Quick answer
How do I use Cloudflare with my domain?
To use Cloudflare with your domain, add the domain to a Cloudflare account, then replace its nameservers with the 2 names Cloudflare assigns, such as ada.ns.cloudflare.com. At DotAlmanac, the Cloudflare preset in the Nameservers tab accepts exactly those 2 names, as of 29 October 2026. Turn DNSSEC off before the switch.
Cloudflare and your domain at a glance
| Method | Full setup: Cloudflare becomes the DNS provider through a nameserver change |
|---|---|
| Nameservers to enter | The 2 names Cloudflare assigns, in the form name.ns.cloudflare.com |
| Where at DotAlmanac | Domain › Nameservers › Cloudflare |
| Before the switch | Export your zone file and turn DNSSEC off |
| After the switch | DNS records, web forwarding, email forwarding and managed DNSSEC move to Cloudflare |
| DNSSEC again | Copy Cloudflare's DS record (algorithm 13) into the DNSSEC tab |
| Registration | Stays at DotAlmanac: renewal, transfer lock and WHOIS privacy do not change |
| Without a nameserver change | Cloudflare Pages on www with one CNAME record |
Do I need to move my domain to Cloudflare to use it?
No. Cloudflare's DNS, proxy and security features work with a domain registered anywhere, through a nameserver change. DotAlmanac is a domain extension guide and registrar: compare every extension, then register it with no KYC and pay in crypto. Your domain stays registered with us while Cloudflare answers its DNS queries.
Cloudflare Registrar is a different product. It sells at cost, $10.46 for a .com as of 8 October 2026, and every domain it registers must use Cloudflare nameservers. It documents no crypto payment. We do not claim to be the cheapest registrar: a .com at DotAlmanac costs $11.99/year, with no KYC, paid in BTC, USDT, USDC, ETH, SOL, LTC, XMR.
How to move your DNS to Cloudflare in 7 steps
Export your current records
In the client area, open the domain, then DNS › Import / export › Export zone file. Keep the BIND file: it holds your MX, SPF, DKIM and verification records.
Onboard the domain in Cloudflare
In the Cloudflare dashboard, open Domains › Onboard a domain. Enter the bare domain, such as example.com, and choose a plan.
Check the records Cloudflare found
Cloudflare scans the zone and lists the records it found. Compare them with your export, and add any missing MX, TXT or CNAME record. Cloudflare also imports a zone file.
Turn DNSSEC off at DotAlmanac
Open the DNSSEC tab and turn DNSSEC off. Cloudflare warns that a nameserver change while DNSSEC is active can make the domain unreachable.
Enter Cloudflare's 2 nameservers
Open Nameservers › Cloudflare, paste the 2 names exactly as Cloudflare shows them, and save. The preset accepts exactly 2 names ending in
.ns.cloudflare.com.Wait for the zone to become Active
Cloudflare checks the delegation and emails you when the zone is Active. Its guide tells you to allow up to 24 hours for the registrar update.
Turn DNSSEC back on
In Cloudflare, open DNS › Settings › Enable DNSSEC. Copy the DS record values into DotAlmanac's DNSSEC tab, under DS records, and save.
What are the exact values to enter at DotAlmanac?
Cloudflare assigns 2 nameservers to each account and zone. The names below are examples of the format; enter the 2 names your dashboard shows.
| Setting | Where in DotAlmanac | Value |
|---|---|---|
| Nameserver 1 | Nameservers › Cloudflare | The first name Cloudflare assigns, for example ada.ns.cloudflare.com |
| Nameserver 2 | Nameservers › Cloudflare | The second name Cloudflare assigns, in the same *.ns.cloudflare.com form |
| DS key tag | DNSSEC › DS records | The number Cloudflare shows (0 to 65535) |
| DS algorithm | DNSSEC › DS records | 13 (ECDSA P-256 with SHA-256), Cloudflare's choice |
| DS digest type | DNSSEC › DS records | 2 (SHA-256), as shown by Cloudflare |
| DS digest | DNSSEC › DS records | The hexadecimal string Cloudflare shows: 64 characters for SHA-256 |
The values in your Cloudflare dashboard always win over the examples on this page. A wrong DS record makes the domain unreachable for resolvers that check DNSSEC.
