Guides · DNS, Cloudflare & delivery · Published 2026-09-12 · 3 min read

Custom Domain on Cloud Run with Cloudflare DNS — Domain Verification, the A/AAAA Records, DNS-Only vs Proxied, and Why the Certificate Takes 20 Minutes

How to map your own domain to a Cloud Run service when DNS lives on Cloudflare: verify the domain with Google, create the mapping, add the A and AAAA records and the www CNAME as DNS-only, and wait for the managed certificate without breaking it with the Cloudflare proxy.

Cloud Run gives you a *.run.app URL by default. Putting your own domain on it is a three-part job: prove to Google you own the domain, create a domain mapping, and point DNS at Google's front end. With Cloudflare holding the DNS there is one setting that quietly breaks everything, so read the proxy section before you click.

1. Verify the domain with Google

Cloud Run domain mappings require the domain to be verified for the Google account that deploys. Run:

gcloud domains verify example.com

It opens Search Console's verification flow. Choose the DNS TXT method, add the google-site-verification TXT record at the root of the zone in Cloudflare, and confirm. If Cloudflare offers a "Domain Connect" shortcut for Google, it adds the record for you in one click. Verification usually completes within a minute of the record appearing.

2. Create the mapping

gcloud beta run domain-mappings create --service my-site --domain example.com --region us-central1
gcloud beta run domain-mappings create --service my-site --domain www.example.com --region us-central1

The command prints the DNS records to add: four A records and four AAAA records for the root domain, and a CNAME to ghs.googlehosted.com for www.

3. Add the records in Cloudflare, DNS-only

Create the records exactly as printed. The setting that matters is the orange cloud: turn the proxy off (grey cloud, "DNS only") for these records. If Cloudflare proxies them, Google cannot complete certificate validation for your domain, the mapping stays in a pending state, and you get certificate errors indefinitely. You can revisit proxying later once the certificate exists, but the simple, reliable configuration is DNS-only with Google serving the certificate.

A faster way to add eight records is Cloudflare's Import feature with a small BIND zone file:

$ORIGIN example.com.
$TTL 300
@   300 IN A     216.239.32.21
@   300 IN A     216.239.34.21
@   300 IN A     216.239.36.21
@   300 IN A     216.239.38.21
@   300 IN AAAA  2001:4860:4802:32::15
@   300 IN AAAA  2001:4860:4802:34::15
@   300 IN AAAA  2001:4860:4802:36::15
@   300 IN AAAA  2001:4860:4802:38::15
www 300 IN CNAME ghs.googlehosted.com.

Use the addresses the mapping command printed for your project rather than copying these blindly. Delete any parking records the registrar left behind first, or the root will resolve to both.

4. Wait for the certificate

Check status with:

gcloud beta run domain-mappings describe --domain example.com --region us-central1

The managed certificate typically takes 15 to 25 minutes after DNS is correct. During that window https://example.com returns TLS errors; that is expected. Right after the certificate is issued, some clients may still see a failure for a few minutes while Google's edge propagates. Do not change the DNS in that period.

5. Verify from outside

curl -sI https://example.com/health
curl -sI https://www.example.com/

Both should return 200 with an x-cloud-trace-context header. If www redirects or serves your app, the CNAME is working.

Common mistakes

Leaving the Cloudflare proxy on. The certificate never issues.
Verifying with a different Google account than the one running gcloud. Add the deploying account as an owner in Search Console.
Judging failure too early. Give the certificate half an hour before debugging.

Summary

Verify with a TXT record, create the mapping for the root and www, add the printed A/AAAA/CNAME records in Cloudflare as DNS-only, and wait about twenty minutes for the certificate. Then check both hosts from outside.

cloud run cloudflare dns custom domain ssl

Related guides

Deploy Express to Cloud Run from source — A minimal, production-ready way to run an Express app on Cloud Run: the Dockerfile, reading PORT, a deploy script in package.json, scaling to zero with a small memory limit, and the mistakes that cost the first hour.
What a small Cloud Run site really costs — How Cloud Run bills a low-traffic Node.js site, why min-instances 0 keeps it near zero, what a cold start costs you in latency, how memory and max-instances settings change the bill, and the small charges people forget: image storage, egress and the build.
The Cloud Run /healthz gotcha — On Cloud Run, a request to exactly /healthz is answered by Google's front end with its own 404 and never reaches your app, while /healthz/ and /health work. How to tell an edge 404 from an app 404 using response headers, and a naming convention that avoids the trap.