Correct DNS Architecture When Using Cloudflare with Hostinger Hosting and Email Services (Hostinger / Google Workspace / Zoho / None)

This Knowledge Base article explains the correct DNS architecture, configuration, and operational best practices when:

• A domain is delegated to Cloudflare for DNS and security

  Advertisement

• Website hosting is provided by Hostinger

• Email is provided by Hostinger Email, Google Workspace, Zoho Mail, or no email service

The document focuses on:

• Eliminating DNS authority conflicts

• Ensuring predictable resolution behavior

• Preventing SSL, email delivery, and verification failures

This article assumes Cloudflare is the authoritative DNS provider.

2. Product / System Overview

Components Involved

3. DNS Architecture & Authority Model

3.1 Single Authority Rule (Critical)

A domain MUST have exactly one authoritative DNS provider.

When Cloudflare nameservers are configured at the registrar:

• Cloudflare becomes the sole DNS authority

• Hostinger nameservers must NOT be used

• All DNS records are created inside Cloudflare only

3.2 Correct Authority Flow

User Request
   ↓
Cloudflare Nameservers (Authoritative)
   ↓
Cloudflare DNS Records
   ↓
Hostinger Server IP (Website)
   ↓
Email Provider MX (Mail Flow)

3.3 What NOT to Do

4. Use Cases & Supported Environments

• WordPress / PHP websites on Hostinger

• Static websites

• Google Workspace business email

• Zoho Mail business email

• Hosting-only (no email) domains

• Multi-client MSP / IT service environments

5. Step-by-Step Implementation

5.1 Registrar Configuration (Mandatory)

Set ONLY Cloudflare nameservers at the registrar:

xxxx.ns.cloudflare.com
yyyy.ns.cloudflare.com

Remove:

• ns1.dns-parking.com

• ns2.dns-parking.com

• Any legacy hosting nameservers

5.2 Website DNS (Common for All Scenarios)

Create these records in Cloudflare → DNS:

Type: A
Name: @
Content: <Hostinger_Server_IP>
TTL: Auto
Proxy: Proxied

Type: A
Name: www
Content: <Hostinger_Server_IP>
TTL: Auto
Proxy: Proxied

Notes:

• Orange-cloud proxy must be enabled

• Enables CDN, SSL, DDoS protection

6. Email Configuration Scenarios

All email-related records MUST be DNS-only (gray cloud)

6.1 Hostinger Email

MX Records

MX  @  mx1.hostinger.com   10
MX  @  mx2.hostinger.com   20

SPF

TXT @  v=spf1 include:_spf.mail.hostinger.com ~all

DKIM (From Hostinger Panel)

TXT default._domainkey  v=DKIM1; k=rsa; p=MIIBIjANBgkq...

DMARC

TXT _dmarc  v=DMARC1; p=none; rua=mailto:postmaster@domain.com

6.2 Google Workspace Email

MX Records

MX @ ASPMX.L.GOOGLE.COM        1
MX @ ALT1.ASPMX.L.GOOGLE.COM  5
MX @ ALT2.ASPMX.L.GOOGLE.COM  5
MX @ ALT3.ASPMX.L.GOOGLE.COM 10
MX @ ALT4.ASPMX.L.GOOGLE.COM 10

SPF

TXT @  v=spf1 include:_spf.google.com ~all

DKIM

TXT google._domainkey  v=DKIM1; k=rsa; p=MIIBIjANBgkq...

DMARC

TXT _dmarc  v=DMARC1; p=none; rua=mailto:dmarc@domain.com

6.3 Zoho Mail

MX Records

MX @ mx.zoho.in   10
MX @ mx2.zoho.in  20
MX @ mx3.zoho.in  50

SPF

TXT @  v=spf1 include:zoho.in ~all

DKIM

TXT zoho._domainkey  v=DKIM1; k=rsa; p=MIIBIjANBgkq...

DMARC

TXT _dmarc  v=DMARC1; p=none; rua=mailto:dmarc@domain.com

6.4 No Email (Website Only)

A   @    <Hostinger_IP>   Proxied
A   www  <Hostinger_IP>   Proxied

Behavior:

• No MX records

• All inbound mail will bounce

• Acceptable only for non-communication domains

7. Proxy Rules (Critical)

8. Common Errors, Root Causes & Fixes

9. Security Considerations & Risks

• Missing DKIM/DMARC → Email spoofing

• Split DNS → Hijack risk

• No Cloudflare proxy → No DDoS/WAF

• Incorrect SPF → Mail spam rejection

10. Best Practices & Recommendations

• Use Cloudflare as the only DNS authority

• Always implement SPF + DKIM + DMARC

• Proxy only web traffic

• Document DNS for each client

• Avoid registrar default parking DNS

• Verify using:

  nslookup domain.com
  dig MX domain.com
  

11. Conclusion

When Cloudflare is used, it must fully own DNS authority. Hostinger should be treated strictly as an origin server, and email services must be integrated via explicit MX and TXT records inside Cloudflare.

Following this architecture ensures:

• Predictable DNS behavior

• Reliable email delivery

• Strong security posture

• Zero propagation ambiguity

#cloudflare #dns #hostinger #googleworkspace #zohomail #mxrecords #txtrecords #spf #dkim #dmarc #dnssecurity #dnstroubleshooting #cloudflaredns #webhosting #emaildns #domainsetup #dnsarchitecture #ssl #cdn #waf #dnsbestpractices #wordpresshosting #phphosting #itadmin #sysadmin #emailsecurity #dnsissues #dnsconfig #cloudflareproxy #dnsauthority #nameservers #emaildeliverability #domainmanagement #itkb #technicaldocumentation #networking #hostingguide #emailsetup #cloudflarehostinger #dnsguide