Receiving an email stating that a domain was “Deleted by Cloudflare” can be alarming, especially when the domain hosts a production website, API, email-related DNS records, customer portal, or another important online service.

However, this message does not normally mean that the domain registration itself has been deleted or cancelled.

Cloudflare manages a domain as a DNS zone inside a Cloudflare account. When Cloudflare says that a domain has been deleted, it generally means that the zone has been removed from Cloudflare, not that ownership of the registered domain has been cancelled.

Your domain registration is normally controlled separately by your registrar.

Examples of registrars include companies through which you purchase and renew domain names.

Therefore, there are two separate things to understand:

Domain registration
Controls ownership and renewal of the domain.

Cloudflare zone
Controls Cloudflare DNS, proxy, security, CDN, SSL-related services, rules, and other Cloudflare configurations.

A Cloudflare zone can therefore be deleted while the underlying domain remains registered.

Why Does Cloudflare Automatically Delete a Domain?

Cloudflare documents several common reasons for domain deletion.

A domain may be deleted when:

• A user with appropriate access manually removes the domain.
• The authoritative nameservers no longer point to the Cloudflare nameservers assigned to that zone.
• A newly added domain remains unauthenticated or pending for too long.
• A Free-plan zone remains in Pending status for 28 days.
• A Free-plan zone enters Moved status and remains there long enough to be automatically deleted.

Cloudflare continuously monitors DNS delegation for domains using its full DNS setup.

If the domain is supposed to use Cloudflare DNS but the registrar starts publishing different nameservers, Cloudflare can eventually determine that the domain is no longer using that Cloudflare zone.

Understanding Cloudflare Zone Status

Understanding Cloudflare's zone states is useful when diagnosing an unexpected deletion.

A zone may progress through statuses such as:

Initializing → Pending → Active → Moved → Deleted → Purged

Not every domain necessarily passes through every state.

Initializing

The domain has been added but initial Cloudflare setup has not been completed.

For example, plan selection may still be required.

Pending

Cloudflare is waiting to authenticate the domain setup.

For a normal full DNS setup, this commonly means that Cloudflare cannot confirm that the registrar is publishing the exact Cloudflare nameservers assigned to the zone.

A Free-plan domain that remains Pending for more than 28 days may be automatically deleted.

Active

The domain has been authenticated successfully and Cloudflare considers the zone active.

This is the normal production state.

Moved

A previously active zone can enter the Moved state if Cloudflare's DNS checks determine that the domain is no longer properly delegated to its assigned Cloudflare nameservers.

For Free-plan zones, Cloudflare documents automatic deletion after the zone remains in Moved status for seven days.

Deleted

The zone has been archived/deleted from the Cloudflare account.

Importantly, deletion is not immediately identical to permanent purging.

Purged

Cloudflare states that a deleted zone is normally purged after seven days.

Once a zone is purged, its previous configuration should not be expected to be recoverable simply by adding the domain again.

Most Common Cause: Nameservers Were Changed

One of the most common explanations is a nameserver change at the registrar.

Suppose Cloudflare originally assigned nameservers similar to:

alice.ns.cloudflare.com
mark.ns.cloudflare.com

But the registrar later contains:

ns1.examplehost.com
ns2.examplehost.com

Cloudflare can determine that the domain is no longer delegated to the Cloudflare zone.

The zone may move from:

Active
   ↓
Moved
   ↓
Deleted

This often happens after:

• Moving a website to another hosting company
• Changing hosting control panels
• Migrating DNS
• Changing nameservers during troubleshooting
• Allowing another developer to modify the domain
• Restoring old registrar settings
• Accidentally replacing Cloudflare nameservers
• Moving DNS to the hosting provider
• Changing domain-management services

Another Common Cause: Cloudflare Setup Was Never Completed

A domain can be added to Cloudflare without completing the required registrar-side nameserver change.

Cloudflare then waits for the domain to authenticate.

