Question 4 of 6
Cloudflare Nameservers
Customer ticket
Subject: Cloudflare Nameservers
How are Cloudflare's nameservers different from the DNS provided by Google DNS or OpenDNS? Can I delegate to Cloudflare nameservers while still using my host’s DNS?
1. Email reply to the customer
Hi there,
Thanks for your questions. These two get mixed up a lot, so here is how they differ, followed by your options for keeping your host’s DNS.
Authoritative nameservers vs. public resolvers
DNS has two different kinds of server, and they do opposite jobs:
- Recursive resolvers, such as Google Public DNS (8.8.8.8), OpenDNS, or Cloudflare’s own 1.1.1.1. These are what your visitors’ devices or ISPs ask. They don’t hold anyone’s records. They look them up for the visitor by following the chain from the root servers, to
.com, to the domain’s nameservers, and then cache the answer. - Authoritative nameservers, such as the two
*.ns.cloudflare.comservers assigned to your zone. These hold the actual records for your domain and are the final source of truth that resolvers ask. When you use Cloudflare DNS, you manage your records in our dashboard, and because our nameservers return Cloudflare proxy IPs for orange-clouded records, your traffic passes through Cloudflare’s CDN and security features.
So Google DNS and OpenDNS can’t host your domain at all. They are the services that look up whatever your authoritative provider publishes. Changing the resolver on your own laptop has no effect on how anyone else reaches your site.
# Ask a resolver (recursive): what does the world see?
dig example.com @8.8.8.8
# Ask the authoritative source directly: what is published?
dig example.com NS +short
dig example.com @xxx.ns.cloudflare.comCan I use Cloudflare but keep my host’s DNS?
Yes, depending on your plan. There are three ways to set this up:
- Full setup (all plans, recommended): you change the nameservers at your registrar to the two Cloudflare nameservers and manage DNS in Cloudflare. Your host still hosts the website. You just copy its records (A, CNAME, MX and so on) into Cloudflare, and our scan usually imports most of them automatically. This is the simplest option and works on the Free plan.
- CNAME (partial) setup (Business and Enterprise plans): your host stays the authoritative DNS provider. You add the zone to Cloudflare, verify ownership with a TXT record, then point the hostnames you want to protect at Cloudflare with a CNAME such as
www.example.com CNAME www.example.com.cdn.cloudflare.net. The apex (example.com) can only be proxied this way if your host supports CNAME flattening. Partial setup isn’t available for domains registered with Cloudflare Registrar. - Secondary DNS (Enterprise): your host remains primary and Cloudflare receives copies of your records by zone transfer (AXFR/IXFR) and serves them alongside your host. Proxying can then be enabled for selected records.
In short, you can’t simply “delegate to Cloudflare’s nameservers” and still have your host answer DNS: delegation means our nameservers become authoritative. If you need your host to remain authoritative, the CNAME setup is the right choice. If you’re on Free or Pro, a full setup gives you the same CDN and security benefits, and your website stays at your host.
If you tell me which plan you’re on and which hostnames you’d like on Cloudflare, I can walk you through the exact steps.
Kind regards,
Marwan
Cloudflare Customer Support
2. Thought process
The question has two parts, and the first rests on a common misconception, so I handled them separately:
- Concept: I contrast authoritative and recursive servers in plain language and explain what each is for. I mention 1.1.1.1 to head off “but Cloudflare is a resolver too”, because Cloudflare runs both kinds, and they are separate products.
- Options: “Delegate to Cloudflare while still using my host’s DNS” is slightly self-contradictory, since delegating means Cloudflare becomes authoritative. I gently correct that, then give the real options. I checked their plan availability in the current docs: CNAME (partial) setup is Business and Enterprise only (not on Cloudflare Registrar domains, and the apex needs CNAME flattening at the host), and Secondary DNS is Enterprise only.
- Recommendation: most customers who ask this want to keep their hosting, not necessarily their host’s DNS, so I explain that a full setup keeps the site at the host and works on every plan.
Since I can see their account, I’d also check their plan before sending, and remove any option they can’t use or point them to the upgrade path.
3. Tools I would use, and why
| Tool | Why |
|---|---|
dig +trace / dig NS | Shows the delegation chain (root, TLD, authoritative) and makes the resolver/authoritative split concrete. |
dig @8.8.8.8 vs dig @<cf-ns> | Compares what a public resolver returns with what the authoritative server publishes. |
whois / registrar panel | Confirms where the domain is currently delegated, and whether it uses Cloudflare Registrar (no partial setup). |
Cloudflare dashboard (Overview, DNS settings, plan) | Checks zone setup type (full, partial, secondary) and plan, so I only offer options the customer can use. |
developers.cloudflare.com/dns/zone-setups | Source for current plan availability and setup steps to link the customer to. |