Domain Shunting Functionality and Management
Shunting
For those who often connect to external networks (public networks), you may have encountered that once you enable your phone’s proxy function, accessing domestic websites becomes slow or even freezes. This is because the proxy sends access requests using an external network exit IP. In the early days, the workaround was to exclude certain apps within the software or choose which apps should or shouldn’t go through the VPN route. If you don’t exclude anything, it’s basically a global proxy. But even that isn’t truly global — banking apps, for example, will detect this and automatically shut down. To achieve a real global proxy, you need to connect via an external network that can access the public internet.
The shunting feature that has become popular in recent years was specifically developed to avoid affecting access to domestic websites when using VPN functionality. For example, Karing comes with built-in shunting features.
There’s an even more advanced shunting function, but it’s limited to Warp. You need to modify the configuration under Zero Trust on the Cloudflare website, assuming you can use Zero Trust. Simply add the domains you want to exclude in the traffic policy. For excluding the entire Chinese mainland, you can use a wildcard. The “.cn” is China’s country code top-level domain (ccTLD) and, in theory, can represent many Chinese websites, though more verification is needed. ‘.cn’ stands for China — the country’s internet identifier. Preceding it with an asterisk as a wildcard (i.e., *.cn) will do the trick.
Management
Cloudflare currently restricts ordinary users (Free/Pro accounts) from hosting subdomains as independent Zones, requiring binding of root domains (like example.com) mainly to prevent abuse and simplify management.
Actually, the majority of mainstream DNS providers don’t allow subdomains to be added directly. There was historical support from 2021—2022. Current restrictions are in place for 2024–2026; the UI will directly intercept attempts to add subdomains and prompt for a root domain instead. Subdomain additions are only available to Enterprise contracts or accounts on the whitelist.
Cloudflare (CF) is a big name, which causes many developers to mistakenly think CF can be used to directly add subdomains. In reality, subdomains registered via platforms like DigitalPlat and dnshe.com are part of CF’s whitelist. Without going into details: users just need to change their DNS server to the NS record provided by Cloudflare to complete the binding.
For subdomains under your own primary domain, even if you distribute them via the subdomain feature of services like vps8, it’s highly unlikely they can be hosted on Cloudflare — because CF hasn’t delegated that power. Only after delegation can you get DNS record values and set subdomain parsing records on CF.
Some services require you to bind a domain during registration. The domain is the key, the server is the lock, and the DNS provider is the locksmith; only with all three can you open the door to the network.
A free platform-provided subdomain suffices — a root domain is even better. For example, when testing the Vietnam server at Datataolin, after registering on my.dataonline, you enter your public IP into the A record field of your CF-managed domain, with the name set as @.
For commercial servers, don’t settle for super low specs and prices — for example, WordPress can’t run on 256MB RAM. What’s worse: if you’re on a shared IPv4 and someone does illegal stuff, the whole server’s IP could be blacklisted globally, crippling your business email. Cheap servers often oversell resources: one physical server is divided into hundreds of VMs, CPU usage stays over 90%, SSH connections constantly freeze. Claimed “Hong Kong Datacenter” servers actually use Southeast Asian BGP lines, with up to 300ms latency and more than 15% packet loss. Data security is a black hole: no SSL, no DDoS protection. There are real cases where tens of thousands of yuan were lost to ransom viruses, and the service provider shirked responsibility as “user-managed”.
These cheap servers are outperformed even by Oracle’s notorious free VMs, which, although not always stable, are still better than these alternatives.
All my free registrations offer at least 1GB of RAM and 20GB of monthly traffic. A good domain should have no history of abuse, so domain registration platforms share the risk and hope users don’t make trouble for honest providers. Due to abuse, cc.cd and us.ci, which are currently hosted by Cloudflare, are accessible domestically but not in Jiangsu.
Most free domain providers only support binding via A records (pointing to an IP). Advanced record types like CNAME, MX, and NS are rarely supported (unless you can host on Cloudflare). For example, with IDC.LC, 9v4.net, Loc.cc, features are very limited. Unlike standard free platforms, VPS8 solves the weak DNS parsing problem by letting you directly set a "root domain CNAME,” a must-have for those linking to Vercel, GitHub Pages, or Cloudflare Pages!
