How to Move a Domain to Cloudflare DNS

The domain stays at its current registrar; only the nameservers change. Cloudflare copies the existing records first, so the site and email keep working through the switch.

Create a Cloudflare account and add the domain

Sign up at dash.cloudflare.com, click Add a domain, enter yourdomain.com and continue. Choose the Free plan when asked.

Review the imported records

Cloudflare scans public DNS and lists every record it found. Open the registrar's DNS page in another tab and compare line by line. Add anything missing, which is usually records that were never queried publicly: subdomains, TXT verification records, DKIM and SPF entries. Each record has a proxy toggle; leave the defaults for now and click Continue.

Change the nameservers at the registrar

Cloudflare now shows two nameservers in this form:

ada.ns.cloudflare.com
bob.ns.cloudflare.com

At the registrar, open the domain's nameserver settings, switch from the default to custom nameservers, delete every existing entry, and enter the two from Cloudflare. Save, then return to Cloudflare and click Done, check nameservers.

Wait for the activation email

Activation takes anywhere from a few minutes to 24 hours, depending on the registrar. Cloudflare emails when the domain is active, and the overview page changes from Pending to Active. To check yourself:

dig +short NS yourdomain.com

When both Cloudflare nameservers appear, the move is complete.

Set the SSL/TLS mode

Open SSL/TLS, Overview, and click Configure. Choose Full (strict) if the origin server already has a valid certificate, which is the case on Vercel, Netlify, most managed hosts, and any server running Let's Encrypt. Choose Full only if the origin uses a self-signed certificate. Do not choose Flexible for a site that already serves HTTPS; it causes redirect loops.

Orange cloud versus DNS only. A proxied record (orange cloud) routes traffic through Cloudflare, which hides the origin IP, caches static files and applies the SSL mode above. DNS only (gray cloud) returns the real IP and passes traffic straight through. Web traffic on A, AAAA and CNAME records can be proxied; anything that is not HTTP, such as SSH, FTP or a game server, must be DNS only.

Keep mail unproxied. MX records are never proxied, but the A record they point at, such as mail.yourdomain.com, must be set to DNS only or incoming mail fails. The same applies to any hostname used for SMTP or IMAP.