Cloudflare migration

From legacy edge to Cloudflare, safely.

Tap a node on either side to focus the flow.

FROMNANOSEKCLOUDFLAREDiscoveryMappingCutoverOperateAkamaiImpervaFastlyCloudFrontOn-prem WAF / F5DNSCDN / CacheWAFBot MgmtZero TrustWorkersLogpush

Migration flow

From Akamai, through Discovery → Mapping → Cutover → Operate, into the Cloudflare destinations on the right. Tap any node to focus the flow.
Plan your DNS migration View DNS migration checklist
On this page
AI summary Machine-readable context is available at /ai-index.json

Nanosek provides Cloudflare DNS migration services for organizations moving authoritative DNS zones, DNS records, nameservers, certificates, email records, SaaS verification records, DNSSEC, CDN proxy status, and DNS operations to Cloudflare. The service includes discovery, record inventory, risk review, TTL planning, Cloudflare zone setup, proxy decision mapping, email and third-party validation, nameserver cutover, rollback design, and managed DNS operations after migration.

cloudflaredns migrationauthoritative dnsnameserver cutoverdnssecemail recordsmx recordsspf dkim dmarc

Who this is for

Infrastructure, platform, security, application, IT operations, SaaS, and enterprise teams moving authoritative DNS to Cloudflare.
Organizations with many domains, delegated subdomains, SaaS records, email records, certificates, DNSSEC, or business-critical hostnames.
Teams that need DNS migration connected to Cloudflare CDN, WAF, DDoS protection, certificate readiness, rollback, and managed operations.

Why DNS migration needs careful planning

Website and application availability

A missed record or wrong hostname mode can break public websites, APIs, mobile applications, admin portals, or origin routing.

Email delivery continuity

MX, SPF, DKIM, DMARC, provider TXT records, and routing dependencies must be preserved exactly to avoid mail disruption.

SaaS and third-party service validation

Many platforms depend on TXT or CNAME verification records that can fail if records are omitted or proxied incorrectly.

Certificate validation readiness

CAA records, validation CNAMEs, Universal SSL, Advanced Certificate Manager, and custom certificates need review before hostnames are proxied.

Correct proxy status decisions

Not every hostname belongs behind Cloudflare proxy. Nanosek classifies public web, API, SaaS, email, origin, and delegated records separately.

DNSSEC and registrar coordination

DNSSEC changes require careful DS record handling between Cloudflare and the registrar to avoid validation failures.

Rollback planning

Nameserver rollback needs previous values, TTL expectations, validation criteria, decision owners, and a clear change window.

Post-migration governance

DNS needs ownership, audit trails, change review, documentation, and managed operations after the initial cutover.

Common DNS migration risks

DNS migrations fail when inventory, ownership, and cutover sequencing are weak. Production zones often contain years of accumulated dependencies: web hostnames, email records, SaaS verification records, delegated subdomains, TXT records, CNAMEs, API endpoints, certificate validation records, CDN records, and security records.

Missing records during importIncorrect proxy statusBroken MX records or email routingBroken SPF, DKIM, or DMARC alignmentLost SaaS verification TXT recordsCAA records blocking certificate issuanceDNSSEC mismatch at the registrarDelegated subdomains not preservedLow TTLs not prepared before cutoverWrong origin exposure assumptionsConflicting apex or wildcard recordsNo tested rollback procedure

Our Cloudflare DNS migration methodology

Phase 1

DNS discovery and inventory

  • Export current DNS zones and collect authoritative nameservers, registrar details, TTLs, record types, delegated subdomains, email records, SaaS verification records, certificate records, and application-critical hostnames.
  • Identify ownership for each critical service.
Phase 2

Risk review and migration plan

  • Classify records by business function: websites, APIs, email, SaaS, identity, certificates, internal systems, monitoring, and delegated subdomains.
  • Identify high-risk records and records that should remain DNS-only instead of proxied.
Phase 3

Cloudflare zone preparation

  • Create or prepare Cloudflare zones and import DNS records.
  • Review proxy status for each hostname and configure SSL/TLS mode, certificate settings, DNSSEC plan, and account-level ownership.
Phase 4

Validation before nameserver cutover

  • Compare current DNS against Cloudflare DNS.
  • Validate web hostnames, email records, TXT records, CAA records, delegated NS records, certificate records, third-party SaaS records, TTL strategy, and rollback steps.
Phase 5

Nameserver cutover

  • Coordinate registrar changes and monitor propagation.
  • Validate critical records from multiple resolvers and watch website, email, API, and SaaS service health.
Phase 6

Post-cutover verification

  • Confirm DNS resolution, SSL/TLS certificates, email delivery, CDN proxy behavior, SaaS validations, delegated subdomains, and DNSSEC status.
  • Remove obsolete records only after validation.
Phase 7

Managed DNS operations

  • Establish change workflow, ownership model, monitoring, audit process, documentation, and managed Cloudflare support.

