Next-generation Global CDN
Connect a Cloudflare-Proxied Domain to a New Site (O2O)
Connect a domain that is proxied through your own Cloudflare zone to a new Pantheon site on the next-generation GCDN using Orange-to-Orange (O2O).
If you're adding a domain to a new Pantheon site and your own Cloudflare zone already proxies that domain (orange-clouded), you can keep the zone in front of Pantheon's next-generation GCDN using Cloudflare's Orange-to-Orange (O2O) configuration. This page walks through connecting the domain, including the records to add, the order to add them in, and the errors you may see along the way. To move an existing site from the legacy Global CDN instead, see Migrate a Cloudflare-Proxied Domain (O2O).
O2O setup runs through Terminus rather than the dashboard's TXT-record verification flow. You add the domain to your site, then get every record you need from Terminus and add them in your Cloudflare zone. Repeat the process for each domain.
Before you begin
Be sure that you have:
- A new site on Pantheon. New sites already use the next-generation GCDN, so there's nothing to upgrade.
- Terminus and the GCDN Terminus plugin installed on your local computer.
- Access to the Cloudflare account that hosts the zone, with permission to edit DNS records and SSL/TLS settings.
- A domain that your Cloudflare zone proxies and that currently serves traffic from another host.
O2O setup requires the GCDN Terminus plugin, and the dashboard can contradict these steps. Ignore the DNS records and TXT verification steps the dashboard shows for these domains, and use the records from terminus gcdn:o2o instead.
Run terminus gcdn:update before you start to install the latest plugin version. Older versions report not verified for O2O domains, even when the certificate is issued.
Release your zone hold (Enterprise only)
Zone Holds are enabled by default on Cloudflare Enterprise plans and Cloudflare for SaaS Enterprise accounts. If your zone is on a Free, Pro, or Business plan and your domain was not previously on a Cloudflare for SaaS provider, it has no Zone Hold, so skip this step and re-enabling the hold at the end.
Otherwise, release the hold right before you add the domain to your site, and re-enable it once the hostname becomes active. Pantheon creates the custom hostname as soon as you add the domain, and Cloudflare checks for a Zone Hold at that moment. If a hold applies, the hostname starts as Blocked, with no ownership validation or certificate, and a cutover in that state returns a 1014 error. A hold always blocks the root domain, and blocks a subdomain when Also prevent subdomains is on.
If the hostname already shows Blocked, switch Zone Hold to Off, then run terminus gcdn:verify <site>.<env> <domain> to recover it. Releasing the hold first saves that step.
Your own Enterprise zone: On the zone homepage, go to Quick Actions and switch Zone Hold to Off.
Cloudflare for SaaS provider zone hold: If the Zone Hold comes from another Cloudflare for SaaS provider — such as HubSpot, WPEngine, or Kinsta — you can't release it yourself. Contact Pantheon Support and the team will work with Cloudflare to clear the hold. This is the more common scenario.
Add the domain to your site
- Go to the Site Dashboard.
- Add the domain on your Pantheon environment's Domains tab. See Custom Domains for the steps.
The dashboard might show DNS records or TXT verification steps for the domain. Ignore them. Use the records from terminus gcdn:o2o in the next sections instead. Don't change the domain's traffic record yet. Your domain keeps serving from its current host until you point the traffic CNAME at the new edge.
Set the SSL/TLS encryption mode
In your Cloudflare zone, go to SSL/TLS > Overview and set the encryption mode to Full or Full (strict). Other modes, such as Flexible, cause infinite redirect loops between your zone and the GCDN.
Get your O2O records
Omit <domain> to list records for every Cloudflare domain on the environment. Save the output. It lists three records for each domain:
| Record | Purpose |
|---|---|
TXT _cf-custom-hostname.<hostname> | Lets Pantheon confirm that you own the hostname and show the domain as ready before cutover. |
CNAME _acme-challenge.<hostname> | Delegates certificate validation so the certificate can be issued and renewed. |
CNAME <hostname> | Sends traffic to the GCDN edge. |
Add the records in Cloudflare
In the Cloudflare dashboard, go to DNS > Records for your zone.
1. Add the ownership TXT and ACME challenge CNAME
Add the ownership TXT record from the gcdn:o2o output:
Leave this record in place until terminus gcdn:verify reports the domain active. A proxied cutover works without it, but Pantheon can't show the domain as ready before cutover, and Cloudflare can't pre-validate the hostname.
