Blog

Check where your domain is registered

If your registrar is Cloudflare, stop here and transfer the domain to another registrar first (see the special note above). Everything else on this page depends on being able to list more than one provider’s nameservers, and Cloudflare Registrar doesn’t allow it.

# Who is the registrar?
whois example.com | grep -i "registrar:"

# Which nameservers are delegated today?
dig NS example.com +short

Sign up and add your zone to CloudFloorDNS

Create an account and choose a plan, then add the domain in the control panel. The panel shows the nameservers assigned to your zone and our transfer IP addresses; keep both handy.

Option A (Enterprise): add the domain as a Secondary zone and enter Cloudflare’s transfer address, 172.65.64.6, as the primary (master) server. Cloudflare sends NOTIFY messages from 104.30.167.163, 104.30.167.173, and 2a09:bac0:1000:c47::/64.

Option B (any plan): in Cloudflare, open DNS → Records → Import and Export and export the zone file. Add the domain in CloudFloorDNS as a primary zone and import the file, or send it to support and we’ll import it and send back a record report.

Connect the two providers

Option A (Enterprise):

1. Create a TSIG key (recommended). Use the same name, algorithm (for example hmac-sha256), and secret on both sides. The name must match exactly or transfers will fail.
2. Create a peer in your Cloudflare account’s DNS Settings, under DNS Zone Transfers. Enter the CloudFloorDNS IP from our panel, port 53, and link the TSIG key.
3. Link the peer to your zone, then enable outgoing zone transfers in the zone’s DNS settings. Cloudflare sends a NOTIFY right away and we pull the full zone.

Option B (any plan): set up a way to keep the zones identical. For zones that rarely change, updating both dashboards is enough. For anything busier, use a scheduled job that reads your records from the Cloudflare API and writes them to the CloudFloorDNS API. We’re happy to help you set one up.

Verify we answer exactly like Cloudflare

Query our nameservers directly and compare against Cloudflare’s. The SOA serials should match (Option A), and every record you care about should return the same answer. Nothing is live on our side yet, so take your time.

# Use one of the two nameservers Cloudflare assigned to your zone
dig @ada.ns.cloudflare.com example.com SOA +short
dig @ns1.cloudfloordns.com example.com SOA +short

# Spot-check the records that matter most
dig @ns1.cloudfloordns.com example.com A +short
dig @ns1.cloudfloordns.com example.com MX +short
dig @ns1.cloudfloordns.com example.com TXT +short
dig @ns1.cloudfloordns.com www.example.com A +short

Tell Cloudflare about the second provider

In the Cloudflare zone, add NS records at the apex (@) for each CloudFloorDNS nameserver. By default Cloudflare ignores apex NS records, so also turn on Multi-provider DNS in the zone’s DNS settings. With it enabled, Cloudflare returns both sets of nameservers in its answers and keeps the zone active when your registrar lists nameservers from another provider.

On our side, the zone’s NS records list both Cloudflare’s and our nameservers, so both providers publish the same NS set.

If you use DNSSEC, set up multi-signer first

A signed zone served by two providers needs both providers’ keys published in the zone and both DS records at the registrar, a setup known as multi-signer DNSSEC (RFC 8901). Cloudflare supports it, and it has to be in place before you change delegation; otherwise validating resolvers will reject answers from whichever provider they can’t verify. Talk to us before this step and we’ll plan the key exchange with you. If your zone isn’t signed today, skip this step.

Add CloudFloorDNS nameservers at your registrar, alongside Cloudflare’s

At your registrar, add our nameservers to the list. Don’t remove Cloudflare’s. Once the change is published, the registry hands out both sets and resolvers use whichever answers. Confirm it at the source:

# Ask the .com registry what it delegates (use your TLD's servers for other TLDs)
dig NS example.com @a.gtld-servers.net +norec

# Both providers should now show in the answer
dig NS example.com +short

That’s it. From here on, keep editing records in Cloudflare as you always have.

Backup DNS protects DNS, not Cloudflare’s proxy

If Cloudflare’s nameservers stop answering, we keep your domain resolving. Proxied hostnames still resolve to Cloudflare’s edge, though, so if the proxy itself is down, those sites are down too. DNS-only records (mail, VPN, APIs pointed straight at your servers) get the full benefit.

Cloudflare Registrar is a hard stop

We can’t work around it and neither can Cloudflare support. Domains registered with Cloudflare must use only Cloudflare’s nameservers, so the domain has to move to another registrar before a backup provider can be added.

Automatic sync needs Cloudflare Enterprise

Zone transfers out of Cloudflare are an Enterprise feature. On other plans Option B works well, but you or a scheduled job has to keep both zones identical. A backup that’s out of date gives inconsistent answers, which is worse than no backup.

DNSSEC takes a little more planning

Signed zones need multi-signer DNSSEC across both providers before the second set of nameservers goes live. It’s well understood and we’ve done it before, but it’s a step you can’t skip.