FAQ: accounts, domains, and DNS
Answers about domain onboarding, Pending status, proxy mode, email records, DNS propagation, and origin exposure.
Edited and verified by Orange Book Editorial Team ·
Does adding a domain to Cloudflare transfer the registrar or ownership?
No. A typical full setup changes the authoritative nameservers to the pair assigned by Cloudflare; the registrar and ownership remain where they are. Review every scanned DNS record before the change. Use the domain onboarding guide for the complete flow.
Why does the zone remain Pending?
Cloudflare must confirm the public nameserver delegation. The current official guidance says ownership verification can take up to 24 hours. Check the nameservers at the registrar, old DNSSEC/DS records, and domain status instead of repeatedly deleting and adding the zone.
When should a record be Proxied or DNS only?
A, AAAA, and CNAME records serving HTTP/HTTPS normally use Proxied so traffic enters Cloudflare's cache, security, and analytics path. Email, third-party domain verification, and ordinary non-HTTP services use DNS only. See the DNS proxy decision guide.
Can MX, TXT, or a mail host be proxied?
MX and TXT records cannot be proxied. The hostname targeted by MX should also resolve to a DNS-only address. Cloudflare's normal HTTP proxy does not forward SMTP, so proxying mail.example.com often sends clients to Cloudflare IPs instead of the mail server.
Why do some users see a new address while others still see the old one?
An updated authoritative record does not instantly expire every recursive resolver and device cache. Query the Cloudflare authoritative nameserver and a public resolver separately, and record the TTL. Do not infer global propagation from one browser on one device.
dig NS example.com +short
dig @1.1.1.1 example.com A +shortWhy can I no longer resolve the origin IP after enabling Proxied?
That is expected: a proxied record returns Cloudflare Anycast addresses. Verify the origin through controlled curl --resolve checks, origin monitoring, or the hosting dashboard. Do not expose the origin temporarily and forget to restore protection.
Is switching to DNS only always the safest outage fallback?
No. DNS only bypasses WAF, cache, and DDoS protection and exposes the origin address. Browsers will also reject a direct origin that only has an Origin CA certificate. Use it only as a time-bounded fallback after verifying a public certificate, capacity, and origin access controls.
Primary sources
Did this page help you complete your goal?
Beta feedback is generated in this browser and is never uploaded automatically.