All guides

Migrating your DNS away from Cloudflare without downtime

·7 min read

Moving DNS is a straightforward job; when it causes an outage, the cause is almost always the order of operations. The correct order is: build the complete record set at the new provider first, then switch nameservers. Do it the other way round and the domain starts answering from servers that are not ready, and the site disappears for a few hours.

A day before: lower your TTL

TTL controls how long the internet caches a DNS record. At least 24 hours before the move, drop your existing records to a 300-second TTL. Skip this and, if something goes wrong mid-migration, your ability to roll back is delayed by the old TTL — usually hours.

The real trap: proxied records do not show your real IP

A record marked with the orange cloud in Cloudflare answers the world with a Cloudflare address. When you export your records — or simply read them off the dashboard — the value you see may not be your server's actual address. Copy those records verbatim into a new provider and traffic still goes to Cloudflare, which no longer has a configuration for your domain, and you get an error.

Before migrating, confirm the true origin address for every proxied record from your hosting panel or server provider. Skipping this is what produces the classic "the migration finished but the site will not load" state.

Get the full record list

These are the ones people commonly miss:

  • MX records — miss these and mail stops flowing; inbound messages bounce.
  • SPF, DKIM and DMARC TXT records — miss these and mail still sends but lands in spam, which typically takes days to notice.
  • Verification TXT records — ownership tokens for Google Search Console, Microsoft 365 and similar.
  • CAA records — if present, they can stop your new provider from issuing a certificate.
  • Subdomains — everything beyond www, especially panel and API hostnames.

The sequence

  1. Lower existing records to a 300-second TTL and wait a day.
  2. Export every record, and confirm the real IP behind each proxied one.
  3. Create the zone at the new provider and enter the records. OZELNS imports from Cloudflare, cPanel, Virtualmin and Plesk in one click.
  4. Before switching nameservers, query the new servers directly and compare the answers with the current ones.
  5. Change the nameservers at your domain registrar.
  6. Watch propagation. Usually minutes; on some networks a few hours.
  7. Once the site, email and SSL all check out, raise the TTL back to normal (3600).

What happens to your SSL certificate?

The certificate Cloudflare issued stops being valid for you once you leave. Your new provider needs to issue one automatically; OZELNS does that through Let's Encrypt, wildcard included, and handles renewal itself. The certificate is normally ready within a few minutes of the nameserver switch.

Once the migration is done, the next job is auditing whether your real server address leaks through older records: how your origin IP leaks.

Protect your site with OZELNS

Authoritative DNS and reverse-proxy DDoS protection in one panel. Free plan available, no card required.

See plansTalk to us