Yes, but only after you have verified the domain inside HighLevel and confirmed the SSL certificate is issued. Once that’s done, you can turn the orange cloud back on—just make sure your Cloudflare SSL mode is set to Full or Full (strict).

What is the difference between flash.funnels.msgsndr.com and preview.ghlpreview.com?

Both are official HighLevel CNAME endpoints. flash.funnels.msgsndr.com is the production edge CNAME you should use for live client funnels and websites because it handles automated CDN caching and SSL certs cleanly.

Why does HighLevel say “Could not find DNS records” when Cloudflare shows them added?

DNS changes can take a couple of minutes to propagate across external resolvers. Wait 2 to 5 minutes and try again. Also double-check that you don’t have conflicting records, like an old AAAA record or an outdated A record on the same host.

Do I need separate DNS records for membership areas or client portals?

Yes. If you are running a client membership portal or whitelabeled app dashboard, point a separate subdomain (like app.yourdomain.com or members.yourdomain.com) with a CNAME pointing to custom.msgsndr.com.

Next Steps for Your HighLevel Infrastructure

With your domain verified and routing cleanly through Cloudflare, your funnel is ready for live traffic. If you plan to send transactional emails or tracking links from this domain, configure your email records next.

Check out our walkthrough on how to set up a dedicated email sending domain in GoHighLevel to get SPF, DKIM, and DMARC dialed in alongside your funnel DNS.