Step 1 - Disable DNSSEC
Cloudflare cannot provide authoritative DNS resolution for a domain when DNSSEC is enabled at your domain registrar. You can re-enable DNSSEC after the domain is Active on Cloudflare, but must configure DNSSEC using Cloudflare's DNSSEC requirements.
DNSSEC must only be disabled for domains on Full setups where Cloudflare’s nameservers will be authoritative.
Possible symptoms of DNSSEC being enabled at the registrar include:
- DNS does not resolve after switching to Cloudflare’s nameservers.
- DNS query response status is SERVFAIL.
- The domain remains in a Pending status in the Cloudflare Overview app.
Contact your domain provider if you need assistance to disable DNSSEC. If a DS record exists for the domain, DNSSEC is likely enabled. DS records can be checked via third-party online tools such as https://mxtoolbox.com/ds.aspx or via a command-line terminal:
dig +short ds cloudflare.com
2371 13 2 32996839A6D808AFE3EB4A795A0E6A7A39A76FC52FF228B22B76F6D6 3826F2B9
Step 2 - Register the domain
There are several domain registration issues that will prevent a domain from being added to Cloudflare:
- Domain uses a new TLD (top-level domain) not yet on the Public Suffix List
- You may see an error similar to the following:
We were unable to identify bad.psl-example as a registered domain. Please ensure you are providing the root domain and not any subdomains (e.g., example.com, not subdomain.example.com) (Code: 1099)
Instructions for updating the Public Suffix List exist at https://github.com/publicsuffix/list/wiki/Guidelines.
- Domain is not yet fully registered or registration data does not list nameservers
- Contact your domain registrar to update the nameservers in the registration
Below are some possible errors in the Cloudflare dashboard when adding an improperly registered domain via + Add site:
- exampledomain.com is not a registered domain (Code: 1049)
- Failed to lookup registrar and hosting information of exampledomain.com at this time. Please contact Cloudflare Support or try again later. (Code: 1110)
Step 3 - Resolve DNS for root domain
Before a domain can be added to Cloudflare, the domain must return NS records for valid, working nameservers. NS records can be checked via third-party online tools such as https://www.whatsmydns.net/#NS/ or via a command-line terminal using a dig command:
dig +short ns cloudflare.com
ns3.cloudflare.com. ns4.cloudflare.com. ns5.cloudflare.com. ns6.cloudflare.com. ns7.cloudflare.com.
Additionally, the domain must return a valid SOA record when queried. SOA records can be checked via third-party online tools such as https://www.whatsmydns.net/#SOA/ or via a command-line terminal:
dig +short soa cloudflare.com
ns3.cloudflare.com. dns.cloudflare.com. 2029202248 10000 2400 604800 300
Step 4 - Verify if the domain is banned at Cloudflare
Cloudflare disallows the addition of certain domains on either a permanent or a temporary basis. See the instructions below for removing either type of ban.
Removing a temporary ban
When Cloudflare observes too many attempts to add a domain to Cloudflare, an error is returned:
Error with Cloudflare request: [1105] This zone is temporarily banned and cannot be added to Cloudflare at this time, please contact Cloudflare Support.
Before contacting Cloudflare support, wait 3 hours before attempting to re-add the domain to Cloudflare.
Cloudflare support cannot expedite expiration of the temporary ban.
Clearing a permanent ban
File a request with Cloudflare Support if any of the following errors are observed when adding a domain:
- Error: This zone is banned and cannot be added to CloudFlare at this time, please contact CloudFlare Support. (Code: 1097)
- This zone cannot be added to Cloudflare at this time, please contact Cloudflare Support. (Code: 1093)
Error (Code: 1093) or (Code: 1116) can also mean that you included a subdomain (somehost.example.com) instead of the root domain (example.com) when adding the domain to Cloudflare.