Before you add the ACME challenge CNAME, delete any existing _acme-challenge.<hostname> TXT records. They block certificate delegation, and Cloudflare doesn't allow a CNAME to share a name with another record. Don't remove unrelated TXT records, such as SPF, DKIM, or DMARC.
Then add the _acme-challenge CNAME and set its proxy status to DNS only (grey cloud):
This record issues your certificate. Leave it in place permanently and keep it grey-clouded. Removing or proxying it breaks certificate renewal, and changing it to a TXT record breaks delegation.
While Cloudflare proxies the hostname (orange cloud, the usual O2O state), it can't use the ownership TXT. It reports The hostname is using Cloudflare and cannot be activated with an TXT or HTTP validation token, and activates the hostname after cutover, once the traffic CNAME points at Pantheon's edge.
If the hostname's traffic record points directly to your origin, you can set it to DNS only (grey cloud) before cutover. Cloudflare then doesn't proxy it, so it can use the TXT to validate and activate the hostname early. This doesn't work if the record points to another host that uses Cloudflare for SaaS, such as a CNAME to WP Engine. Traffic still passes through Cloudflare in that case, and the error remains. If you move from WP Engine, remove the hostname there when you update your DNS records. That removes it from WP Engine's SaaS zone and avoids those errors.
2. Confirm propagation and certificate issuance
The query returns a dcv.cloudflare.com target when the record is live. Then check that Pantheon has confirmed your ownership and issued the certificate:
Proceed once the output shows DNS records ready (confirmed by Pantheon). Pantheon's edge serves the custom hostname's certificate while the hostname still shows as pending, so this state tells you the cutover is safe. If the output shows ownership not confirmed yet or ownership and certificate pending, add the records it lists, wait a few minutes, and run the command again. The command rechecks the domain at most once a minute, and Pantheon sees the result within about 10 minutes. If the output doesn't change once the records above are live, contact Pantheon Support. Don't point traffic at the GCDN before the output shows ready, or visitors reach Pantheon's edge without a valid certificate.
3. Route traffic to the GCDN
O2O requires a CNAME at the hostname. Cloudflare doesn't allow a CNAME alongside A or AAAA records, so delete the hostname's existing A and AAAA records and add the traffic CNAME right away. The time between the two changes is downtime. If the hostname is already a CNAME, edit its target instead.
Create the record as DNS only (grey cloud) and leave it that way for 15 to 20 minutes. Cloudflare needs that time to associate the custom hostname with the new GCDN. If you proxy the record before it does, requests may return a 1014 error. After the wait, edit the record and switch it to Proxied (orange cloud) to complete the O2O configuration if you wish to keep your own Cloudflare rules.
While the record is grey-clouded, visitors connect directly to Pantheon's edge, so your Cloudflare zone's WAF rules, Workers, and page rules don't apply. They resume when you switch to Proxied.
A/AAAA records aren't compatible with O2O and can cause downtime.
After you route traffic, run the check again so Cloudflare and Pantheon detect the change sooner:
The output shows ownership and certificate active once the hostname becomes active.
Re-enable your zone hold (Enterprise only)
Once the custom hostname becomes active, switch Zone Hold back to On in Quick Actions. The hold stops other Cloudflare accounts from claiming your domain, so don't leave it off longer than you need to.
Verify the connection
Request the site at its public URL:
The response returns an HTTP 200 or 30x status. The site should load without certificate warnings or redirect loops.
Troubleshooting
Errors 1014, 1016, and 1034
These errors are usually transient. They appear while Cloudflare validates the custom hostname on Pantheon's edge and typically clear on their own.
If the error persists:
- Confirm the
_acme-challengeCNAME exists, matches thegcdn:o2ooutput, and is grey-clouded. - Confirm the hostname CNAME points to
fe.<zone>.edge.pantheon.io. - Confirm you followed the staged grey-cloud then orange-cloud change.
If the hostname shows Blocked, a Zone Hold applied when Pantheon created it. Switch Zone Hold to Off, then run terminus gcdn:verify <site>.<env> <domain>. If the hold comes from another Cloudflare for SaaS provider, contact Pantheon Support.
Contact Pantheon Support if the hostname is moved (it stayed pending past Cloudflare's 7-day validation window). It doesn't recover on its own.
Too many redirects
Set the zone's SSL/TLS encryption mode to Full or Full (strict).
