This article provides steps to troubleshoot errors that occur when adding a domain to Cloudflare.
Step 1 - Disable DNSSEC
Cloudflare cannot provide authoritative DNS resolution for a domain when DNSSEC is enabled at your domain registrar. You can re-enable DNSSEC after the domain is Active on Cloudflare, but must configure DNSSEC using Cloudflare’s DNSSEC requirements.
Possible symptoms of DNSSEC being enabled at the registrar include:
- DNS does not resolve after switching to Cloudflare’s nameservers.
- DNS query response status is SERVFAIL.
- The domain remains in a Pending status in the Cloudflare Overview app.
Contact your domain provider if you need assistance to disable DNSSEC. If a DS record exists for the domain, DNSSEC is likely enabled. DS records can be checked via third-party online tools such as https://mxtoolbox.com/ds.aspx or via a command-line terminal:
dig +short ds cloudflare.com 2371 13 2 32996839A6D808AFE3EB4A795A0E6A7A39A76FC52FF228B22B76F6D6 3826F2B9
Step 2 - Register the domain
There are several domain registration issues that will prevent a domain from being added to Cloudflare:
- Domain uses a new TLD (top-level domain) not yet on the Public Suffix List
- You may see an error similar to the following:
We were unable to identify bad.psl-example as a registered domain. Please ensure you are providing the root domain and not any subdomains (e.g., example.com, not subdomain.example.com) (Code: 1099)
- Domain is not yet fully registered or registration data does not list nameservers
- Contact your domain registrar to update the nameservers in the registration
Below are some possible errors in the Cloudflare dashboard when adding an improperly registered domain via + Add site:
- exampledomain.com is not a registered domain (Code: 1049)
- Failed to lookup registrar and hosting information of exampledomain.com at this time. Please contact Cloudflare Support or try again later. (Code: 1110)
Step 3 - Resolve DNS for root domain
Before a domain can be added to Cloudflare, the domain must return NS records for valid, working nameservers. NS records can be checked via third-party online tools such as https://www.whatsmydns.net/#NS/ or via a command-line terminal using a dig command:
dig +short ns cloudflare.com ns3.cloudflare.com. ns4.cloudflare.com. ns5.cloudflare.com. ns6.cloudflare.com. ns7.cloudflare.com.Additionally, the domain must return a valid SOA record when queried. SOA records can be checked via third-party online tools such as https://www.whatsmydns.net/#SOA/ or via a command-line terminal:
dig +short soa cloudflare.com ns3.cloudflare.com. dns.cloudflare.com. 2029202248 10000 2400 604800 300
Step 4 - Verify if the domain is restricted at Cloudflare
Cloudflare disallows the addition of certain domains on either a permanent or a temporary basis. See the instructions below for removing either type of restriction.
Removing a temporary restriction
When Cloudflare observes too many attempts to add a domain to Cloudflare, an error is returned:
Error with Cloudflare request: [1105] This zone is temporarily restricted and cannot be added to Cloudflare at this time, please contact Cloudflare Support.
Before contacting Cloudflare support, wait 3 hours before attempting to re-add the domain to Cloudflare.
Clearing a permanent restriction
File a request with Cloudflare Support if any of the following errors are observed when adding a domain:
- This zone cannot be added to Cloudflare at this time, please contact Cloudflare Support. (Code: 1093)
[email protected] if observing a 1097 error: - Error: This web property cannot be added to Cloudflare at this time. If you are an Enterprise customer, contact your Customer Success Manager. Otherwise, email [email protected] with a detailed explanation of your association with this zone. (Code: 1097)