DNS

A domain at another registrar, and Cloudflare

How to run a DNS zone on ZRAZU servers for a domain at another registrar, set your own name servers and connect Cloudflare with an API key in the cabinet.

ZRAZU DNS can also serve a domain registered elsewhere. And if you use Cloudflare, ZRAZU can set up a new domain right in your Cloudflare account.

ZRAZU DNS for a domain at another registrar

The domain stays with its current registrar, and ZRAZU runs the DNS zone. Setting our name servers at the registrar also proves that the domain is yours.

  1. In the cabinet menu open DNS → Add a domain from another registrar (open).
  2. Enter the domain without subdomains: example.com, not www.example.com. You can add up to 100 domains at once, one per line.
  3. Click Add the domain. A request and three name servers appear.
  4. At 1. Check the records we'll carry over review the records we took from the current DNS: root, www, mail and common subdomains. Add rare subdomains yourself. Do not change the name servers yet.
  5. At 2. Replace the name servers at the registrar set these at your registrar:
ns1.zrazu.net
ns2.zrazu.net
ns3.zrazu.net
  1. We notice the change ourselves, usually a few minutes after the registry publishes it (a registry update can take up to an hour). The Check button speeds it up. A check takes from 20 seconds to 3 minutes.
  2. Once the domain is confirmed, you edit records the same way as in the DNS zone on ZRAZU servers.

A request is valid for a limited time: the cabinet shows the date ("The request is valid until…"). If you miss it, the request is removed and you can create it again.

The number of such domains is limited; the cabinet shows "Domains at other registrars: N of M". The limit grows after the first payment for any service or once the organization has a domain with ZRAZU.

You can remove a zone with Remove the zone: our servers then stop serving its records. If you do not want expiry reminders, click Stop expiry reminders.

Your own name servers for new domains

For a ZRAZU domain you can set other name servers: on the domain's DNS tab click Change name servers and enter from 2 to 13 servers, one per line. A second-factor code is required. The new set goes to the registry, and the internet sees it within a day.

For new domains this is also set at the organization level: Settings → Organization, the block Name servers for new domains. There are three options: ZRAZU servers, Your own servers and Cloudflare (your account). Existing domains are changed in the domain card.

Cloudflare

If your domains are in Cloudflare, ZRAZU creates a zone in your account and switches the name servers to the ones Cloudflare issued. This needs an API key.

How to add a key

  1. In Cloudflare open My Profile → API Tokens → Create Token → Custom token. Global API Key and Origin CA Key do not work: they open the whole account.
  2. Grant only what is needed. For reading zones: Zone → Zone → Read. For an edit key: Zone → Zone → Read, Zone → Zone → Edit and Zone → DNS → Edit. Do not grant anything else (account members, Workers, storage): we reject a key that is wider than needed.
  3. In Client IP Address Filtering allow the ZRAZU addresses. They are shown in the cabinet on the keys page.
  4. Set TTL, the token's expiry date. When it passes we will write to you, and the key has to be added again.
  5. In the cabinet open Team → Cloudflare keys (open), choose the purpose: Reading zones or Zones and records, paste the token into the Cloudflare API Token field and click Add the key.

A token is a secret. Paste it only into this cabinet field; do not send or publish it anywhere. We never show the key, not even partly. Keys can be added and removed by the organization owner and administrator.

For a few seconds we check the key with Cloudflare. Key states: "Active", "Not accepted", "Refused by Cloudflare", "Revoked". A new key of the same purpose replaces the previous one. The Call log shows when we used the key with Cloudflare (without values).

What the edit key does

The Zones and records key lets us create a zone for a domain registered with ZRAZU and the _acme-challenge record for SSL. We do not touch other records and do not delete zones.

New domains straight into Cloudflare

  1. Add an edit key (see above).
  2. Open Settings → Organization, the block Name servers for new domains, and choose Cloudflare (your account).
  3. We register a new domain on ZRAZU servers, then create a zone in your Cloudflare and switch the NS to the ones Cloudflare issued. If Cloudflare refuses, the domain stays on ZRAZU servers.

You can follow progress on Team → Cloudflare keys, in the block "Domains moving to Cloudflare". States: "Creating the zone in your Cloudflare", "Switching name servers", "Waiting for Cloudflare to see the new NS", "The domain is in Cloudflare". If Cloudflare issued an unusual pair of servers, the cabinet asks you to Confirm the replacement or Decline. A failed attempt can be Retried.

If it didn't work

  • The status "Awaiting NS change" does not change. Check that all three ZRAZU servers are set at the registrar with no old ones left, and click Check.
  • "Enter a domain, for example example.com". Enter only the domain itself, without www and without https://.
  • "The zone is suspended because the domain doesn't point to ZRAZU servers". Set ns1–ns3 back at the registrar.
  • A Cloudflare key is "Not accepted". Reasons the cabinet gives: it is a Global API Key (an API Token is needed), it is an Origin CA Key, the token cannot read zones, the token is wider than needed, it is disabled or expired, or it was not copied in full.
  • The domain stayed on ZRAZU servers. Cloudflare refused: see the reason in the domain's row and click Retry.

This page in Markdown