CloudFloor DNS Logo
CloudFloorDNS Icon

Why CloudFloorDNS for Managed DNS

Why CloudFloorDNS for Managed DNS

Every visit to your website, every email delivered to your domain, and every API call your customers make starts with a DNS lookup. When DNS is slow, everything feels slow. When DNS is down, everything is down. CloudFloorDNS has run authoritative DNS for more than 25 years, and this post lays out, with independent numbers where we have them, what you get when you make us your managed DNS provider.

Create a Free AccountJump to the API

1. Independently measured uptime, quality, and speed

We’d rather show you someone else’s measurements than our own marketing. DNSPerf tests authoritative DNS providers every minute from more than 200 locations worldwide and publishes the results. Here is where CloudFloorDNS stands among the 37 providers they track (last 30 days):

99.98%

Uptime, #7 of 37 worldwide

99.97%

Quality, #8 of 37 worldwide

14.93 ms

Avg. query speed, North America

18.88 ms

Avg. query speed, Europe

On uptime, that puts us ahead of Cloudflare, Amazon Route 53, and Google Cloud DNS (99.89%, 99.89%, and 99.72% over the same period). On quality, DNSPerf’s measure of how consistently a provider’s nameservers all answer correctly, we’re ahead of NS1, UltraDNS, and Route 53.

A note on reading these numbers

A few of the very largest networks answer a few milliseconds faster, and we won’t pretend otherwise. But recursive resolvers cache your records for the length of their TTL, so most of your visitors never wait on an authoritative lookup at all. What they will notice is an outage. That’s why we put reliability first, and why uptime and quality are the numbers we’re proudest of.

2. A global anycast network built for DNS

Our nameservers are announced from 15+ points of presence on four continents using anycast, so every query is routed to the nearest healthy node automatically. If a node or an entire region has a problem, traffic shifts to the next-closest location without anyone touching a thing.

  • 100% uptime SLA on our DNS network.
  • DDoS-aware by design: built-in protection and the spare capacity to absorb attack traffic.
  • Dual stack everywhere: IPv4 and IPv6 on every DNS and monitoring node.
  • One-click DNSSEC to sign your zones and protect them from spoofing.
  • Primary and secondary DNS with AXFR/IXFR, TSIG, and NOTIFY, so we can be your only provider or one of two.
  • Patented technology: our DNS Failover and GeoDNS load balancing are covered by US patent #20130297596.

3. Monitoring built in, not bolted on

Most DNS providers stop at answering queries. CloudFloorDNS includes Netmon, our monitoring platform, in the same account and the same panel. It watches the services behind your DNS records and, when something fails, it can change those records for you.

19+ test types

HTTP(S), ping, SMTP, POP, IMAP, FTP, SSH, DNS, TCP and UDP connect, SIP/VoIP, Cisco Expressway, SSL certificate expiration, and more.

Checks from multiple continents

Tests run from up to seven global locations, as often as every 10 seconds, so a local network blip isn’t mistaken for an outage.

Automatic DNS failover

When a check fails, Netmon can swap to a backup IP or CNAME, redirect to another URL, or serve a custom maintenance page, then switch back on recovery.

Alerts where you work

Email, SMS, webhooks, and syslog, with alert profiles and blackout windows so maintenance doesn’t page anyone.

4. DNS query statistics you can actually use

Your DNS traffic says a lot about your business: where your users are, which services they use, and when something unusual is happening. CloudFloorDNS gives you detailed query statistics for every zone, in the panel and through the API:

  • By time: hourly, daily, and date-range views to spot trends and traffic spikes.
  • By record: see which hostnames get the most queries, and which ones nobody uses anymore.
  • By country: understand where your audience is before you plan GeoDNS or a new region.
  • Account usage reports: track query volume against your plan so there are no surprises.

A sudden jump in queries for one record, or traffic from a country you don’t serve, is often the first sign of a misconfiguration or an attack. Having it in front of you means you find out early.

5. A management panel secured like it matters

Whoever controls your DNS controls your website, your email, and your certificates. The CloudFloorDNS panel is built around that fact.

Feature What it does for you
Single sign-on (SSO) SAML sign-in through your identity provider, including an Okta integration with SCIM user provisioning. When someone leaves, disabling them in your IdP removes their DNS access too.
Two-factor authentication (2FA) A second factor on every login, so a stolen password alone can’t reach your zones.
Groups and per-domain permissions Organize domains into groups and give each user access only to the domains and actions they need. Ideal for agencies, MSPs, and teams.
Account audit logs A record of who changed what and when, for troubleshooting and compliance.
Domain locks Update, delete, and transfer locks on registered domains to guard against hijacking.
Transfer controls TSIG-signed zone transfers and the option to restrict transfers to approved servers only.

