What is the name of the domain?
What is the issue you’re encountering
The main SaaS CNAME Target has a valid SSL, but real traffic gets blocked (possibly due to a cross-ban), while a CNAME from an alternate domain works normally.
What steps have you taken to resolve the issue?
I kept everything exactly the same, with the same setup and characteristics, but still, the main domain only works when clients point their CNAME directly to it. When they point to a subdomain, it triggers a cross-ban or similar error. Meanwhile, on my staging domain, pointing to the subdomain works perfectly.
What feature, service or problem is this related to?
I don’t know
What are the steps to reproduce the issue?
Hi everyone,
I’ve activated Cloudflare for SaaS on one of my domains (let’s call it saas-domain.com) and configured everything properly:
The Fallback Origin,
Custom Hostnames,
And the subdomain connect.saas-domain.com with proxy enabled, to be used as the official CNAME Target.
Later, I acquired a second domain (staging-domain.com) under the same Cloudflare account (intended for a staging/test environment).
There, I created a subdomain connect.staging-domain.com, also proxied, pointing to a different staging server.
Here’s the unexpected part:
When my clients point their custom domains via CNAME to connect.staging-domain.com (the staging one), SSL is issued correctly and traffic flows fine.
But when they use the correct CNAME (connect.saas-domain.com), SSL is also issued — yet traffic gets blocked by what seems to be a cross-ban or some type of security restriction, and the redirect never completes.
Questions:
Why is a subdomain from a different zone (within the same account, but not where SaaS was activated) allowed to work as a CNAME Target?
And more importantly: how can I get connect.saas-domain.com to work properly, allowing clients to point to it without triggering this security block?
