In this guide 6 sections
Email breaks during a DNS move when a record is missed. Export every record from the old host. Lower the TTL a day ahead and import into Cloudflare. Compare line by line, check the MX and TXT records twice, then change nameservers in office hours with someone testing mail.
Write down every record before you touch anything
Log in to the reseller panel and export the zone file if it offers one; if it does not, take screenshots of every page. Note the type, name, value, priority and TTL of each line; the old panel is the only copy of your setup.
Pay attention to records nobody remembers adding. A TXT record for Google site verification, a CNAME for a helpdesk subdomain and an SRV line for a phone system all die quietly if left behind.
Ask who else depends on the domain. Staff mailboxes, a website host, a booking tool and a Brevo sender may each have asked for a record over the years.
- A, AAAA and CNAME records for web and subdomains
- MX records with their priority numbers
- TXT records for SPF, DKIM and verification codes
- SRV and CAA records, often forgotten
- The current nameservers and registrar login
Lower the TTL a day ahead
TTL is the number of seconds that other servers remember an answer. If your MX record has a TTL of a full day, a mistake will linger for a full day. Drop the TTL on key records to a few minutes at least twenty-four hours before the move.
The wait matters. The lower value only helps once the old long value has expired in caches around the world; setting it an hour before the switch achieves almost nothing.
Choose the date now. Avoid Fridays, month-end and any day with a product launch or payroll run.
Import the zone and compare it line by line
Add the site to Cloudflare. Its scan imports what it can find, but a scan is a guess. Upload your exported zone file if you have one, then review every row against your written list.
Cloudflare proxies web records by default, shown as an orange cloud; mail records must stay grey, meaning DNS only. An MX target or a mail subdomain that is proxied will not accept mail connections.
Tick each record off. Do not trust the count alone. Two wrong values can still add up to the right number.
- Every MX record present with the same priority
- SPF TXT value copied character for character
- DKIM selector records intact and unproxied
- Mail and webmail subdomains set to DNS only
Check the MX records twice, then switch in office hours
Read the MX records aloud to a colleague, one on the old panel and one in Cloudflare. A swapped priority or a typo in the Google or Microsoft hostname is the failure that stops mail. Checking takes two minutes. Repair takes a morning.
Change the nameservers at the registrar on a weekday morning when staff and an IT contact are available. Propagation can take hours. During that time some senders see the old host and some see the new one, so both must hold the same data.
Send a test mail to the company address from a personal account and back again. Then try a second outside provider.
Confirm who owns the account and what remains
Create the Cloudflare account under a company address, not a freelancer’s inbox; turn on two-factor sign-in and add a second administrator. A domain that sits in a former supplier’s account becomes a hostage situation.
Keep the old DNS panel for a week without deleting records. Once mail, the website and every subdomain have run cleanly, raise the TTL back up and cancel the reseller’s DNS service.
Store your final zone export and the registrar login in the company password manager; that export is your recovery plan for the next change.
DNS move worksheet
One sheet with a table of old records and a matching table for Cloudflare; columns are type, name, value, priority, TTL and checked. Below sit blocks for the TTL change date, switch time, test mailboxes, account owner, second administrator and the cleanup date for the old host.
Open a blank worksheet to printQuestions owners ask
Will moving DNS to Cloudflare cause email downtime?
Not if the new zone matches the old one record for record. Mail may take hours to settle during propagation, and both hosts should serve identical answers until it does.
Do I have to move my domain registration to Cloudflare as well?
No. DNS hosting and registration are separate. You can keep the registrar and only change the nameservers, which is the safer first step.
Why should mail records not be proxied?
The orange cloud routes web traffic through Cloudflare. Mail servers connect on other ports and expect your real server address, so a proxied mail record stops delivery.
What if mail stops after the switch?
Compare the MX and SPF records against your written list first. If a fault is not obvious, set the nameservers back at the registrar to the old host, which still holds the full zone.