6. A full-featured API for everything in your account

Anything you can do in the panel, you can automate. The CloudFloorDNS REST API is documented with an interactive OpenAPI reference and covers far more than DNS records:

Area What you can automate
DNS zones and records Create, update, and delete zones and records, including bulk updates and deletes; edit SOA; export zone files; add secondary zones and force zone transfers; convert between primary and secondary; manage DNSSEC and TSIG keys.
Query statistics Pull hourly, daily, date-range, per-record, and per-country statistics plus account usage reports into your own dashboards.
Monitoring and failover Add and edit Netmon tests, read status and logs, pause or resume tests and groups, force up/down or a re-test, enable each failover type, and manage alert profiles.
Branding and certificates Set up branded domain forwarding to an origin or URL, with HTTPS certificates (including wildcards) issued and renewed automatically through Let’s Encrypt, or upload and update your own certificate.
Domain registration Check availability and pricing, register, transfer, and renew domains; set auto-renew and registry locks; retrieve EPP codes; manage email and URL forwarding.
Account and access Manage groups and user permissions, read audit logs and transactions, and control SSO status.

Getting started takes one request. Authenticate with your API username and key over HTTPS:

# List every record in a zone
curl -u "USERNAME:API_KEY" \
  https://apiv3.mtgsy.net/api/v1/dns/zone/example.com/record

# Add an A record
curl -u "USERNAME:API_KEY" -X POST \
  -H "Content-Type: application/json" \
  -d '{"name":"www","type":"A","data":"203.0.113.10","aux":"0","ttl":3600}' \
  https://apiv3.mtgsy.net/api/v1/dns/zone/example.com/record

Using certbot? The certbot-dns-cloudfloordns plugin completes DNS-01 challenges against your CloudFloorDNS zones, so wildcard certificates renew themselves.

7. People who answer the phone

CloudFloorDNS is a specialist DNS company, not a cloud giant with a DNS product on the side. Support is staffed 24/7/365 by phone, email, and helpdesk, and the people who answer are the people who run the network. When something is wrong with your zone at 2 a.m., you talk to a DNS engineer.

Things worth knowing before you choose

We’re not the absolute fastest

A handful of hyperscale networks answer a few milliseconds quicker worldwide. If raw speed is your only criterion, they’ll edge us out. If uptime, monitoring, and support matter too, we’re a strong fit.

Features vary by plan

API access, failover counts, GeoDNS, DNSSEC, and monitoring intervals depend on the plan you choose. Our pricing page spells it out, and we’re happy to size a plan with you.

Ready to put your DNS on a network that’s measured, monitored, and supported by engineers?

Start with a free account, or send us your domain list and we’ll import your zones for you. Call +1 781 373 5823 or email sales@cloudfloordns.com.

Create a Free AccountManaged DNS plans

Performance figures are from DNSPerf’s public authoritative DNS provider rankings (raw performance, uptime, and quality), last 30 days as of October 19, 2026. DNSPerf is operated by DigiCert PerfOps and is not affiliated with CloudFloorDNS; results change hourly. Trademarks belong to their respective owners.

Related: Our anycast DNS network · Netmon monitoring plans · What is DNS failover? · Secondary DNS

A guide to Backup Cloudflare : Cloudflare and CloudFloorDNS as Secondary

For Cloudflare customers

You don’t have to leave Cloudflare to stop depending on it alone. Running CloudFloorDNS as a backup (secondary) authoritative DNS provider means that if Cloudflare’s DNS has a bad day, resolvers simply ask our nameservers instead and your domain keeps answering. This guide walks through the setup step by step, including the one registrar situation that stops it cold.

See the setup stepsIs Cloudflare your registrar?

Why add a second DNS provider?

One DNS provider is one failure domain, no matter how big it is. When your only authoritative DNS stops answering, whether from a bad config push, a software bug, or an attack, every service on your domain goes dark with it: website, email, APIs, VPN. With both providers listed as nameservers, recursive resolvers automatically retry the other set if one doesn’t answer. There’s nothing to flip during an outage, and nobody has to be awake.

Special note: is Cloudflare your domain registrar?

If your domain is registered with Cloudflare, it must be transferred to another registrar before you can add a backup DNS provider.

Domains registered through Cloudflare Registrar are required to use Cloudflare’s nameservers. Cloudflare’s policy does not allow any other provider’s nameservers in the delegation, so there is no way to list CloudFloorDNS alongside Cloudflare while the domain is registered there. Cloudflare’s own documentation states that to use a different DNS provider, you have to transfer the domain away from Cloudflare.

This only affects where the domain is registered. You can keep Cloudflare for DNS, CDN, WAF, and everything else. Most other registrars, including CloudFloorDNS domain registration, support multiple sets of nameservers without any trouble.

