Cloudflare is one of the most widely used DNS providers on the planet, and for good reason. It offers fast anycast DNS resolution, a free SSL certificate, DDoS protection, and a clean dashboard that makes managing DNS records straightforward. Whether you are migrating an existing domain or setting up DNS for the first time, the process takes less than 30 minutes if you know what you are doing. This guide walks you through the entire setup from account creation to live verification, including the most common mistakes that cause downtime during the cutover.

Why Use Cloudflare DNS Instead of Your Registrar's Default

Most domain registrars provide basic DNS as part of the package. It works, but it is rarely fast, rarely feature-rich, and rarely comes with analytics. Cloudflare's free tier gives you:

  • Sub-10ms global DNS resolution via a 300+ city anycast network
  • Unlimited DNS queries with no throttling
  • One-click DNSSEC to protect against cache poisoning
  • Free Universal SSL (shared certificate) or upload your own
  • DDoS mitigation at the network edge when you proxy traffic through Cloudflare
  • DNS record-level analytics showing query volume per record

The tradeoff is that you must point your domain's nameservers away from your registrar to Cloudflare. This is a nameserver delegation, not a zone transfer — your registrar still owns the domain registration, but Cloudflare answers all DNS queries.

Step 1: Create a Cloudflare Account and Add Your Domain

Go to dash.cloudflare.com and register for a free account. Once you are logged in:

  1. Click Add a Site in the top navigation bar.
  2. Enter your root domain — for example, example.com — and click Continue. Do not include a subdomain here.
  3. Select the Free plan and click Continue.

Cloudflare will now perform an automatic DNS scan of your existing zone. It queries multiple public DNS resolvers and your current authoritative nameservers to pull in every record it can find. This scan takes 30 to 60 seconds.

Before you change nameservers, run a full record export from your current DNS provider and cross-check it against what Cloudflare imported. Use the DNS Lookup tool to query your current nameservers directly and confirm every A, MX, CNAME, and TXT record is accounted for.

Step 2: Review and Fix Imported DNS Records

The automatic import is good but not perfect. Mail records in particular are frequently missed or imported with wrong TTL values. Go through the imported list carefully before proceeding.

Records to Check First

  • A records — Confirm the root domain and www point to the correct server IP addresses. If you are running a web server at 203.0.113.10, both example.com and www.example.com should have A records pointing there.
  • MX records — These must be correct or email will break the moment you cut over. If you use Google Workspace, you need five MX records (ASPMX.L.GOOGLE.COM at priority 1, then the four ALT servers). If you use Microsoft 365, you need a single MX record like yourdomain-com.mail.protection.outlook.com at priority 0.
  • TXT records — SPF, DKIM, and DMARC records live here. These are critical for email deliverability. A missing SPF record can get your outbound mail flagged as spam within hours.
  • CNAME records — Check for any CNAMEs used by third-party services: Stripe, Mailchimp, Zendesk, HubSpot, etc. These are easy to miss.
  • SRV records — Relevant if you run SIP telephony or certain game servers. Not imported automatically as often as other types.

To add a missing record, click Add Record, choose the type, fill in the name, content, and TTL. For most records, a TTL of 300 seconds (5 minutes) is sensible during the initial cutover — you can increase it to 3600 or higher once you have confirmed everything is working.

Understanding the Proxy Status Toggle

Next to each record is an orange cloud icon labeled Proxied or a grey cloud labeled DNS Only. When a record is proxied, traffic routes through Cloudflare's edge network, enabling caching, SSL termination, and WAF features. When it is DNS-only, Cloudflare simply returns the real IP address like any other DNS server would.

Set your main A records (root and www) to Proxied to get the full benefit. Set MX records — and any record that points to a mail server — to DNS Only. Cloudflare will not proxy non-HTTP traffic through the orange cloud on the free plan.

Step 3: Note Your Assigned Cloudflare Nameservers

At the bottom of the DNS records review page, Cloudflare displays two nameservers assigned specifically to your account. They look something like:

ada.ns.cloudflare.com roald.ns.cloudflare.com

These are unique to your account, not just to your domain. Write them down. You will need to enter these exactly at your registrar in the next step. Every character matters — do not add a trailing dot unless your registrar's interface specifically requires it.

Step 4: Update Nameservers at Your Domain Registrar

Log in to wherever you registered the domain. The exact navigation varies by registrar, but you are looking for a section called Nameservers, DNS, or Name Server Management. Below are the paths for the most common registrars:

  • GoDaddy: My Products > Domains > DNS > Nameservers > Change > Enter My Own Nameservers
  • Namecheap: Domain List > Manage > Nameservers > Custom DNS
  • Google Domains / Squarespace Domains: DNS > Nameservers > Switch to Custom Name Servers
  • Porkbun: Domain Management > Authoritative Nameservers
  • Hover: Your Domains > Edit Domain > Nameservers

Delete any existing nameserver entries and replace them with the two Cloudflare nameservers you noted above. Save the changes. Most registrars apply the change almost immediately on their end, but the delegation has to propagate through the global DNS system, which takes anywhere from a few minutes to 48 hours depending on the parent zone's TTL and your previous nameservers' TTL settings.