Why turn DNSSEC off before changing nameservers?
Because the DS record at the registry still points to the old signing key. Resolvers that check DNSSEC then reject Cloudflare's unsigned or differently signed answers, and the domain stops resolving for them.
The safe order is fixed: DNSSEC off, nameservers changed, zone Active at Cloudflare, then the new DS record. DotAlmanac accepts DS records with algorithms 8, 10, 13, 14, 15 and 16, and recommends 13. According to DotAlmanac's table of 225 extensions, 219 support DNSSEC. The DNSSEC tab tells you when a registry does not.
What changes when Cloudflare runs your DNS?
The registration stays with DotAlmanac. Everything that lives in the DNS zone moves to Cloudflare.
| Feature | DotAlmanac nameservers | Cloudflare nameservers |
|---|---|---|
| DNS records | DNS tab of the client area | Cloudflare dashboard |
| One-click templates (Vercel, GitHub Pages, Proton Mail…) | Yes | No: add the records by hand |
| Web forwarding | Free, in the client area | Cloudflare's redirect features |
| Email forwarding | Free, in the client area | Cloudflare Email Routing |
| DNSSEC | Signed by our nameservers | Signed by Cloudflare; DS record in the DNSSEC tab |
| Cloudflare proxy, cache and firewall | No | Yes, per record |
| Renewal, transfer lock, WHOIS privacy | DotAlmanac | DotAlmanac |
Can I use Cloudflare Pages without changing nameservers?
Yes, for www and other subdomains. Add the custom domain in the Pages project (Custom domains › Set up a domain), then apply DotAlmanac's Cloudflare Pages template. It adds one CNAME record from www to your project's pages.dev name.
The bare domain is different. Cloudflare Pages accepts an apex domain only when the zone runs on Cloudflare DNS. Without the nameserver change, add a web forwarding rule from @ to www in the Forwarding tab.
www 3600 IN CNAME my-project.pages.dev.
; bare domain: web forwarding from @ to https://www.example.comHow long does the switch to Cloudflare take?
Two clocks run. The first is the registry update of the nameservers: Cloudflare's guide says to wait up to 24 hours. The second is the cache of resolvers, which keep the old delegation and the old records until their TTL runs out.
To shorten the second clock, lower the TTL of your records a day before the switch. DotAlmanac's DNS tab offers 5 minutes as its shortest preset. Keep the old records unchanged at DotAlmanac until Cloudflare shows the zone as Active.
Cloudflare and your domain: FAQ
Can I go back to DotAlmanac's nameservers later?
Yes. Open Nameservers, choose "Our nameservers" and save. Turn DNSSEC off at Cloudflare and remove the DS record first. Then re-create your records in the DNS tab, or import the zone file you export from Cloudflare.
Why does Cloudflare say the nameservers are invalid?
Usually the names were not copied exactly, or a third nameserver is still listed. Cloudflare assigns 2 names per zone and they cannot be changed. The DotAlmanac preset refuses anything other than exactly 2 *.ns.cloudflare.com names.
Does Cloudflare need to be my registrar to proxy my site?
No. The proxy, cache and firewall work for any domain whose nameservers point to Cloudflare. The registrar only records which nameservers the domain uses.
Will my email keep working after the switch?
Yes, if Cloudflare's zone has the same MX, SPF and DKIM records as before. Compare it with the zone file you exported. Email forwarding set up at DotAlmanac stops; use Cloudflare Email Routing instead.
Do I keep WHOIS privacy and the transfer lock with Cloudflare DNS?
Yes. WHOIS privacy, the transfer lock, auto-renew and the transfer (EPP) code are registration settings, so they stay in DotAlmanac's client area. Cloudflare only answers the DNS queries of the domain.
Sources (5)
- Full setup: change your nameservers — Cloudflare Docs (checked 2026-10-29)
- DNSSEC — Cloudflare Docs (checked 2026-10-29)
- Custom domains (Pages) — Cloudflare Docs (checked 2026-10-29)
- Cloudflare Registrar FAQ — Cloudflare Docs (8 October 2026)
- Cloudflare domain pricing — cfdomainpricing.com (8 October 2026)
Keep the registration, use Cloudflare for DNS
Register the domain with no KYC, pay in crypto, then point it to Cloudflare from the Nameservers tab.