iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To put a registered domain on Cloudflare’s standard full DNS setup, add the domain to Cloudflare, review its DNS records, turn off DNSSEC if it is active, and replace the domain’s nameservers at the registrar with the exact pair Cloudflare assigns. Once Cloudflare is active, manage the domain’s DNS records there.
Before you change nameservers
This guide covers Cloudflare’s full setup, where Cloudflare becomes the authoritative DNS provider. It assumes you can manage the domain’s nameservers at its registrar. If the domain is registered elsewhere, make the nameserver change at the registrar that controls its delegation instead. Cloudflare describes full setup as its common setup and the only setup available on Free and Pro plans; its partial/CNAME setup is available on Business and Enterprise plans. See Cloudflare’s full setup guide.
- Make a note of the DNS records currently in use, especially website and email records.
- Have access to the Cloudflare account where you will add the domain and the registrar account that manages its nameservers.
- Know which provider hosts your website and email. The correct DNS values depend on those services.
1. Add the domain to Cloudflare and review its DNS records
In Cloudflare, add the apex domain, such as example.com, and choose a plan. Cloudflare assigns two nameservers to the domain. Do not substitute example nameservers or values assigned to another domain.
Cloudflare may scan for and import existing DNS records, but check the zone carefully before switching nameservers. Confirm the website’s apex record and any required www or other subdomain records. Your hosting setup determines whether those records should be A, AAAA, or CNAME records.
#1 Best Overall
If the domain uses email, add or verify the mail provider’s MX and TXT records, along with any SPF, DKIM, and DMARC records it requires. Use the exact values supplied by your email provider; generic examples are not universal.
Missing website records can prevent visitors from reaching the site. Cloudflare warns that activating a domain without the correct DNS records may result in DNS_PROBE_FINISHED_NXDOMAIN errors.
2. Turn off DNSSEC before the nameserver switch
If DNSSEC is enabled for the domain, disable it before changing nameservers. An old DS record left at the registrar can conflict with the new DNS setup and make the domain unreachable. DNSSEC settings are usually managed through the registrar, although availability can vary by top-level domain. Cloudflare explains the DNSSEC considerations in its full setup troubleshooting guide.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errors3. Replace the nameservers at your registrar
- Sign in to your registrar and open the domain’s management page.
- Open the nameserver settings.
- Select the custom or change-nameservers option and enter the two nameservers Cloudflare assigned to this domain, exactly as shown.
- Save the change. Remove old nameservers if the interface retains them; the delegation should use Cloudflare’s assigned pair.
Changing nameservers moves DNS-zone management to the new provider. After this switch, make DNS changes in Cloudflare, not in the old DNS zone.
4. Wait for activation and verify the delegation
Nameserver changes can take up to 24 hours to update; this is an upper window, not a guaranteed completion time. Registrar processing and DNS caching affect when the change is visible. In Cloudflare, check that the zone status becomes Active. Also confirm that public DNS returns the exact nameservers assigned to the zone.
On macOS or Linux, Cloudflare documents these checks:
dig ns example.com @1.1.1.1
dig ns example.com @8.8.8.8
dig example.com +traceOn Windows, use:
nslookup -type=ns example.com 1.1.1.1Replace example.com with your domain. Cloudflare’s verification and troubleshooting steps are in its primary setup troubleshooting guide.
Recommended Free Tools
5. Re-enable DNSSEC after Cloudflare is active
After Cloudflare reports the zone as active, configure DNSSEC through Cloudflare and update the registrar-side settings as Cloudflare directs. Do not leave a DS record from the previous DNS provider in place. Follow Cloudflare’s activation-specific instructions for the new configuration.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.If the site or email stops working
Cloudflare stays pending or the domain does not resolve
- Confirm that the nameservers at the registrar exactly match the two assigned by Cloudflare.
- Remove extra or old nameservers if they remain listed.
- Check for a pre-existing DS record at the registrar and ensure DNSSEC was disabled before the switch.
- Allow up to 24 hours for updates. If the domain was registered through a reseller or elsewhere, verify that you changed nameservers with the provider that actually controls the domain’s delegation.
The website loads but email does not
Inspect the Cloudflare zone for the email provider’s MX and TXT records, and check that all values match that provider’s requirements. Web proxying is intended for HTTP/S traffic; configure mail records according to your email provider rather than treating them as ordinary proxied website records. Exact mail settings are account-specific.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
