Connect Cloudflare DNS

RedundantDNS talks to Cloudflare with an API token. The token is encrypted with your organization's key as soon as it reaches us, is never shown again, and is only used to read and write the DNS zones you attach.

Pick the access level that matches how much you want to delegate:

Read this first: how Cloudflare fits a multi-provider zone

Cloudflare works as one of the providers of a RedundantDNS zone. Four things differ from the others:

• Multi-provider DNS. By default Cloudflare only answers with its own two nameservers at the zone apex and expects the registrar to delegate to Cloudflare alone. Its Multi-provider DNS setting makes Cloudflare honour NS records added at the apex and activate the zone even when the registrar also lists other providers. RedundantDNS turns the setting on for you: when it creates a zone, when it adopts an existing one and again before it writes the apex NS set. The apex NS set on Cloudflare then lists every provider of the zone, like on the others. The API token needs permission to edit the zone's DNS settings (see the tables below); without it every other record still syncs and the attachment shows the error.
• Zone status. A zone whose registrar does not list Cloudflare's nameservers yet stays pending (Cloudflare still serves it). If Cloudflare ever marks the zone moved, re-check the nameservers in the Cloudflare dashboard (Overview → Re-check now). The dashboard shows the zone status on the attachment.
• Proxy is always off. RedundantDNS writes every record with Proxy status: DNS only, so all providers answer the same addresses. If you turn the orange cloud on for a record in Cloudflare, Cloudflare answers with its own addresses and your providers disagree.
• Cloudflare Registrar cannot use other nameservers at all: see below.

TTLs on Cloudflare go from 60 seconds to one day (86,400 seconds); a zone attached to Cloudflare accepts only TTLs in that range.

1. Find your account ID

In the Cloudflare dashboard open Account home; the account ID is in the account's menu (⋯ → Copy account ID), or on any zone's Overview page, bottom right.

2a. Create and manage zones

My Profile → API Tokens → Create Token → Create Custom Token:

Account resources: Include · your account. Zone resources: Include · All zones from an account · your account. Create the token and copy it (it is shown once).

In RedundantDNS, Providers → Add connection: provider Cloudflare, access level Create and manage zones, paste the API token and the account ID, then click Test and save. We check the token by listing the account's zones.

2b. Manage an existing zone

Create a custom token restricted to the one zone:

Zone resources: Include · Specific zone · your zone. Zone · Read lets RedundantDNS check the zone name and read its nameservers and status; DNS · Edit lets it edit the records; DNS Settings · Edit lets it turn on Multi-provider DNS. The token cannot add or delete zones.

Add the connection with access level Manage an existing zone (the account ID can stay empty). The token is checked when you attach the connection to a zone: open the zone, Providers → Attach, pick the connection and paste the zone ID (the zone's Overview page, bottom right). We verify that the zone holds the same domain and that the token can read its records.

What RedundantDNS writes

• Every record set you manage in the dashboard. Cloudflare stores single records; RedundantDNS replaces a record set by deleting its records and adding the new ones in the same batch request (at most 200 operations per request).
• The apex NS set: one NS record per nameserver of the other providers of the zone. Cloudflare's own nameservers are not records; Cloudflare serves them itself.
• The zone's Multi-provider DNS setting (turned on, never off).
• Nothing in the SOA.

Cloudflare Registrar

Domains registered at Cloudflare Registrar must use Cloudflare's nameservers: the registrar does not accept any other nameserver (Cloudflare Registrar FAQ). The domain's delegation can therefore never list the other providers of the zone, and RedundantDNS cannot give that apex a second provider. The delegation check detects it: it looks the domain up in RDAP, and when the registrar is Cloudflare and the delegation is not complete, the zone's Delegation tab explains it. You have three options:

1. Transfer the registration to another registrar, then set the nameservers RedundantDNS shows you. A domain cannot be transferred in its first 60 days after registration or after a previous transfer (an ICANN rule). Cloudflare explains the steps in Transfer your domain out of Cloudflare.

2. Use subdomain redundancy. Keep the apex on Cloudflare and create the names that matter as their own zones in RedundantDNS, for example api.example.com. When the parent zone example.com is also in RedundantDNS (Cloudflare attached with either access level), the platform writes the child's NS delegation into it and keeps it up to date, so api.example.com is served by several providers even though example.com is not.

3. Keep Cloudflare as one provider of the zone and accept that the apex stays delegated to Cloudflare only. The other providers still hold a synchronized copy you can switch to after a transfer.

Revoking access

Roll or delete the API token at any time. Then remove the connection in Providers; zones keep being served by Cloudflare exactly as they are.