The one-click privacy fix that would have quietly killed my VPN

My domain's main record pointed straight at my home IP address. Every app was already hiding behind a CDN's proxy, but the bare domain wasn't, so anyone curious could look up exactly where my house lives on the internet. Flipping that record to "proxied" looked like a one-click fix. It nearly was a one-click outage.

The catch

My WireGuard tunnel used the bare domain as its endpoint. A CDN's proxy terminates HTTP and HTTPS. It does not forward arbitrary UDP, and WireGuard is entirely UDP. Proxy that record and DNS starts answering with the CDN's addresses, so every VPN client politely sends its handshake to servers that drop it on the floor. No error, no warning, just a tunnel that never comes up.

The fix, in an order that never breaks anything

1. Add a new DNS-only name (say vpn.example.com) to the dynamic DNS updater, so it follows the home IP address the way the main record used to.
2. Point the WireGuard server's endpoint setting at the new name and regenerate the client configs and QR codes.
3. Update each client. Usually that's just editing the endpoint field in the WireGuard app.
4. Only then flip the main record to proxied.

The VPN name still points at my home IP. A VPN needs a reachable address, so that part is unavoidable, but now it's one hostname nobody would guess instead of the name printed on everything.

Before you proxy any DNS record, grep your configs for that exact hostname. VPN endpoints, game servers, mail and SSH are the usual suspects quietly depending on it.