Domain types and how to register them

This page explains the kinds of domains you can add to HiddifyManager and how to set up each one at your DNS provider. Read it before you add your first domain to the panel.

A domain is a name such as sub.example.com that points to an IP address. A subdomain is the part you add in front of your main domain (sub in sub.example.com). A DNS record is the entry at your DNS provider that tells the internet which IP a name points to. For more basics, see Basic concepts.

Domain types changed in HiddifyManager v13

Since v13, every domain has a Mode and a TLS mode. The old modes were moved automatically when you upgraded:

auto_cdn_ip became CDN (with "Resolve IP" turned on).
fake became Direct with TLS mode Fake.
reality and special_reality_* became Direct with TLS mode Reality.
old_xtls_direct became Direct.
"Use only for subscription link" became the Subscription only mode.

Domain modes in the panel

In the panel, open the Domains page and select Add domain. A short wizard asks for the domain, then "How is it set up?" (the mode), then "Which TLS?" (the TLS mode).

Mode	When to use it	What your DNS record must do
Direct	Users connect straight to your server.	Point to your server's IP. On Cloudflare, the proxy must be off (DNS only, grey cloud).
CDN	Your server sits behind a CDN such as Cloudflare. This hides your server's IP and keeps working when the IP is blocked.	Go through the CDN. On Cloudflare, the proxy must be on (Proxied, orange cloud). It must not resolve to your server's IP.
Relay	Users connect to another server in between, which passes traffic on to your server. More about relays	Point to the in-between (relay) server, not to your server.
Cloudflare Worker	Traffic reaches your server through a Cloudflare Worker. More about workers	The domain must be on Cloudflare.
Subscription only	Only for users' subscription links, no proxies. If your proxy domains get blocked, users can still update their subscription and get new working configs. More about subscription domains	Point to your server or go through a CDN. Behind a CDN is best.

The TLS mode decides which certificate the domain uses:

TLS mode	Meaning
Valid TLS	A real certificate that the panel gets and renews for you automatically. Use this in almost all cases. CDN, Cloudflare Worker and Subscription only domains always use it.
Fake	Decoy TLS with another site's name (for example `soft98.ir`) to pass an SNI whitelist. Not recommended, because it can get your server filtered. Only for Direct or Relay. More about fake domains
Reality	Borrows another real site's TLS with the Reality protocol. You do not need to own the domain. Only for Direct or Relay.
DNS	For DNS tunnels only.

The panel checks the DNS record when you save. For example, a Direct domain must point to your server's IP, and a CDN domain must not point to it directly. If the check fails, fix the DNS record, wait a few minutes, and save again.

Let the panel create the DNS records

If your domain is on Cloudflare, you can give the panel a Cloudflare API token. The panel then creates the DNS record for each new domain (proxy on for CDN, off for Direct). See Get Cloudflare API.

How to register a domain

Direct domain registration

You can get a free subdomain or use a domain you bought.

Free subdomain (FreeDNS)

FreeDNS (afraid.org) lets you create a subdomain on domains that other people have shared publicly.

Create an account. You need a real email address.
Open the domain registry. Pick a public domain that has few hosts. Domains ending in .com, .org or .net are best.
Create your subdomain on that domain and set its address to your server's IP.

A domain you bought, on Cloudflare

You can manage a domain you bought with any DNS provider. These steps use Cloudflare.

Create a Cloudflare account and log in.
Go to Domains and select Onboard a domain. Enter your main domain (for example example.com) and select Continue. Older screenshots show this button as Add Site.
Choose a plan. The Free plan is enough.
Review the DNS records Cloudflare found and select Continue.
Cloudflare shows you two nameservers. Go to the site where you bought the domain and replace its nameservers with these two.
Wait until Cloudflare shows the domain as active. This can take from a few minutes to a day.
Open your domain and go to DNS > Records.
Select Add record.
Fill in the record:
- Type: A (for the server's IPv4 address).
- Name: the subdomain you want, for example sub.
- IPv4 address: your server's IP.
- Proxy status: turn it off (DNS only, grey cloud). A Direct domain must not be proxied.
- TTL: leave it on Auto. A lower TTL makes changes reach users sooner.
Select Save.
If your server also has an IPv6 address, add a second record the same way, with Type AAAA and the IPv6 address.

Check that the direct domain works

DNS changes can take a few minutes to spread. Then, on your own computer, run:

ping sub.example.com

You should see your server's IP in the answer. You can also use nslookup or dig. If you see a different IP or "unknown host", check the record and wait a little longer. To learn more, read this article on DNS (Persian).

CDN domain registration

A CDN (content delivery network) is a network of servers that sits between your users and your server. Users connect to the CDN, and the CDN passes the traffic to your server. What is CDN and how does it help us?

These steps use Cloudflare. For other CDNs, see GCore and Amazon CloudFront.

Add the CDN record on Cloudflare

Add your domain to Cloudflare as described in the direct domain section above (steps 1 to 6).
Go to DNS > Records and select Add record.
Use Type A (or AAAA for IPv6), a new subdomain name, and your server's IP.
Turn Proxy status on (Proxied, orange cloud). This is the only difference from a direct domain.
Select Save.

A record with proxy on

Check that the CDN domain works

When you ping this subdomain, you should see one of Cloudflare's IPs, not your server's IP. This hides your server. The Cloudflare IP can change over time.

Sometimes the Cloudflare IPs that your users get are blocked or slow in Iran. In that case, see Guide for finding a clean Cloudflare IP.

Cloudflare SSL/TLS settings

TLS is the encryption that protects the connection between the user and the server. A certificate proves that a server really owns a domain. HiddifyManager gets a real certificate for your domain, so Cloudflare can connect to your server over TLS.

Open your domain in Cloudflare and go to SSL/TLS > Overview.
Choose the encryption mode Full or Full (strict). Do not use Flexible. If the mode is set to Automatic SSL/TLS, Cloudflare picks the most secure mode that works; you can leave it.
Go to Network and turn on WebSockets and gRPC. HiddifyManager's CDN proxies use WebSocket, gRPC, HTTPUpgrade and XHTTP.

Older guides told you to turn on SSL/TLS Recommender. Cloudflare is replacing it with Automatic SSL/TLS, so you do not need it.

The SSL/TLS section of Cloudflare also shows a chart of your traffic by TLS version. More traffic on newer TLS versions means safer connections.

Traffic by TLS version

Relay domain registration

A relay domain is registered like a direct domain, but its record points to the in-between (relay) server instead of your main server. Read more

Fake and Reality domains

With the Fake or Reality TLS mode, you use the name of another site that you do not own, so you do not register anything at a DNS provider. You only add the name in the panel. See How to create and use fake domain.

Last update: October 22, 2026