Cloudflare lets you manage a domain's DNS for free, cache pages and absorb attacks. Many site owners move to it expecting a faster, safer site, and often they get one. But connecting a domain to Cloudflare is not a single click: you are moving the entire DNS control of your domain somewhere else. Done in a hurry, it can stop your email, trap the site in a redirect loop or take it offline. Here is what changes, what you gain and which risks to prepare for.
What connecting actually changes
You replace the domain's name servers at the registrar with the two servers Cloudflare assigns. From then on Cloudflare answers every DNS question about your domain, and records left in the old DNS panel have no effect. After the switch, A, MX, TXT and every other record must be edited in Cloudflare only. When you add the site, Cloudflare scans your existing records, but the scan only finds names it can guess. Common ones like www and mail usually appear; DKIM keys and unusual subdomains are easily missed.
What you gain
Fast, reliable DNS with changes applied in seconds; a proxy mode (the orange cloud) that caches static files, mitigates DDoS and partly hides the server IP; and extra tools such as security rules, bot filtering and redirects. Many are available on the free plan, but features and limits change over time, so check Cloudflare's own documentation.
Risk 1: some records do not come across
The moment name servers change, every record that existed only in the old zone disappears. Most often these are SPF, DKIM and DMARC, and mail starts landing in spam or bouncing. Compare the old zone with Cloudflare's list record by record before switching.
dig @ns1.eski-dns.uz misol-markaz.uz MX +short
dig @ns1.eski-dns.uz misol-markaz.uz TXT +short
dig @ns1.eski-dns.uz default._domainkey.misol-markaz.uz TXT +short
dig @ns1.eski-dns.uz _dmarc.misol-markaz.uz TXT +shortRisk 2: DNSSEC left on takes the site down
If DNSSEC is enabled, the parent zone holds a DS record for the old servers' key. Cloudflare signs with a different key, so validating resolvers return SERVFAIL after the switch. Remove the DS record at the registrar first, wait for its cache to expire, then change name servers. Re-enable DNSSEC in Cloudflare afterwards and submit the new DS record.
Risk 3: the wrong SSL mode causes a redirect loop
With the proxy on, "Flexible" mode connects Cloudflare to your server over plain HTTP. If the server redirects HTTP to HTTPS, the loop ends in "ERR_TOO_MANY_REDIRECTS". If the server has a real certificate such as Let's Encrypt, choose "Full (strict)".
Risk 4: the server IP is still exposed
Only proxied records hide the IP. A mail or ftp record pointing at the same server reveals it to anyone running dig, and mail records cannot be proxied. If protection is the goal, consider accepting web traffic only from Cloudflare's IP ranges.
Risk 5: logs show Cloudflare addresses
Behind the proxy, logs and tools like fail2ban see Cloudflare IPs instead of visitors. The real address arrives in CF-Connecting-IP; restore it on the web server using the full range list from Cloudflare's official page.
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
# ... remaining IPv4 and IPv6 ranges from Cloudflare's list
real_ip_header CF-Connecting-IP;Speed for a local audience
A site hosted in Uzbekistan reaches local users quickly over Tas-IX. With the proxy on, traffic goes through Cloudflare's network, and which edge a user reaches depends on their ISP, so local speed can drop. Test response times from several local providers before and after. If you only want DNS management, keep records grey-clouded ("DNS only").
Example: a training centre moves safely
A training centre in Tashkent listed every record of its old zone, including the lms subdomain and its mail records. Cloudflare's scan had missed DKIM, so it was added by hand. DNSSEC was confirmed off, SSL was set to "Full (strict)", and only then were the name servers changed. Mail, site and learning platform kept working without interruption. Name servers are changed at the registrar; for a domain at sayt.uz that is in the domain settings of the cabinet.