The dashboard may show:

Pending Nameserver Update

If the domain is on Cloudflare's Free plan and remains Pending for 28 days, Cloudflare can automatically delete the zone.

This explains many deletion emails received several weeks after someone initially experimented with adding a domain to Cloudflare.

Did Cloudflare Delete the Actual Domain Registration?

Usually, no.

A Cloudflare zone deletion and domain-registration deletion are different events.

Check your registrar account and verify:

• Domain status
• Expiration date
• Auto-renewal status
• Current nameservers
• Registrar lock
• DNSSEC configuration

If the domain is still registered and active, you can normally configure DNS again.

How to Check the Current Nameservers

Before changing anything, determine which authoritative nameservers the domain currently uses.

Windows Command Prompt

Run:

nslookup -type=NS example.com

Replace example.com with the affected domain.

The result should show the currently published authoritative nameservers.

You can also run:

nslookup -type=NS -debug example.com

For .com domains, an advanced check can query a TLD nameserver directly:

nslookup -type=NS -debug example.com a.gtld-servers.net

This helps determine what the parent DNS zone is actually publishing instead of relying entirely on locally cached DNS results.

Using DIG on Linux or macOS

Run:

dig NS example.com

For more detailed delegation troubleshooting:

dig +trace example.com NS

The trace follows DNS delegation from the root DNS infrastructure toward the authoritative nameservers.

This is particularly useful when the registrar interface says one thing but public DNS appears to show something different.

Check Whether DNSSEC Is Causing the Problem

DNSSEC deserves special attention when changing DNS providers.

A common scenario is:

1. DNSSEC was enabled with the previous DNS provider.
2. Nameservers were changed.
3. Old DS records remained at the registrar.
4. DNS validation failed.

This can result in:

SERVFAIL

or cause Cloudflare activation problems.

You can check DS records using:

dig DS example.com

If old DS records exist from a previous DNS provider, they may need to be removed from the registrar before the new DNS configuration works correctly.

Do not randomly remove DNSSEC records from a working production domain. Confirm the current DNSSEC configuration and migration requirements first.

How to Recover a Domain Deleted from Cloudflare

If the domain was deleted accidentally, use the following recovery procedure.

Step 1: Verify Domain Registration

Sign in to the domain registrar.

Confirm that the domain is:

• Registered
• Not expired
• Not suspended
• Not on hold
• Using valid nameservers

Do not assume that Cloudflare deletion is the only issue.

Step 2: Check the Current Website and Email

Before modifying DNS, document what is currently working.

Check:

• Main website
• www website
• Email
• Webmail
• Subdomains
• Customer portals
• APIs
• FTP/SFTP endpoints
• Remote applications

This helps prevent an unnecessary DNS change from breaking a service that is currently operating through another DNS provider.

Step 3: Add the Domain Back to Cloudflare

Sign in to Cloudflare and add the domain again through the normal onboarding process.

Cloudflare will scan for existing DNS records where possible.

Carefully review the detected records.

Do not assume that every record will be detected automatically.

Critical Warning: Re-Adding a Deleted Domain May Produce New Nameservers

This is one of the most important points during recovery.

When a previously deleted domain is added again, Cloudflare may assign a new pair of nameservers.

Therefore, do not assume that the old Cloudflare nameservers are still valid for the newly created zone.

Always open:

Cloudflare Dashboard → Domain → Overview

and copy the exact nameservers displayed for the newly added zone.

Then compare those values with the nameservers configured at the registrar.

Step 4: Verify DNS Records Before Switching Nameservers

Before changing registrar nameservers, verify critical DNS records.

At minimum check:

Website

A
AAAA
CNAME

Email

MX
TXT

Email Authentication

SPF
DKIM
DMARC

Verification Records

Check TXT or CNAME records used by:

• Google Workspace
• Microsoft 365
• SSL providers
• Search engines
• SaaS applications
• Payment gateways
• CRM systems
• Email marketing platforms

Also verify important subdomains.

For example:

www.example.com
mail.example.com
portal.example.com
api.example.com
app.example.com

Missing DNS records can break services immediately after nameservers are switched.

