Cloudflare Docs
DNS
DNS
Edit this page
Give us feedback
Set theme to dark (⇧+D)

Set up a child domain

When using a subdomain setup, the steps to create a child domain depend on the parent domain’s setup and whether the child domain already exists.

Subdomain setup is only available for Enterprise accounts.


​​ Available setups

Parent zoneChild zoneAvailable
Full or SecondaryFullYes
Full or SecondarySecondaryYes
Full or SecondaryPartialNo
PartialFullYes
PartialSecondaryYes
PartialPartialYes

​​ Parent domain on full setup

If the parent domain is using a full setup1, your child domain setup depends on whether the child domain already exists.

​​ Subdomain does not exist in the parent domain

If you have not yet created a DNS record covering your child domain in the parent zone:

  1. Add the child domain to the parent domain’s Cloudflare account or another account.

  2. Get the nameserver names for the child domain. These will not be the same nameservers as the parent domain.

  3. Within the DNS > Records of the parent zone, add two NS records for the subdomain you want to delegate.

    For example, if you delegated www.example.com, you might add the following records to example.com:

    TypeNameContent
    NSwwwjohn.ns.cloudflare.com
    NSwwwmelinda.ns.cloudflare.com
  4. After a few minutes, the child domain will be active.

  5. Create the various DNS records needed for your child domain.

  6. (Optional) Enable DNSSEC on the child domain.

​​ Subdomain already exists in the parent domain

If you have already created a DNS record covering your child domain in the parent zone:

  1. Add the child domain to the parent domain’s Cloudflare account or another account.

  2. In your child domain, re-create all DNS records that relate to your child domain. This includes all DNS records deeper than the delegated subdomain, meaning that if you are delegating www.example.com, you should also move over records for api.www.example.com.

  3. If the parent zone is in Cloudflare, make sure that you migrate over any settings (WAF custom rules, Rules, Workers, and more) that might be needed for the child domain.

  4. In the child domain zone, order an advanced SSL certificate that covers the child subdomain and any deeper subdomains (if present).

  5. Get the nameserver names for the child domain. These will not be the same nameservers as the parent domain.

  6. Within the DNS > Records of the parent zone, delete all non-address records (meaning everything except for A, AAAA, and CNAME records) referencing the child domain or any of its deeper subdomains.

  7. Within the DNS > Records of the parent zone, leave one address record referencing the child domain and delete the rest.

  8. Change the type of the last address record to NS and its content to one of the child domain’s nameserver names. If the parent domain is in Cloudflare, use a PATCH request to achieve this.

  9. Within the DNS > Records of the parent zone, create the second NS record in the parent zone for the subdomain you want to delegate.

    For example, if you delegated www.example.com, you might add the following records to example.com:

    TypeNameContent
    NSwwwjohn.ns.cloudflare.com
  10. Flush the address records of your child domain in public resolvers ( 1.1.1.1 and 8.8.8.8).

  11. Within a short period of time, the child domain should be active.

  12. (Optional) Enable DNSSEC on the child domain.


​​ Parent domain on partial setup

If the parent domain is using a partial setup2, your child domain setup depends on whether the child domain already exists.

​​ Subdomain does not exist in the parent domain

If you have not yet created a DNS record covering your child domain in the parent zone:

  1. Add the child domain to the parent domain’s Cloudflare account or another account.
  2. Complete the configuration accordingly for Full or Secondary setup.
  3. After creating the DNS records on the child zone, add the Cloudflare nameservers as NS records at your external DNS provider.
  4. Within a short period of time, the child domain should be active.
  1. Add the child domain to the parent domain’s Cloudflare account or another account.
  2. Convert the child zone to a partial setup.
  3. Create the various DNS records needed for your child domain.
  4. Add the TXT verification record at your authoritative DNS provider.
  5. Within a short period of time, the child domain should be active.
  6. Add a CNAME record at your authoritative DNS provider.

​​ Subdomain already exists in the parent domain

If you have already created a DNS record covering your child domain in the parent domain:

  1. Add the child domain to the parent domain’s Cloudflare account or another account.

  2. In your child domain, re-create all DNS records that relate to your child domain. This includes all DNS records deeper than the delegated subdomain, meaning that if you are delegating www.example.com, you should also move over records for api.www.example.com.

  1. In the parent domain, make sure that you migrate over any settings (WAF custom rules, Rules, Workers, and more) that might be needed for the child domain.
  2. In the child domain, order an advanced SSL certificate that covers the child subdomain and any deeper subdomains.
  3. Get the Cloudflare nameservers for the child domain and add them as NS records at your external DNS provider.
  4. Within a short period of time, the child domain should be active.
  5. Within the DNS > Records of the parent zone, delete any A, AAAA, or CNAME records referencing the child domain or any of its deeper subdomains.
  1. Add the child domain to the parent domain’s Cloudflare account or another account.

  2. Convert the child zone to a partial setup.

  3. In your child domain, re-create all DNS records that relate to your child domain. This includes all DNS records deeper than the delegated subdomain, meaning that if you are delegating www.example.com, you should also move over records for api.www.example.com.

  1. In the parent domain, make sure that you migrate over any settings (WAF custom rules, Rules, Workers, and more) that might be needed for the child domain.
  2. In the child domain, order an advanced SSL certificate that covers the child subdomain and any deeper subdomains.
  3. Add the TXT verification record at your authoritative DNS provider.
  4. Within a short period of time, the child domain should be active.
  5. Within the DNS > Records of the parent zone, delete any previous A, AAAA, or CNAME records referencing the child domain or any of its deeper subdomains, and add the Cloudflare CNAME record.

  1. Meaning that Cloudflare is your Authoritative DNS provider. ↩︎

  2. Meaning that another DNS provider - not Cloudflare - maintains your Authoritative DNS. ↩︎