What we migrate to Cloudflare DNS

Authoritative DNS zones, apex records, subdomain records, wildcard DNS records, delegated subdomains, and partial CNAME setups where required.
A, AAAA, CNAME, TXT, MX, SRV, CAA, NS records, SaaS verification records, certificate validation records, and third-party service dependencies.
Email records including MX, SPF, DKIM, DMARC, provider-specific TXT records, routing dependencies, and security policy records.
Cloudflare proxied and DNS-only decisions, DNSSEC configuration, SSL/TLS settings, Universal SSL or custom certificates, and operational ownership.
DNS templates, change workflows, monitoring expectations, audit process, documentation, and managed DNS operations.

Cloudflare DNS controls we use

Cloudflare authoritative DNS

Used to host production zones, serve records globally, and centralize DNS changes in Cloudflare.

Full zone onboarding

Used when Cloudflare becomes authoritative for the entire domain through nameserver delegation.

Partial CNAME setup

Used when selected hostnames should use Cloudflare while DNS authority remains elsewhere.

Proxied DNS records

Used for web and API hostnames that should receive Cloudflare CDN, WAF, DDoS, TLS, cache, and logging controls.

DNS-only records

Used for MX, TXT, many SaaS records, delegated NS records, and hostnames that should not pass through the Cloudflare proxy.

DNSSEC

Used to protect DNS integrity when DS records and registrar coordination can be handled safely.

Universal SSL

Used to provide baseline certificate coverage for proxied hostnames.

Advanced Certificate Manager

Used for custom coverage, wildcard needs, validation control, and enterprise certificate requirements.

CAA records

Used to control which certificate authorities can issue certificates for the domain.

Load Balancing

Used when DNS migration is tied to origin pools, failover, or traffic steering.

Health Checks

Used to validate origin availability for load balancing or operational monitoring.

Origin Rules

Used after proxying when backend Host header, SNI, port, or origin routing behavior needs explicit control.

Redirect Rules

Used when DNS migration also exposes redirect cleanup or hostname consolidation work.

Email security records

Used to preserve and validate MX, SPF, DKIM, DMARC, and provider-specific policy records.

Cloudflare API

Used for repeatable imports, validation, reporting, and controlled operational workflows.

Terraform automation

Used when DNS records and zone configuration should be reviewable and managed as code.

Audit logs

Used to track DNS and zone changes after migration.

Zone settings and account governance

Used to define ownership, access, standards, and change control across Cloudflare accounts and zones.

Proxy or DNS-only decision framework

Public websites

Recommended mode

Usually proxied

Reason

Enables CDN, WAF, DDoS, TLS, cache, and performance controls.

APIs

Recommended mode

Usually proxied, with API-specific controls

Reason

Enables WAF, rate limiting, API Shield, mTLS, logging, and DDoS protection.

Email MX records

Recommended mode

DNS-only

Reason

Mail traffic is not proxied through Cloudflare CDN.

SaaS verification records

Recommended mode

DNS-only

Reason

TXT and CNAME verification must remain reachable as expected.

Third-party SaaS application CNAMEs

Recommended mode

Usually DNS-only unless Cloudflare proxying is supported

Reason

Avoid breaking SaaS hostname validation or TLS behavior.

Origin-only hostnames

Recommended mode

Usually DNS-only or restricted

Reason

Avoid exposing sensitive origins unintentionally.

Internal/private records

Recommended mode

Review carefully

Reason

Internal names should not be moved blindly into public DNS.

Delegated subdomains

Recommended mode

DNS-only NS delegation

Reason

Preserve authoritative control for child zones.

Admin portals

Recommended mode

Often proxied with Access/WAF controls

Reason

Enables identity-aware access and application security controls.