Step 5: Update Nameservers at the Registrar

If you want Cloudflare to become the authoritative DNS provider again, replace the existing registrar nameservers with the exact nameservers assigned by the newly created Cloudflare zone.

Do not add old Cloudflare nameservers from memory.

Do not mix Cloudflare and another provider's nameservers unless you are intentionally using a supported multi-provider configuration.

Step 6: Wait for DNS Delegation

Nameserver changes are not always visible everywhere immediately.

Cloudflare notes that registrar-side updates may take up to approximately 24 hours in some cases.

During this period, Cloudflare may continue displaying:

Pending Nameserver Update

Avoid repeatedly changing nameservers while propagation is taking place because this can make troubleshooting considerably more confusing.

Step 7: Ask Cloudflare to Recheck Nameservers

From the domain Overview page, Cloudflare provides an option to recheck nameservers.

Use it after you have verified that the registrar contains the exact Cloudflare nameservers assigned to the zone.

A recheck request does not necessarily activate the domain instantly. Cloudflare still has to verify the public delegation.

Step 8: Confirm That Status Becomes Active

The desired state is:

Active

Once active, verify the website and all dependent services again.

Test:

example.com
www.example.com

Also test email delivery and important subdomains.

Important DNS Records to Verify After Recovery

DNS recovery should not stop when the website begins loading.

A website can work perfectly while email or another service remains broken.

Verify the following:

A Record

Points a hostname to an IPv4 address.

Example:

example.com → 192.0.2.10

AAAA Record

Points a hostname to an IPv6 address.

CNAME Record

Creates an alias to another hostname.

Example:

www → example.com

MX Record

Controls incoming email routing.

Incorrect MX records can stop email delivery.

SPF

Normally stored as a TXT record.

It specifies which systems are authorized to send email for the domain.

DKIM

Provides cryptographic authentication for outgoing email.

DMARC

Defines policy and reporting for SPF/DKIM authentication.

TXT Records

TXT records may also be required for:

• Domain verification
• Microsoft 365
• Google Workspace
• Search Console
• SaaS verification
• SSL validation
• Security services

What Happens to Cloudflare Proxy Settings?

Cloudflare DNS records can normally be configured as:

Proxied

or

DNS only

Proxied records route compatible web traffic through Cloudflare.

DNS-only records return the origin destination directly.

After restoring a zone, verify the proxy state of every important record.

Do not automatically enable proxying for every DNS record.

Email-related records and many non-HTTP services should normally remain DNS-only unless the specific service supports Cloudflare proxying.

Check Cloudflare Audit Logs

If you cannot determine why a domain disappeared, review Cloudflare's audit logs.

Cloudflare recommends checking Audit Logs when investigating domain deletion.

Look for a deletion action where the affected resource is the Zone.

This can help distinguish between:

• Automatic Cloudflare deletion
• Manual deletion
• Changes performed by another authorized user
• API-driven activity

If the notification explicitly states that the domain was Deleted by Cloudflare, an automatic lifecycle event is more likely than a manual user deletion, but audit logs should still be reviewed when the cause matters.

Security Check: Review Cloudflare Account Access

Unexpected deletion should also trigger an account-access review.

Check:

• Account members
• User roles
• Administrator access
• API tokens
• API keys
• Third-party integrations
• Unused user accounts

Remove unnecessary access and ensure that administrator accounts use strong authentication.

Enabling multi-factor authentication is recommended for accounts controlling production DNS.

What If the Website Still Works After Cloudflare Deleted the Zone?

This is possible.

If the registrar's nameservers were already changed to another DNS provider, the website may be resolving through that provider instead of Cloudflare.

Therefore:

Cloudflare zone deleted + website still working

does not necessarily indicate a problem.

It may simply mean Cloudflare is no longer the authoritative DNS provider.

Check:

nslookup -type=NS example.com

If the results show another DNS provider, that provider is likely handling DNS.