For example: First build a Pages project in CF, then add a custom domain. Here, show it using a subdomain registered at VPS8. On CF, choose “My DNS Provider”, meaning you use the VPS8 registered domain, not a CF-hosted domain. Then, CF will display a CNAME setup; point your domain at Cloudflare, copy and paste it to your registrar site for configuration. The change takes effect in minutes.
This method lets you bind a tertiary domain under a non-CF-hosted subdomain to a project in Cloudflare, opening new paths for flexible domain use and reducing the risks associated with single-domain outages. For projects that don’t require hosting to complete, you can use permanent second-level domains from services like cloudns to avoid renewal hassles.
Domain Terminology:
- NS and SOA records are usually automatically created by registrars or DNS providers—users rarely need to edit these. Errors can break your DNS entirely.
- MX records must be set with a priority: the lower the number, the higher the priority. Mail systems always use the highest priority server first.
- CNAME records cannot be set on root domains and you must avoid circular references (A points to B, B points to A), which can cause failures.
- SPF, DKIM, and DMARC are not independent DNS record types; they are all stored as TXT records.
| Record | Core Use | Typical Scenarios |
|---|---|---|
| A | Maps domain to IPv4. Basic place-to-IP mapping for websites, subdomains, fixed IPv4s | |
| AAAA | Maps domain to IPv6. Same as A but for IPv6. Supports modern internet needs | |
| CNAME | Alias. Points domain to another domain. CDN configs, multi-domain pointing, eases IP switching | |
| MX | Assigns domain to mail servers, with priority. Used for business mail setup | |
| TXT | Any custom text. Domain ownership verification, email authenticity (SPF/DKIM/DMARC), SSL validation | |
| NS | Sets authoritative DNS provider. Who manages this domain’s DNS. Subdomain delegation, using 3rd-party DNS | |
| SOA | Stores DNS zone metadata, main server info, refresh intervals; system default, rarely set manually | |
| PTR | Reverse-lookup: maps IP to domain. For anti-spam, internal IP hostname queries | |
| SRV | Locates servers for specific services (address/port/priority). For IM, VoIP, Microsoft directory discovery | |
| CAA | Which CA can issue SSL certificates for this domain. Adds HTTPS security; prevents unauthorized certificate issuance | |
| SPF | Lists allowed mail sending servers (actually as a TXT record). Fights spam, improves delivery | |
| DKIM | Stores DKIM public key (also as TXT), email signature validation. Works with SPF to improve mail security | |
| DMARC | What to do if SPF/DKIM checks fail (also as TXT). Standardizes mail sending; further improves delivery security | |
| SSHFP | Stores SSH server fingerprint. Clients can auto-check SSH server authenticity, reduces MITM attacks | |
| TLSA | Associates certificates with ports/protocols. Adds TLS client/server validation security | |
| URI | Points domain to a URI. DNS participates in resource linking/documents/services | |
| URL Forwarding | Forwards access to a target URL; explicit (address bar shows new address) or hidden (keeps original) | Brand link simplification, domain migration, hiding real backend addresses |
Some Tips for Domain Resolution
(For reference only)
As mentioned before, mainstream providers don’t allow direct subdomain binding, but it’s not 100% unsupported. The official stance is flexible. After debugging with Alibaba Cloud and Tencent Cloud, here’s what I realized: CDN acceleration is also a resolution feature, but compared to free DNS, it uses more resources, so domains bound to it have limits or fees. Alibaba Cloud only lets you bind subdomains on trial accounts or higher. They do this to prevent users from exploiting the system.
Alibaba Cloud and Tencent Cloud’s DNSPod both offer free DNS services and officially support subdomain parsing. I added subdomains, got a TXT record prompt to copy this code to the upstream manager. Tried this many times with multiple domains, each several times, but validation still failed.
I couldn’t figure out why, until I added the Tencent and Alibaba NS record names to the upstream site. Only then did it succeed.
Summary (Three Points):
- Records must be added to the upstream site, i.e., wherever your domain is actually hosted. For example, if hosted via CF, go to CF—not the registrar.
- The upstream site must support adding NS records for subdomains; otherwise, only TXT verification is possible, but the result is much weaker.
- Don’t operate on just-registered domains until after 48 hours, especially root domains.
Alibaba and Tencent do allow subdomains split off from your own main domain, but whether you’ll get it working always has an element of luck.
