Proxied vs DNS only in Cloudflare, which records should be orange?

Only the stuff that serves web traffic. The proxy only handles HTTP/HTTPS, so anything else pointed at an orange-clouded hostname just stops working. - website A/CNAME (root and www): orange - mail.yourdomain or anything a mail client connects to: grey. MX and TXT records can't be proxied anyway, but the A record the MX points at can, and that's the one people break - FTP, SSH, cPanel-style hostnames: grey, or they'll time out - the booking app subdomain: if it's a CNAME to a third-party SaaS, check their setup docs. A lot of them need it grey so they can issue their own SSL certificate Proxying everything is how you end up with email silently failing on a Monday morning.