# How to Set Up Cloudflare Enterprise DNS on Cloudflare Without an Integration

> Activate a Cloudflare Enterprise domain whose DNS is in your own Cloudflare account when no xCloud Cloudflare integration manages it: add the records yourself, with CNAMEs set to DNS only.

Use this guide when your domain's DNS is in **your own Cloudflare account** and xCloud does **not** manage it through a Cloudflare integration. In that case nothing is added for you: you add the records in the Cloudflare dashboard yourself, with every CNAME set to **DNS only (grey cloud)**. Cloudflare flattens the root CNAME and activates the domain through it, so you do not need the two A records.

If your DNS is somewhere else, use the matching guide: [Google Cloud DNS](/docs/cloudflare-enterprise-dns-setup-google-cloud-dns/), [AWS Route 53](/docs/cloudflare-enterprise-dns-setup-aws-route-53/), or [Namecheap](/docs/cloudflare-enterprise-dns-setup-namecheap/).

## Prerequisites

-   You have bought Cloudflare Enterprise for the domain. See [How to Activate the Cloudflare Enterprise Addon](/docs/how-to-activate-the-cloudflare-enterprise-addon/) or [How to Use Cloudflare Enterprise for External Domains](/docs/how-to-use-cloudflare-enterprise-for-external-domains/).
-   The domain's nameservers are Cloudflare's. Check with `dig +short NS example.com`; the answer lists `*.ns.cloudflare.com` servers.
-   You can edit DNS records for the zone in the Cloudflare dashboard.
-   The website already loads from its current origin.

## Check whether xCloud manages the records

Open the domain's Cloudflare Enterprise page in xCloud. For a site, open the site's **Cloudflare Enterprise** page. For an external domain, go to **Addons → Cloudflare Enterprise Addons**, open the row's actions menu, and select **Manage**.

-   **Managed by xCloud:** the page shows **Auto Manage DNS Records on Cloudflare** with a **Connected** badge and the message "These records are managed automatically in your connected Cloudflare account. Nothing to add manually." You do not need this guide.
-   **Not managed by xCloud:** there is no auto-manage banner. Follow the steps below.

Use the banner, not the button label, to decide. The verify button can read **Verify & Add Records** whenever your team has any Cloudflare integration, even one that does not cover this zone.

A connected Cloudflare account alone is not enough. The integration must cover this specific zone and be able to write its records. If you would rather let xCloud manage them, connect the zone first; see [Using xCloud with Cloudflare for DNS management](/docs/using-xcloud-with-cloudflare-for-dns-management/).

## What you are creating

The **Ownership Verification** panel lists the records for your domain. Copy every value from the panel.

| Purpose | Record | Proxy status |
| --- | --- | --- |
| Routing and verification | CNAME at `@` (root) | DNS only |
| Routing | CNAME at `www` | DNS only |
| Certificate proof, if the panel lists it | CNAME at `_acme-challenge` | DNS only |
| Ownership proof | TXT at `_cf-custom-hostname` | Not applicable |

Because the zone is on Cloudflare's nameservers, the panel hides the two root A records. Cloudflare flattens the root CNAME, so the root needs no other record. The panel always lists the ownership TXT and counts it toward the verified total, so add it. On its own, though, it does not activate a zone on Cloudflare's nameservers: the root CNAME does.

## Activate the domain

### 1. Open the zone's DNS records

In the Cloudflare dashboard, select the account and domain, then open **DNS → Records**.

**Expected result:** The zone's record list is visible.

### 2. Add the CNAME records as DNS only

Add or edit these records. For each one, switch **Proxy status** off so the cloud icon is grey and the record reads **DNS only**.

| Type | Name | Target | Proxy status |
| --- | --- | --- | --- |
| CNAME | `@` | The root target from the panel | DNS only |
| CNAME | `www` | The www target from the panel | DNS only |
| CNAME | `_acme-challenge` | The certificate target from the panel, if listed | DNS only |
| TXT | `_cf-custom-hostname` | The ownership token from the panel | Not applicable |

A name can hold only one A, AAAA, or CNAME record. If `@` or `www` already has an A, AAAA, or CNAME record, edit that record instead of adding a second one. Note the old value first, so you can roll back.

Adding the root CNAME is what activates the domain and moves live traffic. Expect a short window of errors while DNS updates and the certificate finishes.

**Expected result:** The records are saved with a grey cloud.

### 3. Verify and wait for Active

Select **Verify Records** in the **Ownership Verification** panel. If your team has a Cloudflare integration connected, the same button reads **Verify & Add Records**. To refresh the status, use **Refresh Status** in the page header for an external domain, or open the domain row's actions menu and select **Refresh status** for a site.

**Expected result:** The routing rows change to **Verified**, then the domain status changes to **Active** and SSL becomes active.

If the panel shows "Your DNS is hosted on Cloudflare, so this domain is verified by the routing record rather than by the ownership TXT," the root CNAME is missing, proxied, or pointing at the wrong target. Correct it and verify again.

## Verify it worked

```bash
dig +short NS example.com                                  # *.ns.cloudflare.com
curl -sI https://example.com | grep -iE 'server|cf-ray'    # server: cloudflare + a cf-ray header
curl -sI https://www.example.com | grep -iE 'server|cf-ray'
```

Also check the site's critical paths, such as login, forms, and checkout. In the xCloud panel, the domain should read **Active** with bandwidth usage starting to update.

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| The domain stays at **Pending Verification** | A record is proxied (orange cloud), so it answers with your account's Cloudflare addresses instead of the xCloud target. | Switch every record to **DNS only**, then select **Verify Records**. |
| You added the ownership TXT but the domain is still pending | Cloudflare does not activate a zone on its own nameservers through the TXT alone. | Add the root CNAME as DNS only. It is the record that activates the domain. |
| The banner says records are managed automatically, but they are missing | The integration does not cover this zone or could not write the records. | Add the records manually as described here, or reconnect the integration with access to the zone. |
| Cloudflare will not save the CNAME at `@` or `www` | An A, AAAA, or CNAME record already exists at that name. | Edit the existing record instead of adding a new one. |
| The site breaks after the cutover | The target is wrong or the origin is unavailable. | Restore the previous record value, check the target against the panel, then try again. |

## FAQ

### Why doesn't xCloud add the records for me?

xCloud manages records automatically only when a connected Cloudflare integration covers the domain's zone and can write to it. Without that integration, you add the records in your Cloudflare dashboard.

### Do I need the ownership TXT record or the two A records?

Add the ownership TXT, because the panel lists and counts it, but it does not activate the domain on its own: the root CNAME does. You do not need the two A records, because Cloudflare flattens a root CNAME.

### Should the records be proxied?

No. Set every record to **DNS only** (grey cloud). A proxied record answers with Cloudflare's addresses from your own account instead of pointing at the xCloud edge target.

### How long can the domain stay unverified?

Cloudflare deletes a custom hostname that never validates after seven days, so add the routing records soon after purchase.