In this situation, do not immediately switch the domain back to Cloudflare unless that is your intended configuration.

What If the Website Stops Working?

First determine which nameservers are authoritative.

Then determine whether those nameservers contain valid DNS records.

Typical failure conditions include:

• Nameservers point to Cloudflare but the Cloudflare zone no longer exists or is unusable.
• Nameservers point to a hosting provider that does not contain the correct zone.
• Required A/CNAME records are missing.
• DNSSEC DS records are stale.
• The domain is expired or suspended.
• The origin web server itself is unavailable.

Do not assume that every outage following a Cloudflare email is caused by Cloudflare.

Deleted vs Purged: An Important Difference

Cloudflare distinguishes between Deleted and Purged zones.

A deleted zone is archived temporarily.

Cloudflare documentation indicates that deleted zones are normally purged after seven days.

Once purged, previous zone settings should not be expected to be restored.

This makes prompt investigation important when a production domain is unexpectedly removed.

Can Previous Cloudflare Settings Be Restored?

Recovery depends on the state of the zone and how much time has passed.

If the domain was recently deleted, adding it again promptly may allow Cloudflare to re-apply previous configuration in some circumstances.

However, administrators should never depend on Cloudflare as the only copy of critical DNS information.

Once the zone is purged, previous settings should not be expected to return.

Maintain an independent record of production DNS.

Recommended DNS Backup Procedure

For business-critical domains, maintain a DNS inventory containing:

• Hostname
• Record type
• Record value
• TTL
• Proxy status
• Priority
• Comments/purpose

For example:

Type    Name      Value                 Proxy
A       @         192.0.2.10            Proxied
CNAME   www       example.com           Proxied
MX      @         mail.example.com       DNS Only
TXT     @         SPF configuration      DNS Only

Update this inventory whenever DNS is changed.

Screenshots are useful, but a structured export or documented DNS table is better.

How to Prevent Cloudflare Automatic Domain Deletion

1. Complete Nameserver Setup Immediately

After adding a domain to Cloudflare, update the registrar nameservers promptly.

Do not leave production domains indefinitely in:

Pending Nameserver Update

2. Monitor Cloudflare Zone Status

Periodically verify that production domains display:

Active

Investigate unexpected Pending or Moved states immediately.

3. Do Not Ignore Cloudflare Warning Emails

Cloudflare notifications concerning nameservers or zone status can be early warnings of a future deletion.

Treat messages such as:

• Nameservers changed
• Domain stopped using Cloudflare
• Zone moved
• Pending nameserver update
• Domain deleted

as infrastructure alerts.

4. Restrict Cloudflare Administrative Access

Only trusted personnel should have permission to:

• Delete zones
• Modify DNS
• Change account settings
• Create powerful API tokens

Apply the principle of least privilege.

5. Protect Registrar Access

Cloudflare security alone is insufficient.

An attacker or unauthorized administrator with registrar access can change authoritative nameservers and redirect the entire domain.

Protect the registrar account with:

• Strong unique password
• Multi-factor authentication
• Registrar lock
• Restricted administrative access
• Recovery information kept current

6. Keep DNS Records Backed Up

Maintain copies of:

• A records
• AAAA records
• CNAME records
• MX records
• TXT records
• SPF
• DKIM
• DMARC
• SRV records
• CAA records
• Important subdomains

This significantly reduces recovery time.

7. Document DNSSEC

Record whether DNSSEC is enabled and where the corresponding DS information is maintained.

DNSSEC is valuable for DNS security, but stale DS records during a DNS-provider migration can make an otherwise correct domain appear completely unavailable.

Recommended Troubleshooting Checklist

When you receive a Cloudflare domain deletion notification, check the following in order:

1. Is the domain still registered?
2. Is the domain expired or suspended?
3. Which nameservers are currently authoritative?
4. Are those nameservers intentional?
5. Is the website currently working?
6. Is email currently working?
7. Was the domain intentionally moved away from Cloudflare?
8. Does Cloudflare Audit Log show zone deletion activity?
9. Does the registrar contain stale DNSSEC/DS information?
10. Do you have a backup of the previous DNS records?
11. If re-adding the zone, what new Cloudflare nameservers were assigned?
12. Have all A, CNAME, MX and TXT records been verified before changing nameservers?
13. Has the Cloudflare zone returned to Active?
14. Have website, email and subdomains been tested afterward?

