A Simple Guide to Cloudflare DNS Setup for Beginners

What Cloudflare DNS actually does

Cloudflare offers an authoritative DNS service with a free plan that many site owners use as their first step toward faster, more resilient DNS. When you “move to Cloudflare”, you are not transferring your domain registration or your website. You are telling your registrar that Cloudflare’s name servers are now the authoritative source for your domain’s DNS records.

That distinction matters. Your registrar still handles renewal and ownership, your host still runs your website and your mail provider still receives email. Cloudflare sits in front of them, answering DNS queries and optionally proxying web traffic through its network. If DNS is still a fuzzy concept, read how DNS works first.

Before you start: a quick checklist

• Registrar access. Make sure you can log in to the account where the domain is registered and change name servers. If 2FA is tied to an old phone, sort that out first.
• A copy of your current zone. Export the zone file from your current DNS provider, or at minimum take screenshots of every record.
• Your mail settings. Note the MX records and SPF, DKIM and DMARC TXT records from your email provider’s documentation.
• DNSSEC status. Check whether DNSSEC is enabled at the registrar. You will need to turn it off before the switch and re-enable it with Cloudflare afterwards.
• Timing. Pick a low-traffic window. The change itself is quick, but you want time to test.

A WHOIS lookup on TLDix shows your current name servers and registrar, which confirms where the change needs to happen.

Step 1: Create an account and add your domain

Sign up for Cloudflare, choose to add a site and enter your root domain (for example example.com, not www.example.com). Select a plan; the free plan includes DNS, the proxy and universal SSL and is enough for most small sites. Cloudflare then scans common hostnames and tries to import existing records.

Step 2: Review the imported DNS records

This is the step beginners most often rush, and it causes most post-migration problems. The automatic scan guesses common names such as www, mail and ftp, but it cannot see every record in your zone. Compare the list carefully with your exported zone.

Records to check one by one

• A and AAAA for the apex and www, pointing at your host’s IP addresses.
• CNAME records for subdomains like shop, blog or service verification names.
• MX records with the correct priority values.
• TXT records: SPF, DKIM selectors (often long names like selector1._domainkey), DMARC at _dmarc, and site verification strings.
• SRV and CAA records if you use them.

# compare before switching name servers
dig +short MX example.com @old-ns1.provider.example
dig +short MX example.com @ada.ns.cloudflare.com
dig +short TXT _dmarc.example.com @ada.ns.cloudflare.com

Replace the name server hostnames with your old provider’s and the two Cloudflare assigns to you. Querying both directly lets you confirm the zones match before anything goes live.

Step 3: Understand the orange and grey clouds

Each A, AAAA and CNAME record has a proxy status toggle. This is the single most important concept in Cloudflare DNS.

The proxy only handles HTTP and HTTPS on specific ports. If you proxy a hostname used for mail, such as mail.example.com, your mail clients will fail to connect. MX records themselves cannot be proxied, but the hostname they point to must be a grey-cloud record.

Also remember that grey-cloud records reveal your origin IP. If a mail or ftp record points at the same server as your website, the proxy will not hide the origin. Consider separate hosts for mail or restrict the origin firewall to Cloudflare IP ranges.

Step 4: Change the name servers at your registrar

Cloudflare will show two name servers assigned to your account, with names like ada.ns.cloudflare.com and bob.ns.cloudflare.com. Log in to your registrar, find the name server setting for the domain, choose custom name servers and replace the existing ones with exactly those two.

1. Disable DNSSEC at the registrar first if it is on, and wait for that change to take effect. A DS record pointing to the old provider’s keys will make the domain fail to resolve for validating resolvers.
2. Remove all old name servers; do not mix Cloudflare with your previous provider.
3. Save and wait. Cloudflare checks periodically and emails you when the zone becomes active.

Activation is often fast, but the parent zone’s name server records may be cached for up to a day or two depending on the TLD’s TTL. During that window some resolvers use the old servers, which is why both zones must match. Our article on DNS propagation explains the caching involved.

dig +short NS example.com
dig +trace example.com

Step 5: Set SSL/TLS correctly

When traffic is proxied, there are two encrypted legs: visitor to Cloudflare, and Cloudflare to your origin. The SSL/TLS mode controls the second leg.

• Off / Flexible: Cloudflare talks to your origin over plain HTTP. Avoid Flexible on sites that already redirect HTTP to HTTPS, because it commonly causes redirect loops, and it leaves the origin leg unencrypted.
• Full: encrypted to the origin, but the origin certificate is not validated.
• Full (strict): encrypted and validated. This is the recommended setting. Use a publicly trusted certificate on the origin or a free Cloudflare Origin CA certificate.

After switching, enable “Always Use HTTPS” and check that your site loads without mixed-content warnings.

Step 6: Re-enable DNSSEC and tidy up

In the Cloudflare dashboard, enable DNSSEC and copy the DS record details it shows. Add that DS record at your registrar; some registrars that integrate with Cloudflare do this automatically. Then:

• Send a test email to and from your domain and check the headers for SPF, DKIM and DMARC passes.
• Test every subdomain you use, including admin panels and APIs.
• Keep the old DNS zone untouched for a few days in case you need to roll back, then remove it.

Common beginner mistakes

• Missing DKIM or verification TXT records because the scan did not find them, leading to mail landing in spam.
• Proxying non-web hostnames such as mail, FTP or SSH.
• Using Flexible SSL and getting “too many redirects” errors.
• Leaving DNSSEC on at the registrar with the old DS record during the switch.
• Forgetting renewal. Cloudflare DNS does not renew your domain. If the registration lapses, the name servers stop mattering. Track expiry dates in your TLDix domain panel so you get alerts well before renewal is due.

How to roll back if something breaks

If a critical service fails after the switch and you cannot find the cause quickly, the safest move is usually to fix the record in Cloudflare rather than revert name servers, because a revert has to wait for caches again. Check the record type, value and proxy status first, since a single wrong toggle explains most outages. If you really must go back, restore the old name servers at the registrar, keep the Cloudflare zone in place until traffic has fully returned, and re-add the old DS record only if DNSSEC was active with your previous provider. Write down every change you make during the incident so you can repeat the migration cleanly later.

Features worth exploring next

• Caching rules to control which pages are cached at the edge and for how long.
• Security settings such as bot protection and basic firewall rules for login pages.
• Analytics that show DNS query volume and which hostnames receive the most traffic.
• API tokens for automating record changes, scoped to a single zone with only the permissions a tool needs.

Enable these gradually and test after each change, so you always know which setting caused a difference. The free plan covers the basics; paid plans add more rules and features, so check current plan details before upgrading.

Once things are stable, explore TTL tuning; proxied records use an automatic TTL, while DNS-only records let you choose. See our TTL guide for sensible values.