Before configuring Cloudflare as your Secondary DNS provider, allow traffic to the Primary DNS servers from port 53 and update your Access Control Lists. The Allow Ranges are where Cloudflare's AXFR requests originate and Notify IPs are the IP addresses where you notify Cloudflare's Secondary DNS to initiate a pull of new zone information from your Primary DNS servers.

Consult your DNS provider's documentation for instructions on configuring the Primary zone.

Allow Range: 

• 198.41.144.240/28
• 198.41.150.240/28
• 2a06:98c0:3601::/48
• 2a06:98c0:1401::/48

Notify IPs: 

• 172.65.30.82
• 172.65.50.145
• 2606:4700:60:0:317:26ee:3bdf:5774
• 2606:4700:60:0:35a:4be3:4144:c5ee

For example, to run a BIND server as a primary, add the following statements to your zone file: 

allow-transfer {198.41.144.240/28;198.41.150.240/28;2a06:98c0:3601::/48;2a06:98c0:1401::/48;}

also-notify { 172.65.30.82;172.65.50.145;2606:4700:60:0:317:26ee:3bdf:5774;2606:4700:60:0:35a:4be3:4144:c5ee;}

Create a secondary zone through the Create Zone API by setting type to secondary:

curl -X POST "https://api.cloudflare.com/client/v4/zones"      
-H "X-Auth-Email: [email protected]"      
-H "X-Auth-Key: yourapikeyhere"      
-H "Content-Type: application/json"      
--data '{"name":"examplesecondaryzone.fyi","account":{"id":"accountidhere"},"jump_start":true,"type":"secondary"}'

In the example request below, name and secret must be provided by the primary DNS provider and algo must reflect the correct TSIG algorithm from the Primary DNS server. The TSIG name must be lowercase to prevent zone transfer failures.

#POST https://api.cloudflare.com/client/v4/accounts/:account_tag/secondary_dns/tsigs/ 
{"name": ":tsig_secret_name", 
"secret": ":tsig_secret_string", 
"algo": "hmac-sha512"}

A successful POST request will respond with an id.  Include this id when adding a Primary server.

Multiple Primary nameservers can be added via the Cloudflare API.

#POST https://api.cloudflare.com/client/v4/accounts/:account_tag/secondary_dns/primaries/
{"ip": ":primary_ip",
"port": 53, 
"ixfr_enable": true, 
"tsig_id": ":tsig_tag"}

• :primary_ip is the IPv4/IPv6 address of the Primary nameserver.
• ixfr_enable set to true enables IXFR transfer protocol. The default is AXFR.
• :tsig_tag (optional) is the id provided in the previous step if configured

A successful POST request will respond with an id for the Primary DNS server and must be included when creating a Secondary Zone via the Cloudflare API. 

#POST https://api.cloudflare.com/client/v4/zones/:zone_tag/secondary_dns/
{"id": ":zone_tag", 
"name": ":zone_name", 
"primaries": [ ":zone_primary_tag" ], 
"auto_refresh_seconds": 86400 }

• :zone_tag is the Zone ID of the domain configured for Secondary DNS.
• :zone_name is the domain name configured for Secondary DNS.
• :zone_primary_tag is the list of Primary IDs created in the previous step.

curl -X POST "https://api.cloudflare.com/client/v4/zones/:zone_tag/secondary_dns?force_axfr=true" \
-H "X-Auth-Email: [email protected]" \
-H "X-Auth-Key: yourapikeyhere" \
-H "Content-Type: application/json"

:zone_tag is the Zone ID of the domain configured for Secondary DNS.

See full zone transfer details in the API documentation.

Add Cloudflare's Secondary DNS Nameservers to the existing nameservers specified at your registrar. Review the instructions in the Prerequisites section above to locate the names of your Secondary Nameservers.

Add a TXT record to the primary DNS provider to test transfer to Cloudflare's Secondary DNS servers.  Then, verify the TXT record is visible when querying Cloudflare's nameservers.  Replace nsNNNN with the correct name of a Cloudflare Secondary DNS servers for the domain: 

dig @nsNNN.secondary.cloudflare.com :zone_name txt +short