Nameserver propagation is not instant. Use the DNS Propagation Checker to monitor how many resolvers around the world have picked up your new nameservers. You are looking for the NS record query to return Cloudflare's nameservers from most locations before considering the cutover complete.

Step 5: Verify the Nameserver Change

Once you have saved the new nameservers at your registrar, you can check propagation from the command line. On Linux, macOS, or Windows with WSL:

dig NS example.com @8.8.8.8 +short # Expected output after propagation: ada.ns.cloudflare.com. roald.ns.cloudflare.com.

On Windows without WSL, use PowerShell:

Resolve-DnsName -Name example.com -Type NS -Server 8.8.8.8

Back in the Cloudflare dashboard, it will display a Great news! Cloudflare is now protecting your site banner once it detects the nameserver change. Cloudflare checks automatically every few minutes. You can also click Re-check now on the Overview tab to trigger an immediate verification.

Step 6: Enable DNSSEC

DNSSEC adds cryptographic signatures to your DNS records, making it impossible for an attacker to poison a resolver's cache with forged responses. Enabling it in Cloudflare is a two-step process:

  1. In the Cloudflare dashboard, go to DNS > Settings > DNSSEC and click Enable DNSSEC.
  2. Cloudflare generates a DS (Delegation Signer) record. Copy the DS record values shown in the dashboard.
  3. Go back to your domain registrar and find the DNSSEC or DS record section. Paste in the values Cloudflare provided. The fields you need are: Key Tag, Algorithm, Digest Type, and Digest.

Not every registrar supports DS record entry. GoDaddy, Namecheap, Google Domains, and Porkbun all support it. If your registrar does not, that is a valid reason to consider transferring your domain registration to one that does.

After adding the DS record at the registrar, DNSSEC validation will start working once the parent zone (the .com or .net TLD registry) picks up the DS record. This usually takes 15 to 60 minutes.

Step 7: Configure SSL and HTTPS Settings

Once Cloudflare is active, navigate to SSL/TLS > Overview. You have four mode options:

  • Off: No encryption. Never use this.
  • Flexible: Encrypts traffic between visitor and Cloudflare, but Cloudflare connects to your origin over plain HTTP. Use this only as a temporary measure if your origin has no certificate at all.
  • Full: Encrypts end-to-end, but does not validate your origin certificate. Accepts self-signed certificates on the origin.
  • Full (Strict): Encrypts end-to-end and validates your origin certificate against a trusted CA or a Cloudflare Origin CA certificate. This is the recommended setting.

If your origin server already has a valid Let's Encrypt or commercial SSL certificate, set this to Full (Strict) immediately. If it does not, either install a free Let's Encrypt certificate on the origin first, or generate a Cloudflare Origin CA certificate under SSL/TLS > Origin Server and install that on your web server. Using Flexible mode with a site that actually has an origin certificate is a common misconfiguration that causes redirect loops.

Common Problems and How to Fix Them

Too Many Redirects Error

This is almost always caused by SSL mode set to Flexible when the origin is already redirecting HTTP to HTTPS. Cloudflare connects to the origin on HTTP, the origin redirects to HTTPS, Cloudflare connects again on HTTP, and you get an infinite loop. Fix: Set SSL mode to Full or Full (Strict).

Email Stopped Working After Cutover

Check that your MX records are set to DNS Only (grey cloud, not orange). Also verify your SPF TXT record is present. Run a quick check:

dig MX example.com @1.1.1.1 +short dig TXT example.com @1.1.1.1 +short

If you see Cloudflare IP addresses returned for MX queries, those records are incorrectly set to Proxied. Switch them to DNS Only immediately.

Cloudflare Did Not Import All Records

The automatic scan misses records that are not publicly visible (like split-horizon internal records) or records that were added very recently with a very long TTL. The fix is to manually add them through DNS > Records > Add Record. This is why exporting your old zone file before migration is essential.

Nameservers Show as Pending After 24 Hours

Log in to your registrar and double-check that the nameservers were saved correctly. A common error is saving with a trailing dot (ada.ns.cloudflare.com.) when the registrar does not accept that format, or vice versa. Also confirm there are no registry locks on your domain that prevent nameserver changes.

How to Prevent Issues on Future DNS Changes

Once you are on Cloudflare, a few habits will save you significant headaches:

  • Lower TTLs before any planned change. Set records you plan to modify to 60 or 120 seconds at least an hour before making the change. This limits how long stale data is cached downstream.
  • Use Cloudflare's audit log. Under Account > Audit Log, every DNS record change is timestamped and attributed to a user. Invaluable for debugging in team environments.
  • Enable email notifications. Cloudflare can alert you when a zone's status changes or when a certificate fails to renew. Configure this under Notifications in the account menu.
  • Document your zone. Export the zone file periodically from DNS > Records > Export. Keep a copy in version control or a password manager.

Wrapping Up

Setting up Cloudflare DNS is a well-documented process, but the details — proxy status on MX records, SSL mode selection, DNSSEC DS record entry — are exactly where most problems originate. Follow the steps above in order, verify each stage before moving to the next, and you will have a faster, more secure DNS setup with zero downtime. If propagation seems stuck or you want to confirm your records are visible globally, run a lookup from multiple vantage points and compare the results until every region returns the expected data.