# How to Set Up Cloudflare Enterprise DNS on Namecheap

> Activate a Cloudflare Enterprise domain whose DNS is on Namecheap: add the proof records, then point the root with a CNAME record (not ALIAS) and www with a CNAME.

Use this guide when your domain's DNS is on **Namecheap BasicDNS, FreeDNS, or PremiumDNS** and you are activating it on the xCloud Cloudflare Enterprise add-on. Namecheap accepts a **CNAME record at the root**, and that root CNAME is what Cloudflare verifies and activates the domain through. Do not use Namecheap's ALIAS record at the root: it blocks verification.

If your DNS is somewhere else, use the matching guide: [Google Cloud DNS](/docs/cloudflare-enterprise-dns-setup-google-cloud-dns/), [AWS Route 53](/docs/cloudflare-enterprise-dns-setup-aws-route-53/), or [Cloudflare without an xCloud integration](/docs/cloudflare-enterprise-dns-setup-cloudflare-without-integration/).

## Prerequisites

-   You have bought Cloudflare Enterprise for the domain. See [How to Activate the Cloudflare Enterprise Addon](/docs/how-to-activate-the-cloudflare-enterprise-addon/) or [How to Use Cloudflare Enterprise for External Domains](/docs/how-to-use-cloudflare-enterprise-for-external-domains/).
-   The domain uses Namecheap's registrar nameservers. Check with `dig +short NS example.com`; the answer should be `dns1.registrar-servers.com` and `dns2.registrar-servers.com`.
-   The website already loads from its current origin.
-   You can open **Advanced DNS** for the domain in your Namecheap account.

**Namecheap hosting is different.** If `dig +short NS example.com` returns `namecheaphosting.com` servers, your DNS is managed in cPanel, not in Namecheap's registrar DNS. Follow the panel's default records. If cPanel will not accept a CNAME at the root, select **Can't add a CNAME or ALIAS on the root? Use these A records instead** and add those A records only after the domain shows **Active**, as described in the [AWS Route 53 guide](/docs/cloudflare-enterprise-dns-setup-aws-route-53/).

## Find your records

Open the domain's Cloudflare Enterprise page in xCloud. For a site, open the site's **Cloudflare Enterprise** page. For an external domain, go to **Addons → Cloudflare Enterprise Addons**, open the row's actions menu, and select **Manage**.

The **Ownership Verification** panel lists the exact records. For Namecheap, it tells you to point the root at the target with a CNAME record and does not ask for the two A records. Copy every value from the panel.

| Purpose | Record | Moves live traffic? |
| --- | --- | --- |
| Ownership proof | TXT at `_cf-custom-hostname` | No |
| Certificate proof | CNAME at `_acme-challenge`, ending in `.dcv.cloudflare.com` | No |
| Routing | CNAME at `@` and CNAME at `www` | **Yes** |

## Activate the domain

### 1. Open Advanced DNS

In Namecheap, go to **Domain List**, select **Manage** next to the domain, and open **Advanced DNS**.

**Expected result:** The **Host Records** table for the domain is visible.

### 2. Add the two proof records

Add these records. Enter the host **without** your domain, because Namecheap appends it automatically.

| Type | Host | Value | TTL |
| --- | --- | --- | --- |
| TXT Record | `_cf-custom-hostname` | The ownership token from the panel | Automatic |
| CNAME Record | `_acme-challenge` | The certificate target from the panel | Automatic |

These records do not affect live traffic, so you can add them at any time.

**Expected result:** The proof rows in the xCloud panel change to **Verified** after propagation. Namecheap's Automatic TTL is 30 minutes, but new records usually appear within a few minutes.

### 3. Point the root and www at the edge

When you are ready to move traffic, change the routing records in Advanced DNS:

| Action | Type | Host | Value |
| --- | --- | --- | --- |
| Delete | A Record | `@` | Your origin IP |
| Add | CNAME Record | `@` | The root CNAME target from the panel |
| Add or replace | CNAME Record | `www` | The www target from the panel |

A name can hold only one A or CNAME record, so delete the old `@` A record in the same save. Adding the root CNAME is what activates the domain: Cloudflare verifies it as soon as the record points at the edge. Expect a short window of errors while DNS propagates and the certificate finishes.

