Move Shopify DNS to Cloudflare and configure optional O2O Print

Quick answer

Move a Shopify domain's DNS to Cloudflare by recreating its complete zone, resolving the previous DNSSEC delegation, changing nameservers at the registrar and verifying the store with Shopify web records set to DNS only. Optional Orange-to-Orange (O2O) adds your Cloudflare proxy in front of Shopify through a proxied CNAME to shops.myshopify.com. Cloudflare documents O2O; Shopify currently lists proxy/O2O as unsupported. Decide who will troubleshoot it before enabling it.

Applies to and support boundaries

This article covers a Shopify storefront and an owner-controlled Cloudflare zone. The storefront stays hosted on Shopify. You need permission to manage the domain at its registrar, Cloudflare DNS and Shopify Settings > Domains. Hosting a separate website with Interactive Online does not provide access to a Shopify store or Cloudflare account.

Shopify's documented Cloudflare connection uses DNS only for records pointing to Shopify. O2O is an advanced Cloudflare configuration with a different support arrangement; Shopify warns that proxying can affect certificates, resilience and bot detection. Use the DNS-only path if you want the setup described by Shopify. The steps below separate DNS migration, optional O2O and later security enforcement so each can be verified and reversed.

1. Inventory the domain and business services

1. In Shopify > Settings > Domains, record the primary custom domain, redirecting aliases, connected subdomains and current connection/TLS status. Preserve the working DNS values shown for your domain rather than assuming another store's addresses apply.
2. Identify the current authoritative DNS provider and registrar. Export the zone, including A/AAAA, CNAME, MX, SPF, DKIM, DMARC, verification TXT, CAA, SRV and delegated subdomains. Record forwarding/redirect services that an export may omit.
3. Confirm the intended Cloudflare account, account owner, access permissions and recovery method. Save old nameservers, DNSSEC/DS state, proxy flags and relevant rules privately. Identify critical apps, search, cart, customer accounts, subscriptions, shipping, feeds and other integrations to check after each stage.
4. Record a working store/email baseline and choose a change window. Nameserver migration does not require transferring registration. If your registrar does not allow the required nameserver change, obtain its supported migration procedure first.

2. Recreate the zone in Cloudflare using DNS only

1. Add the root domain, such as example.com, to the intended account in Cloudflare. Review the imported zone under DNS > Records against your inventory; automatic scanning may miss records.
2. Keep the Shopify storefront records DNS only initially. Follow the current instructions in Shopify's domain connection screen and official Cloudflare connection guide. Its standard configuration uses a root A and AAAA plus a www CNAME targeting shops.myshopify.com. The assigned Shopify A value can vary by region, so retain a working Shopify-provided value.
3. Preserve mail and other service records. Do not point the storefront at a cPanel IP, remove all subdomains, or proxy mail or SSH/SFTP service hostnames. Do not copy the former provider's SOA or apex NS records into Cloudflare.
4. Check any Shopify ownership-verification TXT value and CAA requirements. Remove only an identified conflicting Shopify record, such as an unsupported Shopify wildcard or a duplicate storefront destination, after saving its previous value.

3. Resolve DNSSEC, then change registrar nameservers

Follow the providers' migration procedure for the old DS delegation. Verify that it is absent at the relevant parent and that the previously cached positive DS lifetime has expired before changing nameservers. A SERVFAIL response does not establish an absent DS record. Keep Cloudflare DNSSEC off during this transition; review Shopify's current compatibility guidance before any later activation using new Cloudflare DS values.

1. Re-export and compare the pending Cloudflare zone with the original. Resolve every unexpected omission.
2. At the registrar, replace the old nameservers with the exact pair assigned to this Cloudflare zone. Editing ordinary NS records in the old zone does not change the registrar's delegation.
3. Verify public delegation, Cloudflare authoritative responses and zone Active status. Check from another resolver/network when cached answers differ.
4. In Shopify Settings > Domains, inspect the domain's connection and certificate status. If the domain is new to the store, use Connect existing domain and complete any ownership verification Shopify requests.

4. Confirm the DNS-only store before considering O2O

Test root/www HTTPS, primary-domain redirects, a collection/product, search, adding/updating the cart, customer-account entry and checkout entry. Check important app-proxy and third-party features. Do not submit an order or payment during routine checks without a separate test-order plan. Verify business email and required subdomains too. A healthy homepage does not verify these functions.

If a store or certificate fails here, fix the DNS-only setup before adding a proxy. Shopify documents that domain and certificate updates can take up to 48 hours; investigate actual DNS, CAA or validation errors instead of repeatedly changing records. You can finish with Cloudflare providing DNS only.

