Cloudflare can become the authoritative DNS provider and proxy eligible web traffic while the website remains on its hosting service. A careful DNS inventory is essential because automatic record discovery may omit mail, verification or less common hostnames.
IN THIS ARTICLE
Check access and requirements
Export the existing DNS zone and identify website A/AAAA records, www, MX, mail hosts, SPF, DKIM, DMARC and other verification records. Confirm access to the registrar and check the current DNSSEC state before changing nameservers.
01 Connect a hosted domain to Cloudflare without breaking email
- In the Cloudflare dashboard, choose the domain-onboarding option, enter the registered domain and select the appropriate available plan.
- Review every imported DNS record against the existing zone. Add missing records manually and use the hosting service’s correct destinations.
- Proxy only eligible website hostnames. Keep mail-server hostnames and unsupported services DNS-only, and preserve the provider’s MX and authentication records.
- Follow Cloudflare’s DNSSEC transition instructions. Remove the old registrar DS record when required before switching nameservers, then replace the registrar nameservers with the exact pair Cloudflare assigns.
- Wait for activation, review the origin certificate and SSL/TLS mode, and test websites and email. Enable Cloudflare DNSSEC afterward through the proper new DS workflow if desired.
02 Example: a DNS inventory before switching nameservers
For a business website using separate email hosting, prepare this short inventory before changing the registrar nameservers. Copy the actual values from the currently working DNS zone and the email provider. The entries below describe record purposes, not Nabtech server addresses.
| Record or service | What to preserve and check |
|---|---|
| Website root and www | Copy the correct destination. Proxy compatible HTTP/HTTPS traffic after checking the website configuration. |
| Mail server hostname | Preserve its destination and keep its address record DNS-only for ordinary mail connections. |
| MX records | Keep the provider targets and priorities exactly as supplied. |
| SPF, DKIM and DMARC | Compare each existing name and value; preserve verification records too. |
Expected result: the new zone contains the complete service inventory before the switch. After activation, test a website visit, an incoming message and an outgoing message separately.
Confirm the expected result
Confirm authoritative nameservers, website HTTPS and two-way email from independent networks. A working homepage does not prove all DNS records survived the move.
What should I check if connecting Cloudflare breaks DNS or email?
If the domain returns DNSSEC failures, investigate stale DS information before editing random A records. If email fails, check DNS-only mail hosts, MX values and local routing. Keep the original zone export and migration access until the transition is verified.
.png)
 (1).jpg)
 (1) (1).png)
 (1).png)
.jpg)
.jpg)
 (1).jpg)
.jpg)
