Choose the correct record type
Use A for an IPv4 origin, AAAA for IPv6, CNAME for an alias to another hostname, MX for mail delivery, TXT for verification or sender policy, CAA to restrict certificate authorities and NS only to delegate a child zone. Use @ for the zone apex. A record name identifies the service; its content identifies the destination.
Decide whether traffic should be proxied
A, AAAA and CNAME records used by websites can be proxied so HTTP and HTTPS traffic passes through Cloudflare security, TLS, caching and performance controls. Mail, verification and other non-web records normally remain DNS only. Do not proxy a hostname merely to hide an address: confirm that its protocol and port are supported first.
Choose a TTL
Proxied records use Cloudflare's automatic TTL. For DNS-only records, a shorter TTL makes a planned change propagate sooner but increases resolver lookups; a longer TTL reduces lookups but extends the time stale answers may remain cached. Lower the TTL before a planned move, wait for the previous TTL to expire, make the change and raise it again after verification.
Protect web and email during a change
Inventory every record with the same name before replacing one. Preserve MX, SPF, DKIM, DMARC and verification records during a website move, and preserve web records during a mail move. A CNAME cannot normally coexist with other record types at the same name. Keep the previous destination available until public resolvers return the new answer.
Verify the public result
Query at least two independent public resolvers for the exact type and name, then test the real service. For a proxied web record, DNS should return Cloudflare addresses and HTTPS should present the expected hostname. For DNS only, DNS should return the configured destination. A successful save is not proof that delegation, caching and the destination service are correct.
Recover from a bad record
Restore the previous type, name, content, proxy state, TTL and priority. If the old value is unknown, stop changing related records and use the last verified inventory or service-provider instructions. DNS caches may retain the bad answer until its TTL expires, so verify with authoritative and recursive queries while recovery propagates.
