Move a cPanel-hosted domain's DNS to Cloudflare without losing email Print

Quick answer

To move DNS for a cPanel-hosted website to Cloudflare, copy the complete active DNS zone into your own Cloudflare account, resolve the old DNSSEC delegation, and replace the nameservers at the domain's registrar with Cloudflare's assigned pair. Verify the website and email while web records are DNS only. Enable Cloudflare's web proxy separately after the origin certificate and services work.

Applies to

This guide is for an Interactive Online customer whose website is hosted in an authorized cPanel account. You need access to that hosting service, the current authoritative DNS provider, the registrar and the intended Cloudflare account. Moving DNS changes where records are managed; it does not move website files, registration or the email service. Use the server/IP assigned to your own service.

1. Inventory the current DNS and working services

1. Identify the authoritative DNS provider and the registrar. The zone shown in cPanel may be inactive if another provider is authoritative. Confirm the hosting service and the domain's document root separately.
2. Export the authoritative zone or record every required name, type, value, MX priority and TTL. Include A/AAAA, CNAME, MX, SPF, DKIM, DMARC, verification TXT, CAA, SRV, delegated subdomains and relevant wildcard records. Review redirects and forwarding services that a DNS export may not include.
3. Record the working root and www HTTPS addresses, email provider and important subdomains. Keep the old nameservers, DNSSEC/DS information, record export and change time privately so you can reverse a specific change.
4. Choose a time when you can check the result and contact the account owner if needed. Keep existing hosting, DNS and mail services available through the transition. A domain registration transfer is not required for an ordinary nameserver change.

2. Add the domain to the correct Cloudflare account

1. Sign in at the Cloudflare dashboard, choose the account that should own the domain and use its add-domain/onboarding action. Enter the root domain, such as example.com. Interface labels and plan options can vary.
2. Select an appropriate plan and review the imported DNS records. The automatic scan can miss records; compare the result with your complete source inventory under DNS > Records.
3. Initially keep website A/AAAA/CNAME records DNS only while verifying the migration. Mail, SSH/SFTP and other non-web service hostnames must stay DNS only with Cloudflare's standard web proxy. MX and TXT records do not have a web-proxy toggle.
4. Copy the required values, including long DKIM and verification TXT values, without truncating them. Do not copy the old provider's SOA or apex NS records into Cloudflare. Cloudflare supplies its own zone information and assigned authoritative nameservers.

For an ordinary cPanel website, the root A record uses the website IPv4 address assigned to the service. A www CNAME commonly targets the root domain. Retain an AAAA record only when the intended hosting service supplies the matching IPv6 destination. Do not point the website at both hosting servers or use an old IPv6 address as a fallback.

3. Preserve email before changing nameservers

Copy the actual mail provider's MX records and any A/CNAME records they depend on. Preserve SPF, DKIM, DMARC, autodiscovery and service-verification records as required. If MX targets the root domain, a later change to the root A record can change where mail is delivered. Verify that dependency before editing the website destination.

If the email service is external, keep its provider's values. If mail is handled by cPanel, confirm the correct local or remote email routing separately. Changing nameservers does not configure cPanel routing or migrate stored messages. Avoid combining a DNS move with an unrelated email migration.

4. Resolve the previous DNSSEC delegation

If DNSSEC is active, follow the registrar and DNS providers' migration procedure. For a standard move to Cloudflare, remove the previous provider's DS delegation at the registrar and verify that it is no longer published by the parent. Allow the previously cached DS lifetime to expire before switching nameservers. A SERVFAIL response is an error, not proof that the DS record is absent.

Keep Cloudflare DNSSEC off during this cutover. After the new authority is healthy, enable it as a separate change only if supported by your registrar/service, using Cloudflare's new DS information. Do not reuse the previous provider's DS values. Ask the DNS provider for help if you cannot establish the current validation state.

5. Replace the nameservers at the registrar

1. Recheck DNS parity and copy the exact two nameservers assigned to this Cloudflare zone. An example from another account is not your assigned pair.
2. Open the domain's nameserver control at its registrar. For a domain registered through Interactive Online, start in the Client Area under Domains > My Domains and open the selected domain's nameserver option, when the registrar integration exposes it.
3. Replace the old set with the assigned Cloudflare set and save. Editing ordinary NS records in the old DNS zone does not update registrar delegation. If the registrar restricts external nameservers, use its supported process or ask for help.
4. Check the registrar readback, public delegation and direct answers from the assigned Cloudflare nameservers. Confirm the zone becomes Active. Cached answers can differ during the transition, so verify from another network or resolver too.

6. Verify DNS-only service, then consider the web proxy

Open the intended root and www HTTPS addresses, a nested page and important images/forms. Send and receive a clearly labeled email between addresses you control, and confirm third-party services. Record the result and time. DNS resolution alone does not prove that the website or mail works.

If you want Cloudflare to proxy web traffic, first confirm a valid origin certificate for each web hostname. Change only the intended website record to Proxied, use SSL/TLS > Overview > Full (strict) with a validated origin certificate, and repeat the checks. Keep mail and SSH/SFTP service hostnames DNS only. A Cloudflare Origin CA certificate serves the Cloudflare-to-origin connection; direct browser visitors need a publicly trusted certificate.

Do not enable broad cache, redirect, script-rewrite or security rules in the same step. Check certificate-validation paths and application logins/forms before adding another feature. Avoid Flexible mode as a workaround for a certificate or redirect problem.

Troubleshooting and rollback

• Email stopped after the switch: compare MX, its destination and routing with the original inventory, then use the missing-message checks.
• SERVFAIL or no DNS answer: inspect registrar delegation, DS validation and the authoritative zone before changing unrelated IP records.
• The wrong website appears: verify the assigned IP, root/www A/AAAA/CNAME records and document root, then check the relevant cache.
• HTTPS works DNS only but fails when proxied: review origin TLS, hostname coverage and the exact Cloudflare error. Reverse the newly changed proxy setting first and investigate; do not disable certificate verification.

For a record error, restore its saved value. For a proxy/rule problem, reverse that change while leaving healthy authoritative DNS in place. Restore the previous registrar nameservers only when the delegation itself must be reversed, and expect caches to affect that rollback too. Keep the old zone until the new services are verified.

When to contact support

Contact Interactive Online support if the assigned origin, routing or hosting response is unclear. Registrar and Cloudflare account changes require access to those accounts; hosting access alone does not grant it. Provide the domain, DNS provider, change time/time zone, affected service, exact error and relevant redacted records or Ray ID. Keep passwords, API tokens, cookies, session URLs and unrelated verification values private.

Review authentication at the new DNS host

After delegation is stable, use the provider-specific email-authentication overview to verify SPF, DKIM and DMARC at Cloudflare. Preserve every legitimate sender and selector. Do not tighten the mail policy during a DNS migration unless that separate change has been reviewed.

Related help

• Cloudflare DNS for a Shopify storefront and optional O2O
• Plan a nameserver change without losing services
• Choose the right domain connection method
• Use the right hostname for SSH and email behind Cloudflare

Official references

• Cloudflare full DNS setup
• Cloudflare DNSSEC migration
• Cloudflare proxy status
• Cloudflare Full (strict) TLS

Content and official-source review: November 1, 2026. Dashboard labels and service features can change. All example domains are sample data.