Cloudflare Delegate subdomains: A Guide for Website Owners

To delegate blog.example.com from Cloudflare, keep example.com in Cloudflare and add NS records in Cloudflare’s DNS Records page that point the subdomain to an external DNS provider. Add A records only when glue records are needed for nameservers located inside that subdomain, and add a DS record if the delegated nameserver uses DNSSEC. Cloudflare documents a limit of 10 NS records and recommends seven or fewer. The delegated subdomain does not receive Cloudflare CDN or security services, and delegation is unavailable when the domain uses Cloudflare’s CNAME setup (partial).

What subdomain delegation means#

Cloudflare describes delegation as assigning management of a subdomain to different people, teams, or organizations. The parent domain can remain managed in Cloudflare while the delegated subdomain uses nameservers outside Cloudflare. In practical terms, the NS records tell the internet which DNS service is responsible for that subdomain’s DNS records.

This documented procedure is specifically an outgoing delegation from Cloudflare to another DNS service. It does not describe moving the parent domain away from Cloudflare.

Cloudflare’s documented setup#

1. Open the domain’s DNS Records page in the Cloudflare dashboard.
2. Create NS records for the subdomain, using the nameservers supplied by the receiving DNS provider.
3. Add A records only when glue records are required because the receiving nameservers are located inside the delegated subdomain.
4. If the delegated nameserver uses DNSSEC, add its DS record in Cloudflare.

Cloudflare documents up to 10 NS records for the delegation and recommends using seven or fewer. The receiving provider’s nameserver requirements still apply, so use the nameserver values it supplies.

Important limitations#

Cloudflare says subdomain delegation is unavailable when the domain uses its CNAME setup (partial). Check that condition before planning the change.

Cloudflare also states that its CDN and security services do not apply to delegated subdomains. The external DNS provider manages DNS for the delegated name, while the parent domain remains subject to its existing Cloudflare configuration. The dashboard steps, record limit, and service behavior described here are Cloudflare-specific and should not be assumed to apply to every DNS provider.