5. Review the optional O2O settings

Before O2O, save the exact working DNS-only records and decide who owns Cloudflare troubleshooting. Review account-level as well as zone-level rules. Use this starting configuration and adjust only after a specific check:

• Certificates and HTTPS: verify coverage for each future proxied hostname and the working edge-to-Shopify TLS configuration. Keep the working edge-to-Shopify TLS mode and prefer Full (strict) when the Shopify certificate chain validates. Do not select Flexible or Off to hide a certificate failure.
• Always Use HTTPS: keep it off for Shopify O2O, as required by Cloudflare's Shopify-specific guide. It can interfere with Shopify's HTTP certificate challenge at /.well-known/acme-challenge/*. If a separate HTTPS redirect is needed, scope it to exclude that path. Keep HSTS as a separate change until HTTPS and rollback are proven.
• Caching and script changes: avoid extra HTML caching for cart, checkout, accounts, app proxies and certificate validation. Do not add a blanket Cache Everything rule. Keep Rocket Loader off for O2O; introduce other HTML/script modifications only after app testing.
• Bots and WAF: retain the normal protective baseline and inspect rule outcomes. Leave free Bot Fight Mode off while establishing compatibility because a WAF Skip rule cannot exempt it. Avoid broad country/ASN/Worker blocks or cart challenges copied from another store.
• Workers and Snippets: review active routes. Cloudflare currently disables these on Shopify's /checkout path, but other routes can still affect the storefront. A proxy badge does not verify every integration.

6. Activate O2O one storefront hostname at a time

1. Open the intended hostname in DNS > Records and preserve its working DNS-only values. Set the selected Shopify hostname to CNAME, target shops.myshopify.com, proxy status Proxied.
2. At the root domain, this uses Cloudflare's apex CNAME flattening. Remove only the storefront A/AAAA records that the root CNAME replaces. For a www storefront hostname, use its direct Shopify CNAME. Keep mail, verification and unrelated service records.
3. Save and check Cloudflare's Shopify recognition/icon beside the CNAME value. O2O enables automatically for the eligible proxied Shopify CNAME; Cloudflare documents it for any zone plan. An orange cloud on a Shopify A record is not the documented CNAME setup.
4. Verify HTTPS, Shopify domain/TLS status, redirects and actual traffic visible in your own Cloudflare zone. A server: cloudflare header alone proves little because Shopify also uses Cloudflare. Repeat the store/app checks before changing another hostname.

7. Verify behavior and preserve useful crawler access

Check desktop, mobile and private browsing sessions. Confirm navigation, product/search pages, cart updates, checkout/account entry and the integrations identified earlier. Review available Security Events for false positives and ensure personalized cart/checkout/account HTML is not an extra Cloudflare cache HIT. Observe normal store activity before adding new enforcement rules.

If you want public pages available to AI search and assistants, review Security > Settings > Configure AI bot policies and any individual crawler controls in AI Crawl Control. The public-access baseline used by this guide is Search: Allow, Agent: Allow, Training: Allow. These are separate policy choices. Review your content rights and access preferences before applying them, and reopen the saved values to confirm them.

Check conflicting WAF, geographic, Worker and robots.txt policies too. Limit any necessary exception to verified crawler identity and appropriate public GET/HEAD paths; a user-agent name alone is not verification. Keep account, checkout, exploit and sensitive-file protections. Allowing a crawler does not guarantee indexing or a citation in an AI answer.

Troubleshooting and rollback

• SSL/TLS pending or certificate renewal fails: inspect the exact DNS/CAA error, certificate-validation path, redirects and security events. For an O2O problem, restore the saved DNS-only Shopify record and disable only newly related rules before retesting.
• Cloudflare proxy warning in Shopify: Shopify's current guidance treats O2O as unsupported. Return to its DNS-only configuration if you require that support path; contact Cloudflare for your zone's O2O configuration.
• Cart, app or shipping behavior fails only with O2O: record the request time, URL/path, status, Ray ID and matched rule. Reverse the specific proxy or rule change and compare the result. Do not treat a temporary working homepage as a complete fix.
• DNSSEC SERVFAIL or missing email: inspect delegation/DS and the copied DNS records separately. O2O applies to web hostnames and does not migrate the email service.
• No O2O recognition or an Enterprise zone-hold error: check the direct proxied CNAME target and the exact Cloudflare message. If a zone hold prevents Shopify hostname activation, ask the authorized owner or Cloudflare support about the narrowly required change.

Roll back O2O by restoring the saved DNS-only values for the affected hostname, including the saved A/AAAA values when replacing an apex CNAME. Keep healthy Cloudflare authoritative DNS in place. A DNS-provider rollback is a separate action and may be delayed by cached delegation. Keep a private record of changes, results and unverified functions.

When to get help

Shopify Support can guide its documented domain configuration but cannot edit your Cloudflare account and does not support O2O. Cloudflare supports configuration of your zone. Contact Interactive Online support for help within your service's scope. Provide the domain, affected hostname, DNS-only/O2O state, change time/time zone, exact error, relevant redacted records and Ray ID. Keep credentials, API tokens, customer records and private rule details out of public posts.

Cloudflare rules cover traffic that reaches the proxied custom hostname. They do not establish that every payment attempt or alternate route is protected. Review payment-gateway and Shopify controls separately; a copied challenge rule is not a complete fraud solution.

Related help

• Cloudflare DNS for a cPanel-hosted website
• Plan nameserver migration and preserve email
• Identify authoritative DNS before editing records

Official references

• Shopify: connect a Cloudflare domain using DNS only
• Shopify: domain and proxy troubleshooting
• Cloudflare: Shopify O2O provider guide
• Cloudflare: O2O product compatibility
• Cloudflare: DNSSEC
• Cloudflare: CNAME flattening
• Cloudflare: AI bot policies
• Cloudflare: Bot Fight Mode limitations

Content and official-source review: November 1, 2026. Vendor support policies, dashboard labels and available features can change. All example domains are sample data.