  • Not sure who your registrar is? Run whois example.com | grep -i registrar. If it says Cloudflare, Inc., this applies to you.
  • Transferring out is standard: in the Cloudflare dashboard, unlock the domain and copy the authorization (EPP) code, then start the transfer at your new registrar. It completes when you approve it, or automatically after five days.
  • Watch the 60-day rule: a domain can’t be transferred if it was registered, transferred, or had its registrant details changed in the last 60 days.
  • Keep Cloudflare’s nameservers during the transfer. Don’t change delegation mid-transfer. Once the domain lands at the new registrar, continue with step 7 below.

Moving the domain to us? We’ll walk you through the transfer so your existing nameservers stay in place the whole time: support@cloudfloordns.com

Pick your setup: two ways to run CloudFloorDNS beside Cloudflare

Which one you use depends on your Cloudflare plan. Cloudflare only offers outgoing zone transfers (Cloudflare acting as primary for another provider) on Enterprise plans. If you’re on Free, Pro, or Business, Option B gets you the same resilience with a sync step.

Option A: Cloudflare primary, CloudFloorDNS secondary Option B: Dual primary, synced
Cloudflare plan Enterprise (outgoing zone transfers enabled by your Cloudflare account team) Any plan
How records get to us AXFR / IXFR zone transfers, signed with TSIG Zone file exported from Cloudflare, imported into CloudFloorDNS, then kept in sync via API
When you change a record Cloudflare sends a NOTIFY and we pull the change within seconds, automatically Your sync job (or you) pushes the same change to us
Where you edit records Cloudflare only Cloudflare, with CloudFloorDNS kept identical
Best for Enterprise zones that change often Smaller zones, or zones that rarely change

Either way, the end state is the same: your domain is delegated to both Cloudflare’s and CloudFloorDNS’s nameservers, and both answer with identical data.

Setup steps

The rule that makes this safe is simple: never add a nameserver to your delegation until it is already answering correctly for your zone. Every step below builds toward that.

1

Check where your domain is registered

If your registrar is Cloudflare, stop here and transfer the domain to another registrar first (see the special note above). Everything else on this page depends on being able to list more than one provider’s nameservers, and Cloudflare Registrar doesn’t allow it.

# Who is the registrar?
whois example.com | grep -i "registrar:"

# Which nameservers are delegated today?
dig NS example.com +short
2

Sign up and add your zone to CloudFloorDNS

Create an account and choose a plan, then add the domain in the control panel. The panel shows the nameservers assigned to your zone and our transfer IP addresses; keep both handy.

Option A (Enterprise): add the domain as a Secondary zone and enter Cloudflare’s transfer address, 172.65.64.6, as the primary (master) server. Cloudflare sends NOTIFY messages from 104.30.167.163, 104.30.167.173, and 2a09:bac0:1000:c47::/64.

Option B (any plan): in Cloudflare, open DNS → Records → Import and Export and export the zone file. Add the domain in CloudFloorDNS as a primary zone and import the file, or send it to support and we’ll import it and send back a record report.

3

Connect the two providers

Option A (Enterprise):

  1. Create a TSIG key (recommended). Use the same name, algorithm (for example hmac-sha256), and secret on both sides. The name must match exactly or transfers will fail.
  2. Create a peer in your Cloudflare account’s DNS Settings, under DNS Zone Transfers. Enter the CloudFloorDNS IP from our panel, port 53, and link the TSIG key.
  3. Link the peer to your zone, then enable outgoing zone transfers in the zone’s DNS settings. Cloudflare sends a NOTIFY right away and we pull the full zone.

Option B (any plan): set up a way to keep the zones identical. For zones that rarely change, updating both dashboards is enough. For anything busier, use a scheduled job that reads your records from the Cloudflare API and writes them to the CloudFloorDNS API. We’re happy to help you set one up.

Proxied (orange-cloud) records: a Cloudflare export contains your origin IP addresses. Publishing those from a second provider would send visitors around Cloudflare’s proxy, WAF, and cache, and would expose your origin. For proxied hostnames, publish the Cloudflare edge addresses that Cloudflare’s nameservers currently return instead. Option A handles this for you automatically.

4

Verify we answer exactly like Cloudflare

Query our nameservers directly and compare against Cloudflare’s. The SOA serials should match (Option A), and every record you care about should return the same answer. Nothing is live on our side yet, so take your time.

