Added cost: $0.00 / month
A walkthrough written for your exact situation: the domain tradingdesk.me,
registered and DNS-hosted at IONOS, pointed at your Cloudflare Worker
(tradingdesk.klubhyde.workers.dev) so the academy answers on the bare domain.
| Step | State | Evidence |
|---|---|---|
| Site deployed | Done | tradingdesk.klubhyde.workers.dev returns HTTP 200 with the academy page |
| Zone added to Cloudflare | Done | SOA is josephine.ns.cloudflare.com |
| Nameservers switched at IONOS | Done | NS now marty + josephine.ns.cloudflare.com |
| Email records preserved | Done — all 5 still intact | MX ×2, SPF, DMARC and autodiscover all served correctly by Cloudflare |
Placeholder A deleted | Done | 74.208.236.247 no longer served |
Placeholder AAAA deleted | Done | Confirmed absent from Cloudflare's authoritative answer. Resolvers still pointed at IONOS report it for a few more hours — that is stale delegation, not a live record |
www Custom Domain | Done | Resolves to Cloudflare anycast 104.21.43.108 / 172.67.178.38 |
www certificate | Done | Let's Encrypt, valid 15 Oct 2026 – 13 Jan 2027, covers
tradingdesk.me and *.tradingdesk.me |
www serving the app | Done | HTTPS 200 with the academy page, verified at the Cloudflare edge |
| Apex Custom Domain | Not done | Apex has no A and no CNAME — only the stale AAAA |
| Supabase Site URL updated | Do last | → section 8, step 12 |
tradingdesk.me as a Custom Domain
(section 7, step 9). Nothing is blocking it — the apex simply has no web record yet, which is exactly
what Cloudflare's own "Visitors cannot reach tradingdesk.me" banner is reporting.
| Cloudflare says | What to do |
|---|---|
| "Visitors cannot reach tradingdesk.me" | Act on it. Accurate — the apex has no record. Fixed by adding the Custom Domain, not by adding a record by hand. |
| "Add a DMARC record" | Ignore it, and do not click the link. You already have DMARC as a CNAME at
_dmarc → dmarc.ionos.com → v=DMARC1; p=none;.
Cloudflare's checker does not follow the CNAME. Clicking it tries to add a TXT record where
a CNAME already exists, which cannot coexist — it will error or break working DMARC. |
_domainconnect is set to Proxied (orange cloud). It is a service-discovery
record, not web traffic, so it should be DNS only (grey) like _dmarc and
autodiscover. Click the orange cloud to toggle it. Harmless in day-to-day use, but wrong.
ERR_NAME_NOT_RESOLVEDI looked this up from the public DNS on 14 October 2026. Keep this table. It is your safety net — if anything goes wrong, these are the values to restore.
| Type | Name | Current value | What it is for |
|---|---|---|---|
NS | @ |
ns1026.ui-dns.comns1031.ui-dns.bizns1062.ui-dns.dens1075.ui-dns.org |
IONOS runs your DNS. This is what changes. |
A | @ | 74.208.236.247 |
The IONOS placeholder page. Gets replaced by your site. |
AAAA | @ | 2607:f1c0:100f:f000::200 |
Same placeholder over IPv6. Also replaced. |
MX | @ |
mx00.ionos.com (priority 10)mx01.ionos.com (priority 10) |
Incoming email. Must be preserved. |
TXT | @ |
v=spf1 include:_spf-us.ionos.com ~all |
SPF — stops your outgoing mail being marked as spam. Preserve. |
CNAME | _dmarc | dmarc.ionos.com |
DMARC policy (currently p=none). Preserve. |
CNAME | autodiscover | adsredir.ionos.info |
Lets Outlook auto-configure the mailbox. Preserve. |
There is no www record, no DKIM key and no
CAA record. Nothing else is published. | |||
When you switch nameservers, IONOS shows this warning, and it is accurate:
Please note that your IONOS DNS zone settings are no longer
used with custom name servers.
Every record in the table above stops being served by IONOS the moment the switch takes effect. Cloudflare has to be serving identical copies first. That is the whole job. Get the five mail records right and there is no outage — not even a brief one, because both sets of nameservers return the same answers during the changeover.
Log in at my.ionos.com → MENU → Email.
Either way, do the copying. It costs two minutes and removes the only thing that can bite you.
Your site is live and serving correctly at
https://tradingdesk.klubhyde.workers.dev.
Confirmed responding HTTP 200 with the academy landing page.
You deployed to Workers rather than Pages. That is fine — it is Cloudflare's recommended route for new projects now, and for a static site like this the two are equivalent. It only changes where the custom-domain button lives, which section 7 accounts for.
Do not point the domain at anything until you have confirmed you can sign in on that address.
