Transfer your domain name to Cloudflare in 2026 (step-by-step)

Most registrars apply a markup on every domain renewal. GoDaddy, for instance, often shows the first year at a rock-bottom price, then charges much more for renewal (€20–30 for a .com that costs ~$9 wholesale at ICANN). Cloudflare Registrar took the opposite approach: zero markup on all TLDs. You pay exactly the ICANN wholesale price plus applicable local taxes. In practice, a .com costs ~$10.44/year in 2026.

Concrete advantages:

• Guaranteed at-cost pricing: no renewal surprises, no "promotional first year" pricing. What you pay in year one is what you pay in year ten.
• Native DNSSEC: Cloudflare activates and manages DNSSEC (Domain Name System Security Extensions) in one click from the interface. On most other registrars, DNSSEC requires manually configuring DS records.
• Registry Lock available: for sensitive domains, registry lock prevents any DNS change or outbound transfer without multi-factor validation. Critical protection against domain hijacking.
• Ultra-fast DNS interface: DNS changes at Cloudflare propagate globally in under one minute via their anycast network. At other registrars, you may wait 24–48h.
• Unified dashboard: if you already use Cloudflare for CDN, WAF or Workers, managing your domains in the same place simplifies administration.

One caveat: Cloudflare Registrar does not yet support all TLDs. .com, .net, .org, .io, and most popular ccTLDs are supported, but some exotic TLDs (.xyz, .shop, .africa) may not be available. Check the official list before starting the procedure.

A failed domain transfer can leave your website or emails unreachable for several days. Verify these 4 points before any action:

1. Active free Cloudflare account: create your account at cloudflare.com if you have not done so already. You do not need a paid plan for the registrar.
2. Admin access at your source registrar: you must be able to log in to your current registrar control panel (OVH, IONOS, Gandi, GoDaddy, etc.) with sufficient rights to unlock the domain and generate the authorisation code (also called EPP code or AuthInfo). If you delegated management to a service provider, obtain the credentials in advance.
3. Domain registered for more than 60 days: ICANN imposes a 60-day lock after any recent registration or transfer. A domain registered less than 2 months ago cannot be transferred — this is a non-negotiable ICANN rule. Check the registration date via a WHOIS lookup.
4. WHOIS privacy disabled at source: some registrars enable WHOIS privacy by default, hiding your personal details. This service can block the transfer confirmation email from being delivered. Disable it temporarily before initiating the transfer.

Bonus — DNS zone backup: before any change, export your current DNS zone (BIND/TXT format available at most registrars). Copy every A, CNAME, MX and TXT record into a file. If anything goes wrong, you can reconstruct the zone in minutes.

Here is the step-by-step procedure, tested on OVH, IONOS and Gandi:

1. Add your domain to Cloudflare (Free plan): from the Cloudflare dashboard, click "Add a Site", enter your domain name, choose the Free plan. Cloudflare automatically scans your existing DNS zone and imports the records it detects. Verify that all MX, A, CNAME and TXT records were imported correctly — manually add any that are missing. Cloudflare then provides 2 nameservers (NS) to note down, e.g. aria.ns.cloudflare.com and boris.ns.cloudflare.com.
2. Unlock the domain at your source registrar: log in to your current registrar. Look for "Unlock domain" or "Disable transfer lock" (each interface differs). On OVH: Domains → select domain → Transfer protection → Disable. On Gandi: domain → Security → Unlock.
3. Retrieve the authorisation code (EPP/AuthInfo): immediately after unlocking, request the transfer authorisation code. It will be emailed to you or displayed directly in the interface. The code looks like a 16-character alphanumeric string. It typically expires in 7 days.
4. Initiate the transfer from Cloudflare Registrar: in Cloudflare, go to Account Home → Registrar → Transfer Domains. Enter your domain, paste the EPP code, confirm the registrant contact details, and proceed to payment (1 year of advance renewal, ~$10 for a .com). Cloudflare sends a confirmation email to the registrant address.
5. Wait for completion (5–7 days): the transfer is initiated and your source registrar has 5 days to approve or reject. Most approve automatically. Cloudflare sends a confirmation email once the transfer is finalised. Your domain is now managed by Cloudflare Registrar.

Important note: throughout the process, your DNS servers remain active — your website and emails are not interrupted. A registrar transfer does not change your DNS records.

Many IT managers confuse these two operations. They produce very different effects:

Criterion	Registrar transfer	NS delegation
What changes	Registrar becomes Cloudflare (domain ownership)	Only DNS servers change, registrar stays the same
Operation duration	5–7 days (ICANN process)	Immediate to 48h (DNS propagation)
Service interruption	None if DNS zone copied correctly	None if DNS zone copied correctly
Domain renewal	Managed by Cloudflare (at-cost)	Managed by current registrar (variable price)
Cost	1 year renewal paid upfront	Free

When to choose a full transfer? When you want to benefit from Cloudflare at-cost renewal pricing long-term, or centralise registrar + DNS + CDN management in one place.

When to choose NS delegation only? When you want ultra-fast Cloudflare DNS and CDN benefits, but your domain is still in the ICANN lock period (under 60 days), or you prefer to keep your current registrar for other reasons (bundled contract, local compliance, etc.).

AfricWebHosting recommendation: for clients who entrust us with their cloud hosting management, we first recommend NS delegation to Cloudflare. This allows instant DNS record management (Microsoft 365 MX, SPF/DKIM/DMARC, site A record) without waiting for the transfer process. The full transfer can follow later if the client also wants the at-cost renewal pricing.

Once the transfer is confirmed by Cloudflare, go through this list before closing the task:

1. Verify your MX records: send a test email from an external mailbox (Gmail, Yahoo) to your domain. Confirm the message arrives. If you use Microsoft 365, the MX record must point to yourdomain-com.mail.protection.outlook.com.
2. Validate SPF, DKIM and DMARC: use a tool like MXToolbox or dmarcian to verify that SPF and DMARC TXT records are present and valid, and that DKIM CNAMEs resolve correctly. An error here sends your outbound emails to spam.
3. Enable DNSSEC: in Cloudflare DNS → DNSSEC → Enable. Cloudflare automatically generates DS records and publishes them to the TLD registry. Activation takes a few minutes. Verify on Verisign DNSSEC Analyzer.
4. Enable "Always Use HTTPS": in Cloudflare SSL/TLS → Edge Certificates → Always Use HTTPS → On. This forces all HTTP requests to HTTPS, even if your application does not yet handle the redirect.
5. Configure Page Rules or Redirect Rules: if you had 301 redirects at your former registrar or host (e.g. www to apex, or specific subdomains), recreate them in Cloudflare Rules.
6. Check the domain expiry date: in Cloudflare Registrar, verify the expiry date has been extended by one year (the renewal paid during transfer). Enable auto-renewal.

If you experience email issues after transfer, see our guide Migrating to Microsoft 365 for the specific DNS records to configure.