DNS record migration mapping

DNS record migration mapping

DNS area

A / AAAA records

Cloudflare handling

Proxied or DNS-only records

Migration notes

Decide per hostname based on whether Cloudflare should inspect and accelerate traffic.

DNS area

CNAME records

Cloudflare handling

Proxied or DNS-only records

Migration notes

Validate SaaS, CDN, and application CNAMEs carefully before proxying.

DNS area

MX records

Cloudflare handling

DNS-only

Migration notes

Never proxy MX records; validate email delivery after migration.

DNS area

TXT records

Cloudflare handling

DNS-only

Migration notes

Preserve SPF, DKIM, DMARC, SaaS verification, and certificate validation records.

DNS area

CAA records

Cloudflare handling

DNS-only

Migration notes

Confirm certificate authorities are allowed before Cloudflare or custom certificates are issued.

DNS area

NS records

Cloudflare handling

Delegated subdomains

Migration notes

Preserve subdomain delegation exactly where required.

DNS area

SRV records

Cloudflare handling

DNS-only

Migration notes

Validate service discovery dependencies.

DNS area

Wildcard records

Cloudflare handling

Proxied or DNS-only

Migration notes

Review carefully to avoid unexpected routing or certificate behavior.

DNS area

Apex records

Cloudflare handling

Cloudflare DNS and optional proxy

Migration notes

Confirm flattening behavior and application impact.

DNS area

DNSSEC

Cloudflare handling

Cloudflare DNSSEC plus registrar DS record

Migration notes

Coordinate DS record changes carefully.

DNS area

Email security

Cloudflare handling

SPF, DKIM, DMARC

Migration notes

Validate syntax and alignment before and after cutover.

DNS area

Certificates

Cloudflare handling

Universal SSL, ACM, custom certs, validation records

Migration notes

Confirm certificate coverage before proxying production hostnames.

Cutover checkpoints

  • Confirm registrar access, previous nameservers, current authoritative nameservers, and rollback nameserver values before the window.
  • Lower TTLs where appropriate and compare Cloudflare DNS against the current zone before nameserver changes.
  • Coordinate nameserver changes, monitor propagation, and validate critical records from multiple resolvers.
  • Keep rollback owners, decision criteria, and post-cutover validation owners visible during the cutover.

Validation signals

  • Web, API, email, SaaS, certificate, and delegated-subdomain records resolve as expected.
  • MX, SPF, DKIM, DMARC, CAA, TXT, NS, wildcard, apex, and proxied hostnames match the approved record matrix.
  • SSL/TLS certificates are active for proxied production hostnames.
  • DNSSEC status is valid and no critical service health checks regress after cutover.

Deployment steps

  1. 01 Export current DNS zones and identify authoritative nameservers, registrar access, TTLs, record types, delegated subdomains, email records, SaaS records, certificate records, and application-critical hostnames.
  2. 02 Classify records by business function and decide which hostnames should be proxied or DNS-only.
  3. 03 Prepare Cloudflare zones, import records, review SSL/TLS, plan DNSSEC, and define account ownership.
  4. 04 Compare current DNS against Cloudflare DNS and validate email, SaaS, CAA, TXT, NS, certificate, wildcard, and apex records.
  5. 05 Coordinate nameserver cutover at the registrar and monitor DNS propagation.
  6. 06 Validate applications, APIs, email delivery, certificates, SaaS services, delegated subdomains, and DNSSEC after cutover.
  7. 07 Establish managed DNS operations, documentation, audit process, and change workflow.

Risks and mitigations

Risk

Missing DNS records.

Mitigation

Export, compare, and validate records before nameserver cutover.

Risk

Wrong proxy status.

Mitigation

Review each hostname and classify as proxied or DNS-only.

Risk

Email disruption.

Mitigation

Preserve MX, SPF, DKIM, DMARC, and provider-specific records.

Risk

SaaS verification failure.

Mitigation

Preserve TXT/CNAME verification records and avoid proxying unsupported SaaS CNAMEs.

Risk

Certificate issuance blocked.

Mitigation

Review CAA records and prepare Cloudflare certificates before cutover.

Risk

DNSSEC outage.

Mitigation

Coordinate DNSSEC changes between Cloudflare and registrar carefully.

Risk

Delegated subdomains broken.

Mitigation

Preserve NS records and validate child-zone resolution.

Risk

Propagation confusion.

Mitigation

Lower TTLs, track resolver behavior, and validate from multiple networks.

