How to Set Up Cloudflare Enterprise DNS on Cloudflare Without an Integration

Use this guide when your domain’s DNS is in your own Cloudflare account and xCloud does not manage it through a Cloudflare integration. In that case nothing is added for you: you add the records in the Cloudflare dashboard yourself, with every CNAME set to DNS only (grey cloud). Cloudflare flattens the root CNAME and activates the domain through it, so you do not need the two A records.

If your DNS is somewhere else, use the matching guide: Google Cloud DNS, AWS Route 53, or Namecheap.

Prerequisites

• You have bought Cloudflare Enterprise for the domain. See How to Activate the Cloudflare Enterprise Addon or How to Use Cloudflare Enterprise for External Domains.
• The domain’s nameservers are Cloudflare’s. Check with dig +short NS example.com; the answer lists *.ns.cloudflare.com servers.
• You can edit DNS records for the zone in the Cloudflare dashboard.
• The website already loads from its current origin.

Check whether xCloud manages the records

Open the domain’s Cloudflare Enterprise page in xCloud. For a site, open the site’s Cloudflare Enterprise page. For an external domain, go to Addons → Cloudflare Enterprise Addons, open the row’s actions menu, and select Manage.

• Managed by xCloud: the page shows Auto Manage DNS Records on Cloudflare with a Connected badge and the message “These records are managed automatically in your connected Cloudflare account. Nothing to add manually.” You do not need this guide.
• Not managed by xCloud: there is no auto-manage banner. Follow the steps below.

Use the banner, not the button label, to decide. The verify button can read Verify & Add Records whenever your team has any Cloudflare integration, even one that does not cover this zone.

A connected Cloudflare account alone is not enough. The integration must cover this specific zone and be able to write its records. If you would rather let xCloud manage them, connect the zone first; see Using xCloud with Cloudflare for DNS management.

What you are creating

The Ownership Verification panel lists the records for your domain. Copy every value from the panel.

Purpose	Record	Proxy status
Routing and verification	CNAME at @ (root)	DNS only
Routing	CNAME at www	DNS only
Certificate proof, if the panel lists it	CNAME at _acme-challenge	DNS only
Ownership proof	TXT at _cf-custom-hostname	Not applicable

Because the zone is on Cloudflare’s nameservers, the panel hides the two root A records. Cloudflare flattens the root CNAME, so the root needs no other record. The panel always lists the ownership TXT and counts it toward the verified total, so add it. On its own, though, it does not activate a zone on Cloudflare’s nameservers: the root CNAME does.

Activate the domain

1. Open the zone’s DNS records

In the Cloudflare dashboard, select the account and domain, then open DNS → Records.

Expected result: The zone’s record list is visible.

2. Add the CNAME records as DNS only

Add or edit these records. For each one, switch Proxy status off so the cloud icon is grey and the record reads DNS only.

Type	Name	Target	Proxy status
CNAME	@	The root target from the panel	DNS only
CNAME	www	The www target from the panel	DNS only
CNAME	_acme-challenge	The certificate target from the panel, if listed	DNS only
TXT	_cf-custom-hostname	The ownership token from the panel	Not applicable

A name can hold only one A, AAAA, or CNAME record. If @ or www already has an A, AAAA, or CNAME record, edit that record instead of adding a second one. Note the old value first, so you can roll back.

Adding the root CNAME is what activates the domain and moves live traffic. Expect a short window of errors while DNS updates and the certificate finishes.

Expected result: The records are saved with a grey cloud.

3. Verify and wait for Active

Select Verify Records in the Ownership Verification panel. If your team has a Cloudflare integration connected, the same button reads Verify & Add Records. To refresh the status, use Refresh Status in the page header for an external domain, or open the domain row’s actions menu and select Refresh status for a site.

Expected result: The routing rows change to Verified, then the domain status changes to Active and SSL becomes active.

If the panel shows “Your DNS is hosted on Cloudflare, so this domain is verified by the routing record rather than by the ownership TXT,” the root CNAME is missing, proxied, or pointing at the wrong target. Correct it and verify again.

Verify it worked

dig +short NS example.com                                  # *.ns.cloudflare.com
curl -sI https://example.com | grep -iE 'server|cf-ray'    # server: cloudflare + a cf-ray header
curl -sI https://www.example.com | grep -iE 'server|cf-ray'

Also check the site’s critical paths, such as login, forms, and checkout. In the xCloud panel, the domain should read Active with bandwidth usage starting to update.

Troubleshooting

Symptom	Likely cause	Fix
The domain stays at Pending Verification	A record is proxied (orange cloud), so it answers with your account’s Cloudflare addresses instead of the xCloud target.	Switch every record to DNS only, then select Verify Records.
You added the ownership TXT but the domain is still pending	Cloudflare does not activate a zone on its own nameservers through the TXT alone.	Add the root CNAME as DNS only. It is the record that activates the domain.
The banner says records are managed automatically, but they are missing	The integration does not cover this zone or could not write the records.	Add the records manually as described here, or reconnect the integration with access to the zone.
Cloudflare will not save the CNAME at @ or www	An A, AAAA, or CNAME record already exists at that name.	Edit the existing record instead of adding a new one.
The site breaks after the cutover	The target is wrong or the origin is unavailable.	Restore the previous record value, check the target against the panel, then try again.

FAQ

Why doesn’t xCloud add the records for me?

xCloud manages records automatically only when a connected Cloudflare integration covers the domain’s zone and can write to it. Without that integration, you add the records in your Cloudflare dashboard.

Do I need the ownership TXT record or the two A records?

Add the ownership TXT, because the panel lists and counts it, but it does not activate the domain on its own: the root CNAME does. You do not need the two A records, because Cloudflare flattens a root CNAME.

Should the records be proxied?

No. Set every record to DNS only (grey cloud). A proxied record answers with Cloudflare’s addresses from your own account instead of pointing at the xCloud edge target.

How long can the domain stay unverified?

Cloudflare deletes a custom hostname that never validates after seven days, so add the routing records soon after purchase.