Most local domain registrars in operate a simple business model. They sell domains (often bundled with their own shared hosting) and provide just enough control to point the domain to their hosting servers. If you want to use hosting elsewhere—say, an AWS Lightsail instance in Frankfurt or a Google Cloud Run service in London—they give you a text box for custom nameservers and nothing else. You can’t type in an IPv4 address. You can’t set up a subdomain. You are stuck unless you transfer the domain to a full-fledged DNS provider, which might incur fees and downtime.
This is not malice. It’s simply a legacy of how domain retailing evolved alongside hosting packages. The good news is that the nameserver field is all you need to completely unlock DNS control, because you can delegate that control to a service designed specifically for it: Cloudflare.
What Cloudflare Does in This Scenario
Cloudflare is many things, a content delivery network, a DDoS mitigation service, a web application firewall but at its core, it is an authoritative DNS provider. When you set Cloudflare’s nameservers at your registrar, you are telling the global Domain Name System, “Ask Cloudflare for the actual DNS records of this domain, not the registrar.” Cloudflare then gives you a dashboard where you can add, edit, and delete every possible DNS record: A, AAAA, CNAME, MX, TXT, SRV, you name it. You point those records at the IP address or hostname of your server, and the internet follows.
Better still, Cloudflare’s free plan includes a reverse proxy (the orange cloud) that hides your server’s real IP address, provides free SSL certificates, caches static content across 300+ data centers, and absorbs common attacks. You get enterprise-grade infrastructure without paying a shilling.
Routing a Domain to an AWS Server via Cloudflare
Let’s assume you bought example.co.ke from enthelotcloud.com, and your web application is running on an AWS EC2 instance with the public IP 18.192.1.5. You want visitors typing example.co.ke to reach that server securely.
Step 1: Create a Cloudflare Account
Go to cloudflare.com and sign up for a free account. No credit card is required for the Free plan.
Step 2: Add Your Domain to Cloudflare
After logging in, click Add a site. Enter your domain (example.co.ke) and click Add site. Cloudflare will scan for existing DNS records. Since your registrar probably doesn’t expose any, the scan may come back empty. That’s fine accept whatever it finds and proceed.
Step 3: Choose the Free Plan
Select the Free plan and click Continue. You can always upgrade later if you need advanced WAF rules or custom SSL certificates.
Step 4: Copy the Cloudflare Nameservers
Cloudflare will now show you two assigned nameservers. They look something like:
-
enthelot.ns.cloudflare.com -
enthel.ns.cloudflare.com
Copy both exactly. Leave this Cloudflare page open you will come back to it.
Step 5: Change Nameservers at Your Kenyan Registrar
Log in to your Kenyan domain registrar’s client area. This is usually a dashboard like server.enthelotcloud.com. Navigate to Domains, find your domain, and look for Nameservers or DNS Management. You will likely see default nameservers like ns1.registrar.com and ns2.registrar.com. Replace them with the two Cloudflare nameservers you copied. Save the changes.
If you see more than two nameserver fields, leave the extras empty. If there’s an option to use “Custom Nameservers” or “Default Nameservers,” select Custom and paste Cloudflare’s.
Step 6: Wait for Propagation
Nameserver changes propagate across the global DNS system. This can take anywhere from a few minutes to 24 hours, though in practice it’s often under an hour. Cloudflare will email you (and update the dashboard) once the domain becomes active on their network. Do not close the browser tab—you can keep refreshing.
Step 7: Configure DNS Records in Cloudflare
Once the domain is active, return to Cloudflare’s dashboard and click DNS on the left sidebar. Add the following records:
| Type | Name | Content | Proxy Status |
|---|---|---|---|
| A | @ | 18.192.1.5 (your server IP) |
Proxied (orange cloud) |
| CNAME | www | example.co.ke |
Proxied (orange cloud) |
The @ symbol represents the root domain. The A record tells the internet, “This domain lives at this IP address.” The CNAME makes www.example.co.ke behave exactly the same as the root. Toggle the orange cloud on for both. This activates Cloudflare’s proxy, which hides your real IP and enables their free SSL.