In the Cloudflare dashboard go to Domains in the left sidebar, then click Onboard a domain (on some accounts this button reads Add a domain).
tradingdesk.me — just that, no https:// and no www.Go to your new zone → DNS → Records. The scan usually finds everything, but it is not guaranteed to. Confirm all five of these exist, and add any that are missing with Add record:
| Type | Name | Content / Target | Priority | Proxy status |
|---|---|---|---|---|
MX | @ | mx00.ionos.com | 10 | n/a |
MX | @ | mx01.ionos.com | 10 | n/a |
TXT | @ | v=spf1 include:_spf-us.ionos.com ~all | — | n/a |
CNAME | _dmarc | dmarc.ionos.com | — | DNS only (grey cloud) |
CNAME | autodiscover | adsredir.ionos.info | — | DNS only (grey cloud) |
In Cloudflare, @ means the bare domain and is often displayed as
tradingdesk.me. If a field will not accept @, type tradingdesk.me
instead.
_dmarc and autodiscover must be set to DNS only, not
Proxied. Click the orange cloud icon to toggle it grey. Proxying a mail-related record routes it
through Cloudflare's web proxy, which breaks it. MX and TXT records have no proxy toggle at all,
which is expected.
Still on the DNS records page, delete these two if the scan imported them:
| Type | Name | Value |
|---|---|---|
A | @ | 74.208.236.247 |
AAAA | @ | 2607:f1c0:100f:f000::200 |
These point at the IONOS placeholder page. They have to go, because an A record on the
apex conflicts with the record Cloudflare needs to create there in section 7. Leaving them in
place is the most common reason people still see the IONOS page after everything else is correct.
In Cloudflare, open your zone's Overview page. It lists two nameservers
assigned to your account — they look like ada.ns.cloudflare.com and
lee.ns.cloudflare.com, with names unique to you. Copy both exactly.
tradingdesk.me in the list and open its settings — click the
gear icon in the Actions column, or click the domain
itself.IONOS warns you that its DNS zone settings will no longer be used. That is expected and correct — you copied them to Cloudflare in section 5.
Back on the Cloudflare zone Overview, the status reads Pending nameserver update until the change is seen. In practice this is usually under an hour; the official ceiling is 24 hours. Cloudflare emails you when the zone goes Active. Your site and email keep working throughout, because both sets of nameservers are answering with the same records.
Once the zone is Active: Workers & Pages →
Overview → select your tradingdesk Worker →
Settings → Domains & Routes →
Add → Custom Domain.
Enter tradingdesk.me and select Add Custom Domain.
Cloudflare creates the DNS record and issues the HTTPS certificate for you — you do not touch DNS by
hand and you do not manage a certificate. This is also why tradingdesk.me had to become a
Cloudflare zone first: Custom Domains require an active zone on the same account.
You have no www record today, so www.tradingdesk.me currently fails to
resolve entirely. Repeat the step above with www.tradingdesk.me — Custom Domains can be
added more than once, and your Worker will answer on both.
In the zone: SSL/TLS → Overview → set the encryption mode to Full (strict).
If this is left on Flexible, you get an endless redirect loop in the browser —
ERR_TOO_MANY_REDIRECTS — which looks like a broken site but is only this setting.
Supabase rejects authentication redirects to addresses it does not know. In your Supabase project: Authentication → URL Configuration.
| Field | How many values | What it does |
|---|---|---|
| Site URL | Exactly one | The default address. Supabase puts this into confirmation and password-reset emails when the link does not specify one itself. Think of it as "where this app officially lives". |
| Redirect URLs | A list — add as many as you like | An allow-list. Any address not on it is refused as a login destination. This is a security control, which is why it is not automatic. |
tradingdesk.me still points at IONOS, so an email linking there would be a dead end.
Use the Workers address as the Site URL for the moment:
| Field | Value to enter today |
|---|---|
| Site URL | https://tradingdesk.klubhyde.workers.dev |
| Redirect URLs | Add all four now — unconnected ones are harmless:https://tradingdesk.klubhyde.workers.dev/**https://tradingdesk.me/**https://www.tradingdesk.me/**http://localhost:8080/** |
Change one thing: set Site URL to
https://tradingdesk.me. Leave the Redirect URLs exactly as they are — keeping the
workers.dev entry means the old address still works, which is useful if the domain ever
has trouble.
The /** on the end is a wildcard covering every page and path on that address. Without
it you would have to list /reset.html, /app.html and so on individually.
