Moving Your Business Domain to Cloudflare DNS Without Breaking Email or Your Website
A step-by-step plan for moving a business domain to Cloudflare DNS: audit every record, keep email working, choose proxied vs DNS-only, handle DNSSEC and verify the cutover.
Moving your business domain's DNS to Cloudflare is safe if you do three things in order. First, make sure every existing record, especially email records (MX, SPF, DKIM and DMARC), is copied into Cloudflare and checked. Second, turn off DNSSEC at your current provider before you switch nameservers. Third, decide record by record what should be proxied (orange cloud) and what must stay DNS-only (gray cloud). Email hostnames always stay DNS-only. If you skip any of these steps, your website or your email can go down for hours, and that is avoidable.
This guide covers how we plan these moves for businesses in Miami-Dade and South Florida, using Cloudflare's own documentation.
Full setup or partial setup?
Cloudflare offers two ways to put a domain behind its network.
| Full setup (primary) | Partial setup (CNAME) | |
|---|---|---|
| Who answers DNS queries | Cloudflare's nameservers | Your current DNS provider |
| What changes at the registrar | Nameservers switch to Cloudflare | Nothing; you add CNAMEs at your current provider |
| Plans | All plans | Business and Enterprise only |
| DNS infrastructure DDoS protection | Yes | No (Cloudflare is not authoritative) |
Most small and mid-sized businesses use the full setup: Cloudflare becomes the authoritative DNS provider and you manage all records in one dashboard. A partial setup makes sense only when you cannot move authoritative DNS, for example when a parent company's IT department controls it. Cloudflare's documentation notes that partial setups are not supported for domains registered with Cloudflare Registrar, and that proxying the zone apex then depends on your DNS provider supporting CNAME flattening.
The rest of this guide assumes a full setup.
Step 1: Inventory your current DNS before you touch anything
Before you add the domain to Cloudflare, export or screenshot the full zone at your current provider (your registrar, your hosting company, or Microsoft 365 or Google Workspace if they host DNS). You want a "before" picture you can compare against.
Pay special attention to:
- A and AAAA records for the root domain and
www. - MX records, which tell the world where your email is delivered.
- TXT records for SPF (
v=spf1 …) and DMARC (_dmarc), plus any DKIM records, which may be TXT or CNAME (selector._domainkey). - CNAME records for services such as Microsoft 365 autodiscover, Google Workspace or your CRM.
- Verification records from Google, Microsoft, Apple, payment processors and marketing platforms.
- SRV records for things like Microsoft Teams or VoIP phone systems.
If your email authentication is not in good shape yet, read our guide on SPF, DKIM and DMARC first. Moving DNS is a good moment to fix it, but don't change two things at once.
Lower your TTLs a day ahead
If you expect to change any record values during the move, lower the TTL on those records at your old provider a day or two in advance. Resolvers will then pick up changes faster. Cloudflare's docs describe the trade-off: a longer TTL means more caching, while a shorter TTL lets changes take effect sooner.
Step 2: Add the domain and audit the imported records
In the Cloudflare dashboard, onboard your domain (the apex, such as example.com) and choose a plan. Cloudflare runs a quick DNS scan and imports the records it finds.
Cloudflare's documentation says the scan may miss records, so compare the imported list line by line with your inventory. Records that are easy to miss include DKIM selectors, SRV records and subdomains nobody has visited in years. Add any missing records by hand.
Step 3: Decide what to proxy and what to leave DNS-only
Each A, AAAA and CNAME record in Cloudflare has a proxy status:
- Proxied (orange cloud): web traffic goes through Cloudflare, which hides your server's IP address and applies caching, SSL and security features such as the Cloudflare WAF.
- DNS only (gray cloud): Cloudflare simply answers with your real IP address, like any other DNS provider.
Only A, AAAA and CNAME records can be proxied. MX, TXT and other record types are always DNS-only.
