# Register a domain with Cloudflare ## Purpose Use this SOP when a GETQUICK operator needs to register a new domain through Cloudflare Registrar or connect an already-purchased domain to Cloudflare by hand. This workflow uses the Cloudflare dashboard, verifies DNS records before switching traffic, and avoids CLI or API automation unless the task explicitly calls for it. ## Context Cloudflare can be involved in two different domain workflows: - Registering a new domain through Cloudflare Registrar. - Onboarding an existing domain that was purchased somewhere else, then updating that registrar to use Cloudflare nameservers. Cloudflare documentation calls the second workflow a full DNS setup. For full setup, Cloudflare becomes the authoritative DNS provider after the registrar nameservers are changed. ## Outcome After the procedure is complete: - The domain exists in the correct Cloudflare account. - DNS records needed for the website, app, email, and verification providers are present. - Nameservers point to Cloudflare, unless Cloudflare Registrar handled that automatically. - SSL/TLS is configured before production traffic is expected. - The domain reaches the intended service after DNS propagation. ## Steps ### Before you start Confirm: - The domain name and spelling are final. - The correct Cloudflare account is selected. - You know whether the domain is new or already registered elsewhere. - You have access to the current registrar if the domain already exists. - You have access to the old DNS provider, hosting provider, email provider, and any SaaS verification records that need to be copied. - DNSSEC is disabled at the current registrar before changing nameservers for an existing domain. Do not start a nameserver change if nobody has verified the existing DNS records. Missing MX, TXT, CNAME, A, or AAAA records can break email, app routing, or provider verification. ### Register a new domain in Cloudflare 1. Log in to the Cloudflare dashboard. 2. Open the correct account. 3. Go to **Domain Registration** or **Domains**. 4. Search for the apex domain, such as `example.com`. 5. Choose the desired available domain. 6. Review the registration term, price, contact details, and auto-renew setting. 7. Complete checkout. 8. Open the new domain in Cloudflare. 9. Add DNS records for the service that will use the domain. 10. Configure SSL/TLS before pointing users at the new site. Cloudflare Registrar domains use Cloudflare nameservers, so there is usually no separate registrar nameserver update for newly purchased domains. ### Onboard an existing domain 1. Log in to the Cloudflare dashboard. 2. Open the correct account. 3. Select **Onboard a domain** or **Add a domain**. 4. Enter the apex domain, such as `example.com`, not a subdomain like `www.example.com`. 5. Let Cloudflare scan DNS records. 6. Compare Cloudflare's discovered records against the current authoritative DNS provider. 7. Manually add anything missing. 8. Review proxy status for web records: - Use proxied records for normal HTTP and HTTPS web traffic when Cloudflare should protect and accelerate the site. - Use DNS-only records for mail, ownership verification, or services that must see the origin directly. 9. Continue until Cloudflare shows the two assigned nameservers. 10. Log in to the current registrar. 11. Disable DNSSEC at the registrar if it is enabled. 12. Replace the registrar nameservers with the two Cloudflare nameservers. 13. Save the registrar change. 14. Return to Cloudflare and wait for the zone to become active. Nameserver propagation can take time. Do not repeatedly change records during propagation unless there is a confirmed mistake. ### DNS record checklist Before changing nameservers, check for: - `A`, `AAAA`, or `CNAME` records for the apex domain and `www`. - App subdomains such as `app`, `api`, `admin`, `docs`, `status`, or `mcp`. - `MX` records for email routing. - Email authentication records such as SPF, DKIM, and DMARC. - Provider verification `TXT` records. - CAA records, if certificate issuance is restricted. - Redirect records or page rules from the previous provider. If the domain handles production email, verify MX, SPF, DKIM, and DMARC twice before the nameserver change. ### SSL/TLS setup After the domain is active in Cloudflare: 1. Open **SSL/TLS** for the domain. 2. Use a mode that matches the origin's certificate setup. 3. Prefer an encrypted origin connection for production. 4. Confirm Universal SSL is active or that the intended certificate setup is ready. 5. Test the site over HTTPS. Do not leave a production site in a state where Cloudflare can accept HTTPS from users but cannot connect safely to the origin. ## Validation Validate from Cloudflare: - The domain status is active. - DNS records match the intended service map. - SSL/TLS shows a valid certificate state. - Web records that should be proxied show Cloudflare's proxied status. Validate from a terminal: ```bash dig NS example.com dig A example.com dig CNAME www.example.com dig MX example.com curl -I https://example.com ``` Expected results: - `dig NS` returns the two Cloudflare nameservers. - Web DNS records resolve as expected. - Email records still point to the intended mail provider. - `curl -I` returns a valid HTTP response over HTTPS. ## Operational notes for agents Use this article when a user asks how to manually register, add, onboard, connect, or move a domain into Cloudflare. If the user asks for automation, use a separate API or Terraform workflow instead. Do not mix API automation into this checklist. Important search terms: Cloudflare domain registration, Cloudflare Registrar, onboard domain, add domain, nameservers, DNSSEC, full DNS setup. ## Troubleshooting - If Cloudflare says the domain is not active, confirm the registrar nameservers exactly match the two nameservers Cloudflare assigned. - If the site returns DNS errors, check whether required `A`, `AAAA`, or `CNAME` records were missed during onboarding. - If email breaks, check `MX`, SPF, DKIM, and DMARC records first. - If HTTPS fails, review the SSL/TLS mode and confirm the origin certificate is valid for the hostname. - If DNSSEC was enabled before the nameserver change, disable it at the registrar and wait for the stale DS records to clear. - If the domain was registered through Cloudflare, manage nameservers and registration settings in Cloudflare rather than another registrar.