How to Move Your Domain's DNS to Cloudflare

Moving your DNS to Cloudflare gives you near-instant record changes, a free global CDN, DDoS protection and free SSL. Done in the right order it's zero-downtime; done carelessly you can drop records or break a domain with a stale DNSSEC key. This guide gets it right.

What "moving DNS" means (and doesn't)

You're changing where your DNS is hosted — your zone moves to Cloudflare's nameservers. Your domain registration stays put at your current registrar. Email, website, everything keeps working *as long as every record is copied over first*. If nameservers concepts are fuzzy, read what are nameservers.

Step 1: Inventory your current records

Before anything, list every record at your current DNS host — A, AAAA, CNAME, MX, TXT (SPF/DKIM/DMARC), SRV, CAA, everything. The ones people forget are the email records; drop an MX or SPF record and mail breaks. Export a zone file if your provider allows, or dig the important ones:

dig example.com ANY +noall +answer
dig example.com MX +short
dig example.com TXT +short

Step 2: Add the site to Cloudflare and check the import

Add your domain in Cloudflare (Free plan). Cloudflare scans and imports what it can find automatically. Do not trust the scan blindly — compare it against your inventory and manually add anything missing, especially DKIM selectors and less-common records. This is the single most important step.

Step 3: Set proxy status per record

Cloudflare marks web records orange (proxied) by default. Adjust:

• Website records (A/CNAME on @, www): leave orange for CDN + SSL.
• Mail, SSH, game, and other non-HTTP records (mail, MX targets, SRV): set grey (DNS-only) or they'll break. Cloudflare's proxy is HTTP-only.

This mirrors the advice in how to point a domain to a VPS with Cloudflare.

Step 4: Handle DNSSEC BEFORE switching

If your domain currently has DNSSEC enabled, you must disable it at your current registrar/host *first* and wait for the old DS record to clear. Switching nameservers with a stale DS record makes the domain fail validation everywhere (SERVFAIL) — an outage that's hard to diagnose. See how to enable DNSSEC on your domain for the mechanics; re-enable it in Cloudflare *after* the migration is stable.

Step 5: Change nameservers at the registrar

Cloudflare gives you two nameservers (e.g. dana.ns.cloudflare.com). At your registrar, replace the existing nameservers with these. Keep your old DNS host's records in place for now as a safety net — because both sets of nameservers still answer during the switchover, there's no gap. Full detail: how to set up custom nameservers for your domain.

Step 6: Verify and finish

Cloudflare emails you when it detects the nameserver change (minutes to a day). Then confirm:

dig example.com NS +short          # should show Cloudflare nameservers
dig example.com MX +short          # email records intact
dig www.example.com +short         # site resolves

Test your website and send a test email both ways. Once everything checks out for a day, re-enable DNSSEC in Cloudflare (Step 4). Troubleshooting: diagnosing DNS problems with dig and nslookup.

Guard your email through the move

Email is the thing most likely to break in a DNS migration because people focus on the website and forget mail. Before you switch nameservers, make sure Cloudflare's zone contains every email record:

dig +short example.com MX
dig +short example.com TXT          # SPF
dig +short _dmarc.example.com TXT   # DMARC
dig +short google._domainkey.example.com TXT   # a DKIM selector

Copy each into Cloudflare, and set the MX records and any mail hostname to grey (DNS-only) — Cloudflare's proxy is HTTP-only and would break mail. DKIM selectors are the classic casualty because the auto-import often misses them. After the switch, send a test message both ways to confirm mail still flows, cross-checking against how to set up SPF, DKIM and DMARC step by step.

Post-migration hardening

Once DNS is on Cloudflare and stable for a day, turn on the free wins the platform gives you:

• Always Use HTTPS and Automatic HTTPS Rewrites to force secure connections.
• SSL mode Full (strict) with a valid origin certificate.
• A redirect rule consolidating www and apex to one canonical URL.
• Re-enable DNSSEC in Cloudflare (paste the new DS record at your registrar) — but only *after* the old DNSSEC was removed pre-migration, per how to enable DNSSEC on your domain.

Have a rollback plan

Because both nameserver sets answer during the transition, a clean migration has no gap — but keep an escape hatch anyway. Leave your old DNS host's zone intact for a week. If something resolves wrong on Cloudflare, you can point the registrar's nameservers back to the old host and be restored within the TTL while you debug. Only delete the old zone once you've verified the site, email and any subdomains for several days. If something does misbehave, work through it with diagnosing DNS problems with dig and nslookup.

FAQ

Will moving DNS to Cloudflare cause downtime?

Not if you copy every record before switching nameservers. Both nameserver sets answer during the transition, so there's no gap when done in this order.

Do I lose my domain registration by using Cloudflare?

No. Cloudflare only hosts your DNS. Your registration stays at your current registrar unless you separately transfer it.

What's the most common mistake?

Missing records — usually MX or DKIM — because people trust Cloudflare's auto-import. Always reconcile against a full inventory of your old zone.

What about DNSSEC?

Disable it at the old host first, let the DS record clear, migrate, then re-enable in Cloudflare. Skipping this is the classic way to break a domain during migration.

Can I move DNS to Cloudflare without transferring my domain?

Yes, and it's the usual arrangement. Moving DNS to Cloudflare only changes which nameservers answer for your domain — your registration stays exactly where it is, renewing through your current registrar as before. You're delegating DNS management, not ownership. That's different from a domain *transfer*, which moves the registration itself to a new registrar and is a separate, optional process. Plenty of people keep a domain registered at GoDaddy or Namecheap for years while running its DNS on Cloudflare for the speed, CDN and free SSL. The only fields you change at the registrar are the nameservers; everything else about your registration is untouched.

With DNS on Cloudflare, point those records at a fast NVMe VPS from Nxeon — or manage domains and DNS together with Nxeon domains.