# Use one of the two nameservers Cloudflare assigned to your zone
dig @ada.ns.cloudflare.com example.com SOA +short
dig @ns1.cloudfloordns.com example.com SOA +short

# Spot-check the records that matter most
dig @ns1.cloudfloordns.com example.com A +short
dig @ns1.cloudfloordns.com example.com MX +short
dig @ns1.cloudfloordns.com example.com TXT +short
dig @ns1.cloudfloordns.com www.example.com A +short
5

Tell Cloudflare about the second provider

In the Cloudflare zone, add NS records at the apex (@) for each CloudFloorDNS nameserver. By default Cloudflare ignores apex NS records, so also turn on Multi-provider DNS in the zone’s DNS settings. With it enabled, Cloudflare returns both sets of nameservers in its answers and keeps the zone active when your registrar lists nameservers from another provider.

On our side, the zone’s NS records list both Cloudflare’s and our nameservers, so both providers publish the same NS set.

Can’t find Multi-provider DNS in your dashboard? Ask Cloudflare support whether it’s available on your plan before going further. Without it, Cloudflare may not keep the zone active once other providers’ nameservers appear at the registrar.

6

If you use DNSSEC, set up multi-signer first

A signed zone served by two providers needs both providers’ keys published in the zone and both DS records at the registrar, a setup known as multi-signer DNSSEC (RFC 8901). Cloudflare supports it, and it has to be in place before you change delegation; otherwise validating resolvers will reject answers from whichever provider they can’t verify. Talk to us before this step and we’ll plan the key exchange with you. If your zone isn’t signed today, skip this step.

7

Add CloudFloorDNS nameservers at your registrar, alongside Cloudflare’s

At your registrar, add our nameservers to the list. Don’t remove Cloudflare’s. Once the change is published, the registry hands out both sets and resolvers use whichever answers. Confirm it at the source:

# Ask the .com registry what it delegates (use your TLD's servers for other TLDs)
dig NS example.com @a.gtld-servers.net +norec

# Both providers should now show in the answer
dig NS example.com +short

That’s it. From here on, keep editing records in Cloudflare as you always have.

What Cloudflare sends us, and what it doesn’t

Cloudflare publishes how outgoing zone transfers treat its special record types. Most of it works in your favor, but a few records don’t transfer at all, and it’s better to know that now.

In your Cloudflare zone What CloudFloorDNS serves (Option A) What to do
Proxied (orange-cloud) A / AAAA / CNAME Two A and two AAAA records pointing at Cloudflare’s edge Nothing. Traffic still goes through Cloudflare’s proxy and your origin stays hidden.
DNS-only CNAME at the apex (flattened) The resolved IP addresses Nothing, but note these are a snapshot refreshed on each transfer.
DNS-only CNAME on a subdomain The CNAME itself (or flattened IPs if “flatten all CNAMEs” is on) Nothing.
CAA records Not transferred If you use CAA to restrict certificate issuance, tell us and we’ll help you match them.
Certificate-validation TXT records Not transferred Usually fine. These belong to Cloudflare and are only needed briefly.
DNS-only Load Balancing records Not transferred Proxied load balancers transfer normally. For DNS-only ones, ask us about DNS Failover as the equivalent.

Source: Cloudflare’s published documentation on outgoing zone transfers, as of September 2026.

Things worth knowing before you start

Backup DNS protects DNS, not Cloudflare’s proxy

If Cloudflare’s nameservers stop answering, we keep your domain resolving. Proxied hostnames still resolve to Cloudflare’s edge, though, so if the proxy itself is down, those sites are down too. DNS-only records (mail, VPN, APIs pointed straight at your servers) get the full benefit.

Cloudflare Registrar is a hard stop

We can’t work around it and neither can Cloudflare support. Domains registered with Cloudflare must use only Cloudflare’s nameservers, so the domain has to move to another registrar before a backup provider can be added.

Automatic sync needs Cloudflare Enterprise

Zone transfers out of Cloudflare are an Enterprise feature. On other plans Option B works well, but you or a scheduled job has to keep both zones identical. A backup that’s out of date gives inconsistent answers, which is worse than no backup.

DNSSEC takes a little more planning

Signed zones need multi-signer DNSSEC across both providers before the second set of nameservers goes live. It’s well understood and we’ve done it before, but it’s a step you can’t skip.

Send us a domain that’s on Cloudflare today. We’ll tell you which setup fits and get the backup running.

Secondary DNS starts at $40 a month for 10 domains. If your domain is registered with Cloudflare, we’ll help you move the registration too, with no change to your DNS during the transfer. Call +1 781 373 5823 or email sales@cloudfloordns.com.

Create a Free AccountSecondary DNS plans

CloudFloorDNS is an independent company and is not affiliated with Cloudflare, Inc. Cloudflare features, plan availability, and policies referenced on this page come from Cloudflare’s public documentation as of September 2026 and may change; please confirm current terms with Cloudflare directly. Trademarks belong to their respective owners.

Related: Secondary DNS with Cloudflare as your primary · Secondary DNS overview & pricing · Why use secondary DNS?