Will pointing to Cloudflare nameservers cause downtime?

Not if you recreate every record in Cloudflare before changing nameservers at your registrar. Downtime happens when records are missing from the import, not from the nameserver change itself. Old resolvers keep serving cached answers during the transition.

How long does the nameserver change take to propagate?

Cloudflare usually activates the domain within an hour, though registrar and resolver caching can extend full propagation up to 24-48 hours. You'll get an email when Cloudflare becomes authoritative.

Why is my email broken after moving to Cloudflare?

Almost always a missing MX or email TXT record, or a mail record left proxied (orange cloud). Cloudflare only proxies web traffic, set all mail records to DNS-only and confirm SPF, DKIM, and DMARC came across intact.

How to Point Your Domain to Cloudflare Nameservers

VigilDog Team · October 30, 2026 · 7 min read

Moving a domain onto Cloudflare means handing DNS authority to Cloudflare's nameservers. Done carelessly it drops email or takes a site offline for hours; done carefully it's a ten-minute change with zero downtime. The difference is entirely in the preparation. Here's the safe path.

What Cloudflare nameservers actually do

Every domain has a set of authoritative nameservers, the servers that answer 'what is the IP for this hostname?' When you point your domain to Cloudflare nameservers (something like maya.ns.cloudflare.com and rob.ns.cloudflare.com), you are telling the world that Cloudflare is now the authority for your zone. From that moment, only the records inside your Cloudflare dashboard exist. Records that lived at your old DNS host but were never recreated in Cloudflare simply vanish.

This is the single biggest cause of migration outages: not the nameserver change itself, but records that didn't come along for the ride. Cloudflare scans your existing zone when you add the domain, but that scan is best-effort, it can miss records, especially ones set with unusual TTLs or record types. Treat the import as a draft, not a source of truth.

How a domain name resolves to a server

Before you switch: export your current zone

Prepare an escape hatch before you touch anything. Log into your current DNS provider and export the full zone file, or at minimum screenshot every record. You want a complete, timestamped record of A, AAAA, CNAME, MX, TXT (SPF, DKIM, DMARC, and any verification records), SRV, and NS entries.

Pay special attention to email. Losing an MX record takes down mail delivery; losing SPF, DKIM, or DMARC TXT records silently degrades deliverability days later, long after you've stopped associating it with the migration. You can capture the current state of any domain's records quickly with our DNS checker so you have an independent snapshot to compare against.

Step by step: pointing your domain at Cloudflare

With your backup in hand, the actual switch is short. The key is to get every record right in Cloudflare before you change nameservers at the registrar, never the other way around.

Add the site in Cloudflare and let it scan your existing DNS records.
Review the imported records against your exported zone, line by line. Add anything the scan missed, this is where outages are prevented.
Confirm MX and all email-related TXT records (SPF, DKIM, DMARC) are present and exact.
Cloudflare assigns you two nameservers. Copy them.
At your registrar (where you bought the domain), replace the existing nameservers with the two Cloudflare gave you. Remove the old ones entirely, do not mix providers.
Save, then wait. Cloudflare emails you when the domain is active, usually within an hour but occasionally up to 24 hours.

Proxied vs DNS-only, and the records that break email

Cloudflare shows an orange cloud (proxied) or grey cloud (DNS-only) next to each record. Proxied means traffic routes through Cloudflare's network, hiding your origin IP and adding their CDN and security layer. DNS-only means Cloudflare just answers the query and traffic goes straight to your server.

The rule that trips people up: mail records must be DNS-only. Cloudflare only proxies HTTP/HTTPS, so an MX record, or an A record a mail server connects to, must stay grey-clouded or mail will fail. Your web A and AAAA records can be proxied; anything email, SSH, FTP, or a non-web protocol should not be. If you run a subdomain for mail (like mail.example.com) referenced by your MX, make sure that record is DNS-only too.

Verify propagation and confirm nothing dropped

Once Cloudflare reports the domain active, verify from outside. Run 'dig NS example.com'it should return only the Cloudflare nameservers. Then spot-check the records that matter most: 'dig example.com A', 'dig example.com MX', and your SPF/DMARC TXT records. Compare each answer against the snapshot you took before the switch.

Because resolvers cache old data up to the previous TTL, some networks may still see the old answers for a while; this is normal and resolves on its own. Run your domain through the DNS checker once more and confirm every critical record matches your pre-migration snapshot. If any record looks unfamiliar, our DNS records explained guide breaks down what each type does.

Catch the records that quietly disappear

The dangerous part of a nameserver migration isn't the moment you switch, it's the days after, when a forgotten TXT record or a missing subdomain surfaces as failed logins, bounced invoices, or a broken integration nobody connects back to the move.

VigilDog monitoring watches your DNS, SSL, and email authentication records continuously and alerts you when something changes or goes missing, so a migration that looks clean today doesn't turn into a mystery outage next week. Point your domain at Cloudflare with confidence, and let monitoring confirm it stayed correct.