If you are pointing to an AWS Elastic Load Balancer (which has a DNS name, not a static IP), use a CNAME record for the root instead of an A record. Cloudflare supports CNAME at the apex due to CNAME flattening, so you can simply set:
| Type | Name | Content | Proxy Status |
|---|---|---|---|
| CNAME | @ | your-loadbalancer.eu-west-1.elb.amazonaws.com |
Proxied (orange cloud) |
This works seamlessly. No workaround is required.
Step 8: Set SSL/TLS Encryption Mode
Go to the SSL/TLS tab in Cloudflare. For a secure setup, you need an SSL certificate installed on your origin server. If your AWS instance already has a valid certificate (e.g., from Let’s Encrypt or AWS Certificate Manager), choose Full (strict). This ensures encryption from Cloudflare all the way to your server, and Cloudflare validates the certificate’s authenticity.
If you haven’t installed an SSL certificate on your server yet, you can temporarily use Flexible mode, which encrypts traffic between the browser and Cloudflare but leaves the connection between Cloudflare and your server unencrypted. This is not recommended for production, but it gets the padlock working immediately. For a long-term solution, install an origin certificate (Cloudflare provides free Origin CA certificates) and then switch to Full (strict).
Step 9: Test Everything
Open a private browser window and visit your domain. You should see your AWS-hosted application with a padlock icon. Use an online tool like DNS Checker to verify that your domain resolves to Cloudflare IP addresses (not your server’s real IP). Run an SSL check (e.g., SSL Labs) to confirm certificate validity.
Why This Setup Is Better Than Pointing a Domain Directly at a Raw IP
Some developers try to bypass DNS entirely by telling users to type the raw IP address. That is a security and professional disaster. An IP address offers no SSL (browsers won’t trust certificates issued to IPs). It exposes your server’s true location to every visitor, making DDoS attacks trivial. It looks unprofessional. A domain routed through Cloudflare solves all of this and adds:
-
Free SSL with automatic renewal.
-
DDoS mitigation that has absorbed some of the largest attacks in history.
-
Global CDN caching, slashing load times for visitors far from your server’s region.
-
Firewall rules to block malicious bots and specific countries.
-
Analytics without invasive client-side scripts.
For a Kenyan business serving customers both locally and abroad, Cloudflare’s Johannesburg, Nairobi-adjacent, and European data centers reduce latency.
Key Takeaway
If you expose your server IP directly without Cloudflare’s proxy, you are telling attackers exactly where to knock. If you leave your AWS security group open to 0.0.0.0/0 because “the site needs to work,” you have built a house with no doors. If you forget to renew your origin certificate, your site breaks silently. The technical details matter, and as Izah Njoroge put it, the AI (or any tool) is only as smart as the person using it. The same goes for DNS configuration. A few deliberate, informed clicks save thousands of shillings and hours of anguish later.
How Enthelot Cloud Handles Domain Routing for You
At Enthelot Cloud, we encounter this exact scenario regularly. A client buys a .co.ke domain, wants it attached to their platform hosted on international infrastructure, and their registrar’s panel refuses to cooperate. We handle the entire chain:
-
We configure Cloudflare DNS with the correct records (A, CNAME, MX for email, TXT for verification).
-
We enforce Full (strict) SSL using Cloudflare Origin CA certificates deployed automatically on your server.
-
We set up page rules for caching, redirects, and security headers.
-
We monitor uptime and certificate expiry through our maintenance retainer plans (starting at Ksh 12,500/month).
Our cloud hosting environments come pre-integrated with Cloudflare, so you never stare at a blank DNS screen wondering what to do with an IP address. We build the bridge, test it, and keep it standing.
Step Away From the Registrar’s Dashboard
You do not need to transfer your domain away from your Kenyan registrar. You do not need to buy a hosting package you won’t use. You just need to change two nameserver fields and spend ten minutes configuring Cloudflare. The result is a professional, secure, globally fast web presence that masks the complexity underneath.
If you would rather spend those ten minutes growing your business, call or WhatsApp Enthelot Cloud at +254 722 330 954, email info@enthelotcloud.com, or log into your encrypted client portal at enthelotcloud.com. We will route your domain, harden your SSL.