Risk

Rollback not possible.

Mitigation

Document previous nameservers and rollback decision criteria.

Risk

Accidental origin exposure.

Mitigation

Review proxied hostnames, origin hostnames, and direct DNS records.

DNS migration validation checklist

  • Current authoritative nameservers identified
  • Registrar access confirmed
  • Current DNS zone exported
  • All record types inventoried
  • Critical hostnames classified
  • Email records reviewed
  • SPF, DKIM, and DMARC validated
  • SaaS verification records preserved
  • Certificate validation records preserved
  • CAA records reviewed
  • Delegated subdomains preserved
  • Wildcard records reviewed
  • Proxy status decided per hostname
  • SSL/TLS mode reviewed
  • Universal SSL or custom certificates ready
  • DNSSEC plan confirmed
  • TTLs lowered before cutover where appropriate
  • Cloudflare DNS compared against current DNS
  • Rollback nameservers documented
  • Post-cutover validation owners assigned

Deliverables

  • DNS current-state inventory
  • DNS risk register
  • Record classification workbook
  • Proxy vs DNS-only decision matrix
  • Cloudflare zone preparation
  • DNSSEC migration plan
  • Email record validation
  • Certificate readiness review
  • Nameserver cutover runbook
  • Rollback runbook
  • Post-cutover validation report
  • Managed DNS operations handover

When Nanosek should help

You are moving authoritative DNS to Cloudflare.
You have many domains, subdomains, or business-critical records.
You cannot risk breaking email, SaaS tools, APIs, or certificates.
You need to decide which hostnames should be proxied.
You have delegated subdomains or DNSSEC enabled.
You need a rollback plan before changing nameservers.
You want DNS migration connected to CDN, WAF, DDoS, and managed Cloudflare operations.

Frequently asked questions

What is a Cloudflare DNS migration?
A Cloudflare DNS migration is the process of moving authoritative DNS management for a domain to Cloudflare. It includes importing records, validating hostnames, planning proxy status, reviewing email and SaaS records, configuring DNSSEC where needed, changing nameservers, and verifying services after cutover.
Is DNS migration just changing nameservers?
No. Changing nameservers is only the cutover step. The important work is inventorying records, validating dependencies, preparing Cloudflare zones, deciding which records should be proxied, preserving email and SaaS records, planning DNSSEC, and documenting rollback.
Will email continue working after moving DNS to Cloudflare?
Yes, if MX, SPF, DKIM, DMARC, and provider-specific records are preserved correctly. Nanosek validates email records before and after cutover.
Which DNS records should be proxied through Cloudflare?
Public web and API hostnames are often proxied to use Cloudflare CDN, WAF, DDoS, TLS, and logging controls. Email, TXT, MX, many SaaS verification records, and delegated NS records should remain DNS-only.
Can Cloudflare DNS migration break certificates?
Yes, if certificate validation records are missing, CAA records are incorrect, or hostnames are proxied before certificates are ready. Nanosek reviews certificate readiness before production cutover.
How do you handle DNSSEC?
DNSSEC must be coordinated between Cloudflare and the registrar. Nanosek reviews the current DNSSEC state, prepares the Cloudflare DNSSEC configuration, and coordinates DS record changes carefully.
Can we roll back a DNS migration?
Yes, if rollback is planned. Nanosek documents previous nameservers, TTL strategy, rollback steps, decision criteria, and validation checks before cutover.
What is the difference between full zone and partial CNAME setup?
Full zone setup moves authoritative DNS to Cloudflare nameservers. Partial CNAME setup lets selected hostnames use Cloudflare while DNS authority remains elsewhere. The right model depends on ownership, risk, and migration scope.
Can Nanosek manage Cloudflare DNS after migration?
Yes. Nanosek provides managed Cloudflare operations, including DNS changes, governance, validation, security review, documentation, and ongoing support.

Move DNS to Cloudflare safely

Nanosek helps you migrate DNS with the right inventory, validation, cutover plan, rollback path, and operational model so applications, email, certificates, and SaaS services keep working.

Talk to Nanosek View Cloudflare services
Ready to talk?

Deliver Cloudflare without surprises.

Whether you're migrating, hardening, or operating Cloudflare — Nanosek brings authorized MSP & ASDP delivery, rollback-ready cutovers, and managed operations after launch.

Talk to Nanosek Run readiness assessment