Connect a Domain to Cloudflare Safely: DNS and Nameserver Guide

Cloudflare can provide authoritative DNS, traffic protection and useful visibility for a business website. Connecting a domain is more than adding it to a Cloudflare account: the registrar must delegate the domain to the Cloudflare nameservers, and the new Cloudflare zone must contain the records your website and email already use.

This guide is for Irish businesses moving an existing domain, including a .ie domain. It focuses on preventing the common outage where the nameservers change successfully but the new zone is incomplete.

What changes when you use Cloudflare?

The registrar stores the domain registration and delegation. The authoritative DNS provider stores records such as A, AAAA, CNAME, MX and TXT. Cloudflare can become that authoritative provider, but it does not automatically know every record in the old zone and it does not automatically fix mail, verification or DNSSEC mistakes.

After a successful move, a DNS query should ultimately reach Cloudflare’s assigned nameservers for the zone. The website may still be hosted at Wix, a shared host, Shopify or another provider; DNS and hosting are separate decisions.

Before changing anything: make an inventory

Write down the current nameservers and export or copy the complete zone from the existing provider. Include records that are not visible on the home page:

root and www website records;
MX records and mail subdomains;
SPF, DKIM and DMARC TXT records;
subdomains for portals, APIs, staging and support;
certificate, payment, Search Console and other verification records;
CAA records and any special service records.

Note the current TTLs, record names, types, values and proxy settings. A DNS export is evidence, not a reason to copy every record blindly. Remove obsolete records and check whether a provider requires a particular target or hostname.

Add the domain to Cloudflare and review the imported zone

Add the exact domain to Cloudflare using the customer’s Cloudflare account.
Let Cloudflare scan the old DNS if offered, then compare the result with the source zone.
Correct missing records, duplicate records and incorrect root-host notation.
Keep mail and verification records unproxied unless the service specifically supports proxying.
Confirm the website origin and certificate settings with the hosting provider.

Cloudflare will display two assigned nameservers. Use those exact hostnames. Do not substitute nameservers from another Cloudflare zone or another customer.

Special care for a .ie domain

A .ie domain has registry policies and registrar workflows in addition to ordinary DNS. The nameserver update must be accepted by the registrar and the registry. A successful button click is not proof that the delegation has propagated; verify the parent and the authoritative answers.

Keep the domain’s legal holder and renewal details unchanged during a DNS move. Do not combine a nameserver migration with a registrant change or registrar transfer unless there is a specific reason and a rollback owner.

DNSSEC: the step people miss

DNSSEC adds signed DNS data and a DS record at the parent registry. It is valuable when the signing chain is maintained correctly, but an old DS record combined with a new unsigned zone can make validating resolvers return SERVFAIL. This is not a normal propagation delay.

Before moving DNS, decide whether DNSSEC will remain enabled. If the new provider supports the migration, follow its key-rollover procedure. If the old signer is being removed, remove or roll the DS record through the registrar or registry workflow before relying on the unsigned zone. Do not delete keys casually while a valid signed zone is still in service.

After the change, check the DNSSEC status from the domain provider and test with a validating resolver. Read the DNSSEC guide for a deeper explanation of the chain of trust.

Change the nameservers in a controlled window

Confirm the Cloudflare zone answers with the new records.
Save the old nameserver list and zone export.
Change only the nameserver values in the Hoster domain dashboard.
Wait for the registrar to accept the mutation and the parent to publish the delegation.
Check authoritative NS answers and the website, mail and verification services.

Some resolvers cache the old delegation until its TTL expires. Keep the old zone available during the transition. Do not repeatedly switch back and forth: every change creates a new propagation window and makes diagnosis harder.

Verification commands and practical checks

Technical staff can compare answers using dig. Query the parent for NS and DS, query the assigned Cloudflare nameserver directly for A, MX and TXT, and query a validating recursive resolver. A normal-looking website alone does not prove that all subdomains or email are healthy.

Root domain loads over HTTPS and redirects consistently.
www, API and customer portal hostnames still resolve.
Inbound mail arrives and outbound mail passes SPF, DKIM and DMARC checks.
Payment, analytics and search verification records remain present.
DNSSEC status is either intentionally signed and valid or intentionally unsigned with no stale DS.

If the website works but email fails

This usually means the web record was copied but MX or mail TXT records were not. Restore the exact mail records from the source provider, confirm that Cloudflare is not proxying MX targets, and allow the mail provider’s cache time to pass. Never “fix” mail by inventing an MX target.

If the dashboard says busy or rejected

A registrar operation can be rejected by validation, rate limits, a pending operation, DNSSEC state or a temporary upstream failure. Keep the last authoritative nameservers, record the exact error and avoid treating a local form value as proof of success. Hoster’s domain dashboard should display the registrar-accepted state; if it remains uncertain, contact support with the domain and intended nameservers.

Cloudflare connection checklist

Cloudflare zone belongs to the customer’s own account.
Complete DNS inventory copied and reviewed.
Assigned Cloudflare nameservers recorded exactly.
Website, email and verification records tested at the new provider.
DNSSEC rollover or removal plan confirmed.
Nameserver mutation accepted by the registrar.
Authoritative and validating DNS checks completed.

Use the Hoster domain dashboard for the registrar-side change and Cloudflare’s own dashboard for the zone. Keep each system’s responsibility clear.

How to Connect a Domain to Cloudflare: A Safe Nameserver Change Guide for Ireland