Example Recovery Scenario

Consider a business domain that was previously protected by Cloudflare.

The registrar originally used:

alpha.ns.cloudflare.com
beta.ns.cloudflare.com

During a hosting migration, the nameservers were changed to:

ns1.hostingprovider.example
ns2.hostingprovider.example

Cloudflare eventually detects that its assigned nameservers are no longer authoritative.

The zone enters:

Moved

If it remains there long enough under the applicable Free-plan lifecycle, Cloudflare deletes the zone.

The administrator later decides to move back to Cloudflare.

The correct process is:

1. Add the domain to Cloudflare again.
2. Review all imported DNS records.
3. Add missing records manually.
4. Note the new Cloudflare nameservers.
5. Check DNSSEC/DS configuration.
6. Change registrar nameservers to the newly assigned pair.
7. Wait for delegation.
8. Recheck nameservers.
9. Confirm Cloudflare status becomes Active.
10. Test website, email and subdomains.

The administrator should not simply restore the old Cloudflare nameserver pair, because Cloudflare may assign different nameservers when a deleted domain is re-added.

Frequently Asked Questions (FAQ)

1. Why did Cloudflare delete my domain?

Common reasons include the domain no longer using its assigned Cloudflare nameservers, a Free-plan domain remaining Pending too long, a zone remaining in Moved status, or someone with sufficient access deleting the zone.

2. Does “Deleted by Cloudflare” mean my domain registration was deleted?

Normally no. It generally refers to the Cloudflare DNS zone rather than the underlying domain registration. Check your registrar to confirm registration status.

3. Can I add the domain to Cloudflare again?

Yes. A deleted domain can generally be added again through Cloudflare's normal domain onboarding process.

4. Will Cloudflare give me the same nameservers when I add the domain again?

Do not assume so.

Cloudflare documents that re-adding a previously deleted domain can result in a new nameserver assignment. Always use the nameservers displayed for the newly added zone.

5. How long can a Free-plan domain remain Pending?

Cloudflare states that a Free-plan zone that remains Pending for 28 days is automatically deleted.

6. What does Pending Nameserver Update mean?

It means Cloudflare has not yet authenticated the required DNS delegation for the zone.

For a standard full setup, the registrar must publish the exact nameservers assigned to the Cloudflare zone.

7. What does Moved mean in Cloudflare?

Moved generally means a previously active zone failed Cloudflare's DNS checks because its assigned Cloudflare nameservers are no longer being used correctly.

8. How long does a Free-plan zone remain Moved before deletion?

Cloudflare's current documentation states that Free-plan zones are automatically deleted after remaining in Moved status for seven days.

9. What happens after a Cloudflare zone is Deleted?

The zone enters a deleted/archived state. Cloudflare states that deleted zones are normally purged after seven days.

10. What happens after the zone is Purged?

Previous zone settings should not be expected to be recoverable. The domain can still be added again, but DNS and other configuration may need to be recreated.

11. Can Cloudflare deletion affect my email?

Yes, if Cloudflare was hosting the authoritative DNS and MX/TXT records are lost or incorrectly recreated.

Always verify MX, SPF, DKIM and DMARC after DNS recovery.

12. Why is my website still working even though Cloudflare deleted the domain?

The domain may already be using another DNS provider.

Check its NS records to determine which provider is authoritative.

13. Why is my domain still Pending after changing nameservers?

Possible causes include:

• Registrar changes have not propagated.
• Wrong Cloudflare nameservers were entered.
• Old Cloudflare nameservers were used.
• Additional nameservers are configured.
• Stale DNSSEC DS records exist.
• Registrar-side delegation has not been published correctly.

