To change nameservers to Cloudflare without losing web, mail, and service availability, you copy the existing records into Cloudflare, keep mail and non-HTTP service hosts DNS-only, clear any existing DNSSEC delegation at your registrar, replace the registrar's nameservers with Cloudflare's assigned names, and check delegation with DNS queries.
Compare the existing zone with Cloudflare's imported records
Since the scan is not guaranteed to find all existing DNS records, you need to review your records before you change nameservers.
After Cloudflare imports or scans your zone, compare the records in the DNS Records page with your current DNS configuration. Pay close attention to MX records, SRV records, TXT records (especially SPF, DKIM, and DMARC), and any complex CNAME configurations. Zone apex records (the bare domain), subdomain records (www, blog, or service-specific hostnames), and email records must all appear in Cloudflare with the correct Type, Name, and Content before you change nameservers.
Each A, AAAA, and CNAME record has a proxy status toggle. Proxied (orange cloud) routes web traffic through Cloudflare's network for caching and DDoS protection. DNS-only (gray cloud) returns the DNS record value without proxying. For an initial migration, consider setting all records to DNS-only to isolate DNS resolution from proxy-related issues. After you confirm that DNS resolution works, enable the proxy for specific HTTP/HTTPS records.
Set mail and non-HTTP service records to DNS-only
MX records cannot be proxied. If an A or AAAA record is used exclusively for email (for example, mail.example.com), it must also be set to DNS-only. Cloudflare does not proxy SMTP traffic on port 25 by default. Proxying a record that handles email traffic causes mail servers to connect to Cloudflare's IP addresses instead of your mail server, which prevents email delivery.
Use a dedicated hostname for email that is separate from your proxied web traffic hostname. If your MX record points to the same hostname as your website, Cloudflare dynamically prepends _dc-mx to the hostname in the response for the MX record, ensuring that mail traffic bypasses the proxy and reaches your server directly.
Records used for FTP, SSH, RDP, game servers, or other non-HTTP protocols must be DNS-only. Cloudflare's proxy only handles HTTP and HTTPS traffic. Proxying these records routes the traffic to Cloudflare, which drops the non-HTTP connection.
Address existing DNSSEC
If you are onboarding an existing domain to Cloudflare, make sure DNSSEC is disabled at your registrar before you change nameservers. Otherwise, your domain will experience connectivity errors when you change nameservers. When your domain has DNSSEC enabled, your DNS provider digitally signs all your DNS records. This prevents anyone else from issuing false DNS records on your behalf, but it also prevents Cloudflare from issuing new DNS records when you delegate authority. If you change nameservers without disabling DNSSEC, DNSSEC will prevent Cloudflare's DNS records from resolving properly.
Log in to the admin account for your domain registrar and turn off DNSSEC. If you do not know your provider, use ICANN Lookup. After you disable DNSSEC, wait at least the full DS record TTL published at the parent zone before you change nameservers. The typical TTL duration for DS records is 24 hours (86,400 seconds). You can re-enable DNSSEC through Cloudflare after your domain is active.
Replace the registrar's nameservers
Your domain will be assigned two authoritative Cloudflare nameservers. Your assigned nameservers are displayed as part of the onboarding flow. If you need to find them once again, go to the zone Overview page in the Cloudflare dashboard.
Log in to the admin account for your domain registrar. Navigate to DNS Management or the nameserver settings page. Remove your existing authoritative nameservers and add the nameservers provided by Cloudflare. If their names are not copied exactly, your DNS will not resolve correctly. You should have only Cloudflare nameservers listed at your registrar.
Confirm zone activation and check delegation
Registrar nameserver updates can take up to 24 hours. When your domain is active, you will receive an email from Cloudflare and your domain will have a status of Active on the Domains page of your account.
Check delegation by querying the nameservers for your domain:
dig NS example.com +shortThe output should show only your Cloudflare-assigned nameservers. You can also check individual records to confirm that Cloudflare is answering queries:
dig A example.com @assigned-nameserver.ns.cloudflare.com +shortReplace assigned-nameserver.ns.cloudflare.com with one of the nameservers from the zone Overview page.
Online tools such as whatsmydns.net will show your Cloudflare-assigned nameservers, though most of these tools use cached query results, so it may take longer for them to show the updated nameservers.
DNS resolution does not prove that mail or other services are working. Test mail delivery by sending a message and checking your mail server logs. For non-HTTP services, connect with the appropriate client (SSH, FTP, or the application's protocol) and confirm that the connection succeeds. If a service does not resolve or connect, check that the corresponding DNS record exists in Cloudflare's DNS Records page with the correct Type, Name, Content, and proxy status (DNS-only for mail and non-HTTP services).
Enable DNSSEC and proxying after verification
After you confirm that delegation is complete and each service resolves correctly, you can re-enable DNSSEC through Cloudflare. Go to the DNS Settings page in the Cloudflare dashboard, click Enable DNSSEC, and add the DS record to your registrar using the values Cloudflare provides.
If you set all records to DNS-only during migration, enable the proxy (orange cloud) for HTTP/HTTPS records that serve web traffic.
Verification status: Supported by official documentation only under the conditions below; not reproduced in a test environment by IGPROD. Checked 2026-10-22.
Conditions:
- For a primary (full) setup, use a registered domain and a Cloudflare account; Free and Pro plans use this setup.
- If DNSSEC is active, disable it at the registrar before replacing nameservers; re-enable it through Cloudflare after activation.
- For a delegated child subdomain, update NS records in the parent zone instead of at the registrar.
- Mail and non-HTTP service hostnames must use DNS-only records where Cloudflare’s HTTP proxy does not support the traffic.
- Registrar nameserver updates can take up to 24 hours.
Sources:
Leave a comment
Your email address will not be published. Required fields are marked *