**Expected result:** The routing rows change to **Verified**.

### 4. Verify and confirm Active

Select **Verify Records** in the **Ownership Verification** panel. If your team has a Cloudflare integration connected, the same button reads **Verify & Add Records**. To refresh the status, use **Refresh Status** in the page header for an external domain, or open the domain row's actions menu and select **Refresh status** for a site.

**Expected result:** The domain status changes to **Active** and SSL becomes active shortly after.

Keep both proof records. The `_acme-challenge` CNAME renews the certificate automatically, and removing it breaks renewal about 90 days later.

## Verify it worked

```bash
dig @1.1.1.1 +short TXT _cf-custom-hostname.example.com   # the ownership token
dig @1.1.1.1 +short CNAME _acme-challenge.example.com     # ...dcv.cloudflare.com
curl -sI https://example.com | grep -iE 'server|cf-ray'   # server: cloudflare + a cf-ray header
dig +short MX example.com                                 # mail records are still listed
```

`server: cloudflare` with a `cf-ray` header means the edge is serving the site. Also check `https://www.example.com` and the site's critical paths.

## Root CNAME and email

A CNAME normally hides every other record at the same name, including MX and SPF. Namecheap's registrar DNS is an exception: xCloud verified on a live Namecheap domain that MX and SPF records keep answering alongside the root CNAME through Google, Cloudflare, and Quad9 resolvers.

If the domain receives mail, including Namecheap email forwarding, run `dig +short MX example.com` before and after the cutover and confirm the same records come back.

## Already stuck at Pending Verification

If the root uses an ALIAS record, the panel can read **Found, not accepted yet**, or show: "Cloudflare cannot verify this root domain while it already points at Cloudflare." Namecheap's ALIAS answers with Cloudflare's addresses, so Cloudflare refuses to verify it. To recover:

1.  Delete the ALIAS record at `@`.
2.  Add a **CNAME Record** at `@` pointing at the root target from the panel.
3.  Leave both proof records as they are.
4.  Select **Verify Records**.

Do not delete and re-add the domain in xCloud. Each new purchase generates a new ownership token, so you would have to update the TXT record again without fixing the cause.

## Troubleshooting

| Symptom | Likely cause | Fix |
| --- | --- | --- |
| A record shows **Pending** after you added it | The Host field contains the full name, so Namecheap created `_cf-custom-hostname.example.com.example.com`. | Edit the record and enter only the host part. |
| The root record reads **Found, not accepted yet** | The root uses an ALIAS record. | Replace it with a CNAME record at `@`. |
| Namecheap will not save the root CNAME | An A record or URL redirect record still exists at `@`. | Delete the conflicting `@` record in the same save. |
| Records never appear in public DNS | The domain uses different nameservers, such as Namecheap hosting or a previous DNS host. | Compare `dig +short NS example.com` with `dig @dns1.registrar-servers.com +short example.com A`. |
| SSL stays pending after the domain is active | The certificate proof is missing or still propagating. | Confirm the `_acme-challenge` CNAME answers, then refresh the domain status. |

## FAQ

### Should I use an ALIAS or a CNAME record at the root on Namecheap?

Use a **CNAME Record** at `@`. Namecheap's ALIAS answers with Cloudflare's addresses, so Cloudflare treats the domain as already on Cloudflare and refuses to verify it.

### Do I enter the full record name in the Host field?

No. Enter only the host part, such as `_cf-custom-hostname`. Namecheap appends your domain automatically, so the full name creates a doubled, broken record.

### Will a root CNAME break my email?

On Namecheap's registrar DNS, xCloud verified that MX and SPF records keep answering alongside the root CNAME. Check your MX records after the cutover to confirm mail is unaffected.

### Can I remove the _acme-challenge record after activation?

No. It lets Cloudflare renew the certificate. Removing it breaks the next renewal.