Guides · 20 October 2026 · 7 min read

What to check before moving DNS to Cloudflare

Moving a domain's DNS to Cloudflare is usually a 15-minute job, and that's exactly why it goes wrong. The website comes back up, everyone moves on, and three days later the client asks why their invoices stopped arriving or why Google Search Console says the site is "unverified".

The site loading proves very little. The records that break quietly are the ones nobody looks at: email, verification tokens, and the odd subdomain someone set up years ago. Here's what to check before you change the nameservers.

1. Get a full copy of the current DNS first

When you add a domain, Cloudflare runs a quick scan and imports the records it finds. Cloudflare's own docs say this scan isn't guaranteed to find every record. DNS has no "list everything" command, so a scan can only find names it thinks to ask about.

Do this: export the zone from the current provider (often called "Export zone file", "BIND export" or "Download DNS records"). If they don't offer an export, screenshot every page of the DNS editor. This is your source of truth.

2. Compare the old and new records, line by line

Put the export next to Cloudflare's imported list and look for anything missing. The usual suspects:

• Verification TXT records (Google, Microsoft 365, Facebook, Apple, domain validation for SSL). Losing one rarely breaks anything immediately, but weeks later a service quietly marks the domain "unverified".
• Subdomains on other platforms: shop. (Shopify), blog. (Ghost, Webflow), help. (Zendesk), status pages, old staging sites.
• DKIM records, usually something like selector._domainkey. They live on names a scan can't guess, so they're often the first casualty.
• SRV and CAA records, used for things like Teams or SIP, and for limiting which certificate authorities may issue for the domain.

Comparing by eye gets slow fast, because the same record can be written differently (trailing dots, uppercase, TXT split into chunks). That's what Klockie Migrate does: paste both exports and it lists exactly what's Missing, Changed or Added, comparing meaning rather than text. It runs in your browser, so the files aren't uploaded.

3. Check every email record, and keep it grey-clouded

Email is where most "it worked yesterday" calls come from. Before switching, confirm these exist in Cloudflare with exactly the values your email provider gives you:

• MX records, with the right priorities.
• SPF, the TXT record starting v=spf1. Make sure every service that sends as the domain is still included, such as the newsletter tool or the invoicing app. A dropped include: doesn't bounce email; it just quietly pushes it into spam.
• DKIM, from step 2.
• DMARC, at _dmarc.
• Any A record your mail uses, such as mail.

Cloudflare's docs are clear that email records should be DNS only (grey cloud), not proxied. Cloudflare's proxy handles web traffic, not mail.

4. Decide the orange cloud deliberately, record by record

"Proxied" (orange cloud) sends web traffic through Cloudflare; "DNS only" (grey) just answers with the record. Rules of thumb:

• Your main website and www: usually proxied, which is the point of Cloudflare.
• Mail hosts, FTP/SSH hosts, and CNAMEs that point to verification targets or third-party platforms: usually DNS only. Some platforms check that the CNAME resolves directly to them and fail when it's proxied.

Once proxied, a record answers with Cloudflare's IP addresses, not your server's. That's expected, but it confuses people checking afterwards ("the A record is wrong!"). Note which records you proxied.

5. The root domain and CNAMEs

If the old provider used an "ALIAS" or "ANAME" record at the root (for example pointing to a hosting platform), Cloudflare handles this with a CNAME at the root, which it flattens automatically. That's fine, but double-check the final address the root resolves to after the switch.

6. Turn off DNSSEC at the registrar first

If the domain has DNSSEC enabled, Cloudflare's docs say you must turn it off at your registrar before replacing the nameservers. Changing nameservers with DNSSEC still on can make the domain unreachable. Turn it back on through Cloudflare once the domain is active.

7. Write down the "before" state

Before you touch the nameservers, run a quick check of the live domain and save the result:

• Does the site load over HTTPS, and do http:// and www. end up in the same place?
• Does the domain have MX, SPF and DMARC records?
• Are the security headers as expected?

A Klockie Check does all of this in about 10 seconds, and you can share the result with your client. Then you have proof of what worked before the change.

8. Change the nameservers, exactly

Copy Cloudflare's two assigned nameservers exactly as shown. Cloudflare warns that a typo here means the DNS won't resolve. Remove the old nameservers at the registrar rather than adding Cloudflare's alongside them. The change can take up to 24 hours. Public lookup tools often show old results for a while because of caching, so don't panic in the first hour.

9. Check again after the switch, and a few days later

Once Cloudflare shows the domain as Active, run the same check again and compare it with your "before" result:

• Does email still arrive? Send a test message from an outside address.
• Do the subdomains from step 2 still work?
• Are the verification records still there?

Then check once more a few days later. Some failures, like a lost verification token or a certificate that can't renew, only show up after a delay.

The short version

1. Export the current zone; don't rely only on Cloudflare's scan.
2. Compare old and new, and look for verification TXT, subdomains, DKIM, SRV and CAA.
3. Check MX, SPF, DKIM and DMARC, and keep email records grey-clouded.
4. Choose proxied versus DNS-only on purpose.
5. Check the root domain's final address.
6. Turn DNSSEC off at the registrar before switching.
7. Save a "before" check.
8. Copy the nameservers exactly; allow up to 24 hours.
9. Check again after, and a few days later.

Already switched and email stopped working? See Email stopped working after changing nameservers.

Sources: Cloudflare's Full setup documentation.