NXDOMAIN after moving nameservers to Cloudflare: records weren't imported
Deploy and infrastructure
Symptom
After handing the nameservers to Cloudflare at the registrar, a host starts returning NXDOMAIN at some point. Not an error, just "no such name" — monitoring doesn't catch it, and every external API call routed through that host stops. Separately: you add an MX record in the hosting panel and mail still isn't arriving after 30 minutes.
Cause
- Cloudflare Email Routing, Workers and the proxy only work when the zone's nameservers are Cloudflare, so you move the whole NS delegation, not a copy of the records. Cloudflare scans and auto-imports the existing records, but it doesn't guarantee all of them. Anything it missed dies silently the moment NS propagation completes (minutes to 48 hours).
- Once the authoritative nameservers are Cloudflare, the hosting panel's zone editor is no longer authoritative. MX and A records added there are ignored.
- If the A record a mail relay or MX target points at has the proxy on (orange cloud), mail doesn't arrive. It must be DNS only (grey cloud).
Fix
- Before moving NS, dump the whole existing zone with
dig into a file. After the move, diff it and add whatever is missing in the Cloudflare dashboard. - Edit records only in the Cloudflare dashboard. If a panel edit "isn't taking", suspect this first.
- Prefer not to move the NS of a zone that a relay or API depends on. Put mail in a separate zone.
Verification
Ask the authoritative server directly — dig @<authoritative NS> <host> A — then make one real API round trip through the relay path. Not a ping; a real call.
★ The moment the nameservers move, the screen you edited yesterday changes nothing.