Editing a Cloudflare DNS record and verifying authoritative answers

Confirm the Cloudflare account, domain and record type. Save the old value, proxy status and TTL, and obtain the destination from the service you are connecting.

1. Open the domain’s DNS > Records page and locate the exact name and type.
2. Choose Edit for an existing record or Add record for a genuinely new one. Avoid creating a second record when the intended change is a replacement.
3. Enter the required value and select the appropriate proxy status for supported A, AAAA or CNAME records. Mail and other non-web services normally need DNS only.
4. Save, then query an authoritative nameserver and compare with a normal recursive lookup. Proxied web records normally return Cloudflare addresses publicly, which is expected.
5. Test the actual website, mail or verification service and retain the previous value until the change has been confirmed.

After changing an address record, use the actual nameserver assigned to the active Cloudflare zone. In this example, ns1.example.net is a placeholder for that assigned server, and www.example.com is the record being checked. These commands inspect DNS and do not change it.

dig @ns1.example.net www.example.com A
dig www.example.com A

The first query targets the chosen authoritative server; the second uses your normal resolver configuration. Compare the status, answer and TTL, and check which server responded. A recently changed record can appear differently while a resolver still holds its earlier answer.

Expected result: the authoritative answer reflects the current record policy. For a proxied hostname, public Cloudflare addresses are expected, so also inspect the dashboard Content field for the intended origin. Repeat with AAAA only when investigating IPv6 records, then test the actual connected service.

The authoritative response and connected service should reflect the intended change. Cached resolver answers may remain temporarily according to the previous TTL.

If an unexpected answer persists, check nameserver delegation, duplicate A/AAAA records, CNAME conflicts and whether you edited the correct zone. Partner-managed Cloudflare setups may require changes through the hosting partner’s interface.

Visitors connect to Cloudflare’s proxy addresses, which then contact the configured origin. Inspect the record’s Content field to verify the origin destination rather than expecting it in a public A lookup.

• Keeping mail and FTP hostnames outside Cloudflare’s web proxy
• Exporting a Cloudflare DNS zone before migration
• Changing the hosting origin behind an existing Cloudflare proxy
• Enabling Cloudflare DNSSEC with the correct registrar DS record

• Cloudflare: Create DNS Records
• Cloudflare: Proxy Status

• BIND dig DNS lookup utility