Skip this step and password-reset emails still arrive, but their links silently refuse to sign anyone in. That failure produces no error message, so it is worth getting right the first time.
| # | Check | Expected |
|---|---|---|
| 1 | Open https://tradingdesk.me | The academy landing page, not the IONOS placeholder |
| 2 | Look at the padlock in the address bar | Valid certificate, no warning |
| 3 | Open https://www.tradingdesk.me | Same site, still a valid certificate |
| 4 | Create an account and sign in | Works; no orange DEMO MODE banner |
| 5 | Request a password reset | Email arrives and its link signs you in |
| 6 | Send a test email from another account to your @tradingdesk.me address | It arrives. Do this even if you think the mailbox is unused |
If check 1 still shows the IONOS page after the zone is Active, you almost certainly left the
A record from section 5 step 5 in place. Delete it and wait a few minutes.
Both of these look like "the site is broken". Neither one is. They have different causes and different fixes, so identify which you are seeing before changing anything.
tradingdesk.me shows the IONOS "This domain is already registered" pageCause: two things at once.
A, no AAAA, no
CNAME. Cloudflare's own dashboard says so with its
"Visitors cannot reach tradingdesk.me" banner.74.208.236.247) in its DNS cache from
before the migration, so it keeps going there instead of asking again.Fix: add the Custom Domain (section 7, step 9), then flush your DNS cache using step C below. Until the Custom Domain exists there is nothing for the apex to point at, so flushing alone will not help — it will just change the error from the IONOS page to "cannot be reached".
www.tradingdesk.me gives ERR_NAME_NOT_RESOLVEDCause: a cached negative answer, and nothing more. Before the migration,
www did not exist, so resolvers recorded "no such name". That memory outlives the change.
Right now the two big public resolvers disagree:
| Resolver | Answer for www.tradingdesk.me |
|---|---|
Cloudflare 1.1.1.1 |
172.67.178.38, 104.21.43.108 — correct |
Google 8.8.8.8 |
NXDOMAIN — stale negative cache |
The site itself is fine: requested directly at Cloudflare's edge, www returns
HTTP 200 with a valid certificate. Only the lookup is stale.
Fix: flush your cache (step C), or simply wait — negative entries expire on their own, typically within the hour. Do not undo anything in Cloudflare because of this error.
A record for www by hand to make the error go
away. That breaks the Worker Custom Domain. The record is already correct — the problem is on the
asking side, not the answering side.
Cause: a leftover AAAA (IPv6) record. The Custom Domain creates a
proxied IPv4 record, but an old IPv6 record from IONOS can survive beside it. Windows prefers IPv6
whenever both exist, so the browser takes the stale address and never tries the good one.
The giveaway is resolvers disagreeing on IPv6 while agreeing on everything else:
| Resolver | apex A | apex AAAA |
|---|---|---|
Cloudflare 1.1.1.1 | Cloudflare | 2607:f1c0:100f:f000::200 — IONOS |
Google 8.8.8.8 | 74.208.236.247 — stale |
Cloudflare |
| AdGuard / doh.sb / NextDNS | — | Cloudflare |
That IPv6 address is the one recorded in the section 1 backup, which confirms it is left over rather than something Cloudflare created.
Fix: DNS → Records → find the AAAA row named
tradingdesk.me → Delete. Leave the MX,
TXT and _dmarc / autodiscover / _domainconnect
rows alone — those are email.
AAAA
queries from its own range without any record on your side. Adding one by hand only recreates
this bug.
Then purge the resolver cache instead of waiting out the 1-hour TTL: open
https://one.one.one.one/purge-cache/, enter tradingdesk.me, choose type
AAAA, purge, then repeat for type A. Finish with step C below.
cmd) and run:
ipconfig /flushdnsedge://net-internals/#dns → Clear host cache.edge://net-internals/#sockets → Flush socket pools.If it still fails, your router or ISP is probably forwarding to Google DNS, which is the resolver currently holding the stale answer. Two ways around it:
1.1.1.1, Alternate 1.0.0.1. That resolver already has the
correct answer.Nothing here is permanent. To put everything back exactly as it was:
tradingdesk.me →
Name Server tab → Reset DNS or usage.
That restores the four original ui-dns nameservers and reactivates the IONOS zone
with the records listed in section 1.tradingdesk.klubhyde.workers.dev the whole time,
so the academy never goes offline even if you roll the domain back.If you would rather not hand DNS to Cloudflare, you can keep IONOS exactly as it is and host on
GitHub Pages instead. IONOS permits A records on the apex (it only forbids
CNAME there), so the bare domain still works.
main and the folder to / (root).tradingdesk.me → Save.tradingdesk.me →
DNS tab: delete the existing A record for @
and add these four, all with host @:
185.199.108.153
185.199.109.153
185.199.110.153
185.199.111.153Trade-offs: your email is never at risk because the nameservers and all mail records stay untouched at IONOS. In exchange the repository must be public on the free plan, bandwidth has a soft 100 GB/month limit, and you lose Cloudflare's unlimited-bandwidth CDN. For a school-sized audience all three are irrelevant — this is a perfectly good option if the nameserver switch makes you uneasy.