Prerequisites and verification tools
Before starting, ensure you have administrative access to both your Domain Registrar (where you pay for the domain) and your current DNS Host.Phase 1: Pre-migration security (24–48 hours prior)
The most common cause of migration failure is DNSSEC. If nameservers are changed while the Top-Level Domain (TLD) registry still expects cryptographic signatures from the old provider, the domain will go offline globally.Checklist
1
Identify DNSSEC status
Check your current registrar dashboard for DNSSEC/DS records.
2
Disable DNSSEC
Toggle DNSSEC to OFF in your registrar’s security settings.
3
Verify deletion
Enter the domain at DNSViz.net.
The graph must show an “Insecure” status (blue/gray boxes) with an NSEC3 proof from the registry. Do not proceed if any “Secure” (green) or “Broken” (red) paths remain.
4
Lower TTLs
Set all critical
A, CNAME, and MX records to 300 seconds (5 minutes).This ensures that if a rollback is required, the change propagates in minutes rather than hours.
Phase 2: The deep data audit (AI-assisted)
Cloudflare’s automatic scan frequently misses complex TXT records (DKIM, SPF), deeply nested subdomains, or service-specific verifications. A manual import is mandatory for production environments.Checklist
1
Extract zone file
Export your current DNS records as a
.csv, .txt, or .bind file from your existing provider.2
Sanitize via AI
Upload the raw export to an AI Assistant with the following prompt to ensure 100% compatibility:
3
Audit MX records
Manually cross-check that all Google Workspace (or other provider) MX records are present in the sanitized file.
4
Initial import
In Cloudflare DNS > Records > Import, upload the sanitized file.
5
Enforce Grey Cloud policy
Ensure every record is set to DNS Only (Grey Cloud).
This allows you to move DNS management without changing the underlying traffic routing or SSL handshake logic yet.
Phase 3: The nameserver handover
In this phase, you officially transfer “steering” control to Cloudflare.Checklist
1
Set SSL mode
Navigate to Cloudflare SSL/TLS > Overview. Set the mode to Full (Strict).
Production origins (like Webflow) already have SSL. “Full (Strict)” ensures an end-to-end encrypted tunnel.
2
Update nameservers
In your Registrar (Squarespace/GoDaddy/etc.), replace the current nameservers with the two provided by Cloudflare.
3
Monitor propagation
Open WhatsMyDNS.net and check the
NS record.You should see a majority of global nodes returning the Cloudflare nameservers.
4
Await edge certificate
In Cloudflare SSL/TLS > Edge Certificates, wait until the status for your domain is Active.
Phase 4: Activation and proxying
Now that Cloudflare owns the DNS and has a valid SSL certificate ready, you can activate the Web Application Firewall (WAF) and Workers.For detailed reverse proxy configuration (Cloudflare Workers, NGINX, Apache, IIS, and Caddy), see the Reverse proxy guide.
Checklist
1
Enable proxy (Orange Cloud)
Toggle the main
@ and www records to Proxied.2
Verify header flow
Load the website and inspect the Network tab.
Response headers must contain
server: cloudflare and a cf-ray ID.3
Deploy Workers
Bind your Workers to specific routes (e.g.
example.com/blog/*).4
SEO verification
Verify that subdirectories (like
/blog) are rendering correctly and that canonical tags point to the proxied URL.Phase 5: Post-migration optimization
1
Purge cache
Perform a Purge Everything in Cloudflare to ensure Worker logic is applied to all cached assets.
2
Enable DNSSEC (final step)
After 24 hours of stability, enable DNSSEC in Cloudflare.
3
Registry update
Copy the new DS Records from Cloudflare and paste them back into your Registrar’s security settings to re-establish the Chain of Trust.