Error "You've reached the maximum usage limit for Cloudflare domain CDN" in Experience Cloud

Summary: After Salesforce migrated Digital Experience custom domains to Cloudflare CDN, orgs may encounter the error "You've reached the maximum usage limit for Cloudflare domain CDN" when adding new custom domains. Additionally, domains configured with Cloudflare CDN may show a greyed-out Delete option in Setup. This article explains the cause and resolution for both issues.

Scope: This article covers the Cloudflare CDN custom domain usage limit error in Experience Cloud and the inability to delete custom domains configured with Cloudflare CDN. It does NOT cover Cloudflare CDN provisioning failures, DNS record troubleshooting, TLS/SNI handshake errors, or naked-domain CNAME redirection issues — see related articles for those topics.

Description

Experience Cloud sites support custom domains served through Cloudflare CDN. Each org has a default limit on the number of custom domains that can use the Cloudflare CDN configuration option. When this limit is reached, attempts to add a new custom domain fail. Separately, custom domains currently configured with Cloudflare CDN cannot be deleted directly from Setup — the Delete button is greyed out.

Symptoms

1. When attempting to add a new custom domain with the Cloudflare CDN configuration option, the following error appears:

`You've reached the maximum usage limit for Cloudflare domain CDN. If you need help, contact Salesforce Customer Support. (Related field: Current Domain Configuration Option)`

2. In Setup under Sites > Custom URLs, the Delete option for an existing Cloudflare CDN domain is greyed out and cannot be clicked.

Cause

Salesforce enforces a per-org limit on the number of custom domains that can use the Cloudflare CDN HTTPS configuration option. The default limit may be lower than the number of domains previously supported under the legacy CDN infrastructure. Orgs that had more domains configured before the migration to Cloudflare CDN may find themselves at or above the new default limit.

(hypothesis) The deletion restriction exists because Cloudflare CDN domains require active certificate management. Salesforce prevents direct deletion of domains while they are configured with Cloudflare CDN to avoid orphaned certificate states.

Resolution

## Increasing the Cloudflare CDN Domain Limit

The domain limit can only be increased by Salesforce Support. To request an increase:

1. Open a case with Salesforce Support.
2. Provide a business justification explaining why the higher limit is required (for example, multiple clients access your Experience Cloud portal via their own custom domain names).
3. Specify the desired new limit.
4. Salesforce Support reviews and approves the request, then applies the new limit to your org.

Once the limit is increased, you can add new custom domains with the Cloudflare CDN option without encountering the error.

## Deleting a Custom Domain Configured with Cloudflare CDN

To delete a custom domain that uses the Cloudflare CDN configuration option, you must first switch it to non-HTTPS:

1. In Setup, search for `Sites` in Quick Find.
2. Click the name of the Experience Cloud site that owns the custom URL.
3. In the Custom URLs section, click Edit next to the domain you want to delete.
4. Change the Current Domain Configuration Option from Cloudflare CDN to a non-HTTPS option and save.
5. Return to the Custom URLs list. The Delete option for that domain is now available.
6. Click Delete to remove the custom domain.

Caveats: Switching to non-HTTPS temporarily removes HTTPS serving for that domain. Perform this step only when you are certain the domain should be permanently removed.

Known Limitations

- The Cloudflare CDN domain limit cannot be self-serviced by administrators; a Salesforce Support case is required for any increase.
- (hypothesis) The exact default limit value may vary by org edition or contract terms. Confirm your current limit with Salesforce Support.
- Domains cannot be deleted while configured with Cloudflare CDN — the configuration must be changed to non-HTTPS first.