Direct answer

For a standard Minecraft Java TCP endpoint, use DNS-only mode on Cloudflare DNS unless you have an explicitly compatible Minecraft proxy product such as a configured Spectrum service.

Recommended procedure

  1. Open the DNS record for the game hostname and confirm that its proxy status matches the game traffic supported by your provider.
  2. On normal Cloudflare DNS plans, set the game A/AAAA record to DNS-only rather than attempting to send raw Minecraft traffic through the HTTP reverse proxy.
  3. Confirm the hostname resolves to the public game server IP and the TCP game port is reachable.
  4. If your website uses the same domain, keep its HTTPS proxy settings separate from the game hostname.

Why this matters

An HTTP/CDN reverse proxy is designed primarily for web protocols, not ordinary Minecraft Java packets. The orange-cloud toggle may hide the actual game IP behind endpoints that are not listening for your Minecraft port.

How to verify the result

Resolve the hostname after DNS caches expire, then test in the Minecraft client with the real TCP port from outside the LAN.

Version and compatibility notes

DNS-only exposes the origin IP to clients. If DDoS protection requires IP masking, choose a service that explicitly supports Minecraft TCP/UDP traffic.

Official references

These sources were checked for the current MSH revision. Version-sensitive details should always be confirmed against the project documentation for the release you run.

Was this article helpful?
Help us improve this article

Tell us what is missing, unclear, outdated, or incorrect. You can also suggest something we should add.

What could we improve?
Do not include passwords, server IPs, or other private information.0 / 1000