Book a demo
Book a demo
Login

How to Set Up Cloudflare Enterprise DNS on Namecheap

Updated October 19, 2026 · 6 min read

Use this guide when your domain’s DNS is on Namecheap BasicDNS, FreeDNS, or PremiumDNS and you are activating it on the xCloud Cloudflare Enterprise add-on. Namecheap accepts a CNAME record at the root, and that root CNAME is what Cloudflare verifies and activates the domain through. Do not use Namecheap’s ALIAS record at the root: it blocks verification.

If your DNS is somewhere else, use the matching guide: Google Cloud DNS, AWS Route 53, or Cloudflare without an xCloud integration.

Prerequisites

Namecheap hosting is different. If dig +short NS example.com returns namecheaphosting.com servers, your DNS is managed in cPanel, not in Namecheap’s registrar DNS. Follow the panel’s default records. If cPanel will not accept a CNAME at the root, select Can’t add a CNAME or ALIAS on the root? Use these A records instead and add those A records only after the domain shows Active, as described in the AWS Route 53 guide.

Find your records

Open the domain’s Cloudflare Enterprise page in xCloud. For a site, open the site’s Cloudflare Enterprise page. For an external domain, go to Addons → Cloudflare Enterprise Addons, open the row’s actions menu, and select Manage.

The Ownership Verification panel lists the exact records. For Namecheap, it tells you to point the root at the target with a CNAME record and does not ask for the two A records. Copy every value from the panel.

Purpose Record Moves live traffic?
Ownership proof TXT at _cf-custom-hostname No
Certificate proof CNAME at _acme-challenge, ending in .dcv.cloudflare.com No
Routing CNAME at @ and CNAME at www Yes

Activate the domain

1. Open Advanced DNS

In Namecheap, go to Domain List, select Manage next to the domain, and open Advanced DNS.

Expected result: The Host Records table for the domain is visible.

2. Add the two proof records

Add these records. Enter the host without your domain, because Namecheap appends it automatically.

Type Host Value TTL
TXT Record _cf-custom-hostname The ownership token from the panel Automatic
CNAME Record _acme-challenge The certificate target from the panel Automatic

These records do not affect live traffic, so you can add them at any time.

Expected result: The proof rows in the xCloud panel change to Verified after propagation. Namecheap’s Automatic TTL is 30 minutes, but new records usually appear within a few minutes.

3. Point the root and www at the edge

When you are ready to move traffic, change the routing records in Advanced DNS:

Action Type Host Value
Delete A Record @ Your origin IP
Add CNAME Record @ The root CNAME target from the panel
Add or replace CNAME Record www The www target from the panel

A name can hold only one A or CNAME record, so delete the old @ A record in the same save. Adding the root CNAME is what activates the domain: Cloudflare verifies it as soon as the record points at the edge. Expect a short window of errors while DNS propagates and the certificate finishes.

Expected result: The routing rows change to Verified.

4. Verify and confirm Active

Select Verify Records in the Ownership Verification panel. If your team has a Cloudflare integration connected, the same button reads Verify & Add Records. To refresh the status, use Refresh Status in the page header for an external domain, or open the domain row’s actions menu and select Refresh status for a site.

Expected result: The domain status changes to Active and SSL becomes active shortly after.

Keep both proof records. The _acme-challenge CNAME renews the certificate automatically, and removing it breaks renewal about 90 days later.

Verify it worked

dig @1.1.1.1 +short TXT _cf-custom-hostname.example.com   # the ownership token
dig @1.1.1.1 +short CNAME _acme-challenge.example.com     # ...dcv.cloudflare.com
curl -sI https://example.com | grep -iE 'server|cf-ray'   # server: cloudflare + a cf-ray header
dig +short MX example.com                                 # mail records are still listed

server: cloudflare with a cf-ray header means the edge is serving the site. Also check https://www.example.com and the site’s critical paths.

Root CNAME and email

A CNAME normally hides every other record at the same name, including MX and SPF. Namecheap’s registrar DNS is an exception: xCloud verified on a live Namecheap domain that MX and SPF records keep answering alongside the root CNAME through Google, Cloudflare, and Quad9 resolvers.

If the domain receives mail, including Namecheap email forwarding, run dig +short MX example.com before and after the cutover and confirm the same records come back.

Already stuck at Pending Verification

If the root uses an ALIAS record, the panel can read Found, not accepted yet, or show: “Cloudflare cannot verify this root domain while it already points at Cloudflare.” Namecheap’s ALIAS answers with Cloudflare’s addresses, so Cloudflare refuses to verify it. To recover:

  1. Delete the ALIAS record at @.
  2. Add a CNAME Record at @ pointing at the root target from the panel.
  3. Leave both proof records as they are.
  4. Select Verify Records.

Do not delete and re-add the domain in xCloud. Each new purchase generates a new ownership token, so you would have to update the TXT record again without fixing the cause.

Troubleshooting

Symptom Likely cause Fix
A record shows Pending after you added it The Host field contains the full name, so Namecheap created _cf-custom-hostname.example.com.example.com. Edit the record and enter only the host part.
The root record reads Found, not accepted yet The root uses an ALIAS record. Replace it with a CNAME record at @.
Namecheap will not save the root CNAME An A record or URL redirect record still exists at @. Delete the conflicting @ record in the same save.
Records never appear in public DNS The domain uses different nameservers, such as Namecheap hosting or a previous DNS host. Compare dig +short NS example.com with dig @dns1.registrar-servers.com +short example.com A.
SSL stays pending after the domain is active The certificate proof is missing or still propagating. Confirm the _acme-challenge CNAME answers, then refresh the domain status.

FAQ

Should I use an ALIAS or a CNAME record at the root on Namecheap?

Use a CNAME Record at @. Namecheap’s ALIAS answers with Cloudflare’s addresses, so Cloudflare treats the domain as already on Cloudflare and refuses to verify it.

Do I enter the full record name in the Host field?

No. Enter only the host part, such as _cf-custom-hostname. Namecheap appends your domain automatically, so the full name creates a doubled, broken record.

Will a root CNAME break my email?

On Namecheap’s registrar DNS, xCloud verified that MX and SPF records keep answering alongside the root CNAME. Check your MX records after the cutover to confirm mail is unaffected.

Can I remove the _acme-challenge record after activation?

No. It lets Cloudflare renew the certificate. Removing it breaks the next renewal.