Records that must NOT be proxied
- Mail hostnames. If your MX record points to
mail.example.com, the A record formailmust be DNS-only. Cloudflare does not proxy email traffic on port 25 (SMTP) by default, so proxying that hostname breaks mail delivery. - Domain-ownership verification CNAMEs. Cloudflare's docs say records used to prove ownership should not be proxied.
- Non-web services such as FTP, SSH, VPN endpoints or VoIP on the same hostname. The proxy handles web traffic, so give these services their own DNS-only hostname.
Proxy your website records
Your website (example.com and www) is normally proxied. One caution: if your mail server and web server share the same IP address, the DNS-only mail record reveals the IP that the proxy is supposed to hide. Cloudflare's documentation lists mail configuration as one of the ways an origin IP gets discovered. Where possible, host email separately (Microsoft 365 or Google Workspace) or on a different IP address.
TTLs inside Cloudflare
Proxied records use a fixed TTL of Auto (300 seconds), which you cannot change. For DNS-only records you can set the TTL yourself, from 60 seconds on non-Enterprise plans up to one day. Auto also means 300 seconds.
Step 4: Handle DNSSEC before changing nameservers
This step causes the most outages. If DNSSEC is enabled for your domain, a DS record at your registrar tells resolvers which keys to trust. If you switch nameservers while that old DS record is still active, validating resolvers can return SERVFAIL errors and your domain becomes unreachable for anyone using them.
Cloudflare's documented sequence when your current provider does not support multi-signer DNSSEC:
- Remove the DS record at your registrar (disable DNSSEC).
- Wait for the DS record's TTL to expire. Check with
dig DS example.com. Cloudflare notes this is commonly 24 to 48 hours. - Change your nameservers to Cloudflare.
- Wait for the old NS record TTL to expire.
- Enable DNSSEC in Cloudflare (DNS settings) and add the new DS record that Cloudflare shows you at your registrar.
If your current provider lets you add DNSKEY records at the zone apex, Cloudflare also documents a multi-signer migration that avoids the gap without DNSSEC. If you are not sure whether DNSSEC is on, the dig DS check tells you: no answer means there is no DS record.
Step 5: Change the nameservers at your registrar
Cloudflare assigns two nameservers to your zone and shows them on the zone's Overview page. You cannot choose them.
- Find your registrar (ICANN Lookup will tell you if nobody remembers).
- Remove the existing nameservers and enter Cloudflare's two nameservers exactly as shown.
- Save, and expect the change to take up to 24 hours at the registrar.
Some domains are managed through a reseller or a web designer's account, so the change may need to happen there. Find out before the planned day.
Step 6: Verify everything
Your zone is live when the dashboard shows the domain as Active. Cloudflare also sends a confirmation email. Then work through this checklist:
dig ns example.com @1.1.1.1(ornslookup -type=ns example.com 1.1.1.1on Windows) returns Cloudflare's nameservers.- The website loads on both
example.comandwww, with a valid certificate and no redirect loops. - Send and receive a test email with an outside account (Gmail or Outlook.com) in both directions.
- Check the headers of a received test message: SPF, DKIM and DMARC should all pass.
- Microsoft 365 or Google Workspace admin centers show the domain as healthy.
- Third-party services that relied on DNS (CRM email, payment processor, booking tools) still verify.
- DNSSEC is re-enabled in Cloudflare and the new DS record is published at the registrar.
- Two people have access to the Cloudflare account, both with MFA, and the login is in your password manager.
Keep your old DNS provider's zone in place for a few days. It serves as a reference, and it answers resolvers that still have the old nameservers cached.
What comes next
Once DNS is on Cloudflare and the website is proxied, check your SSL/TLS encryption mode (it should be Full (strict) when your server has a valid certificate) and decide which security and caching features to turn on. Our web hosting management and business email teams do these moves regularly, including the after-hours cutover.
If you would like help moving your domain without losing email or uptime, request a free IT assessment. Core Florida IT supports businesses across Miami-Dade and South Florida, in English and Spanish, and we configure Cloudflare as an independent IT provider.