14. How can I verify nameservers from Windows?

Use:

nslookup -type=NS example.com

For more detail:

nslookup -type=NS -debug example.com

15. How can I verify nameservers on Linux or macOS?

Use:

dig NS example.com

For delegation tracing:

dig +trace example.com NS

16. Can DNSSEC stop Cloudflare from activating?

Yes. Stale DS records from a previous DNS configuration can break DNSSEC validation and may prevent correct activation or cause SERVFAIL responses.

17. Should I disable DNSSEC permanently?

Not necessarily.

DNSSEC provides useful protection. During DNS-provider migration it may need to be disabled or reconfigured correctly, then enabled again after the new provider is established.

18. Can changing Cloudflare nameservers cause downtime?

Yes, especially if the destination DNS zone is incomplete.

Verify all required DNS records before changing authoritative nameservers.

19. Should MX records be proxied through Cloudflare?

Normal email-related DNS records should generally remain DNS-only unless a specific supported Cloudflare product or configuration requires otherwise.

20. How can I determine who deleted the domain?

Review Cloudflare Audit Logs and look for deletion activity involving the Zone resource.

Also review account members and API access.

21. Should I re-add the domain immediately?

If the deletion was accidental and Cloudflare is intended to remain the DNS provider, prompt action is advisable. However, first check the current DNS state so you do not disrupt a legitimate migration to another provider.

22. Can I recover a domain after Cloudflare purges the old zone?

You can add the domain to Cloudflare again, but you should not expect the old zone configuration to be restored after purge. Recreate and verify the required DNS settings.

23. Is this problem related to my web-hosting server?

Not necessarily.

Cloudflare DNS, domain registration and web hosting are separate layers. The hosting server can be perfectly healthy while DNS is incorrectly configured.

24. What should I back up before making DNS changes?

At minimum preserve A, AAAA, CNAME, MX, TXT, SPF, DKIM, DMARC, SRV and CAA records, plus important subdomains and Cloudflare proxy status.

25. What is the safest way to prevent this problem?

Keep production Cloudflare zones Active, monitor nameserver-related warnings, protect both Cloudflare and registrar accounts with MFA, restrict administrative access, and maintain an independent DNS configuration backup.

Conclusion

A “Domain Deleted by Cloudflare” notification does not automatically mean that the registered domain has been lost. In most cases, it means the DNS zone has been removed from Cloudflare because the domain was no longer correctly authenticated with Cloudflare, remained Pending or Moved beyond the applicable period, or was removed by an authorized action.

The most important recovery principle is to check the current authoritative DNS configuration before changing anything.

If Cloudflare should continue managing the domain, re-add the zone, carefully verify every important DNS record, use the newly assigned Cloudflare nameservers, check DNSSEC/DS records, update the registrar, wait for delegation, and confirm that the Cloudflare status changes to Active.

For production domains, maintain an independent DNS backup and monitor Cloudflare status notifications. DNS is a critical infrastructure layer: a single incorrect nameserver or missing MX/TXT record can affect websites, email, APIs and other services even when the hosting server itself is functioning normally.

#Tags

#Cloudflare #CloudflareDNS #CloudflareDomain #DomainDeleted #DeletedDomain #DNS #DNSTroubleshooting #DNSManagement #DNSRecovery #DomainRecovery #CloudflareRecovery #Nameserver #Nameservers #NameserverUpdate #NameserverProblem #DNSDelegation #DomainManagement #DomainRegistrar #CloudflareNameserver #CloudflareSetup #CloudflareTroubleshooting #CloudflareError #CloudflareZone #ZoneDeleted #ZoneStatus #PendingNameserverUpdate #CloudflarePending #CloudflareMoved #CloudflareActive #CloudflarePurged #DNSSEC #DNSSECError #DSRecord #SERVFAIL #DNSRecords #MXRecord #SPF #DKIM #DMARC #DomainSecurity #WebsiteSecurity #WebsiteDown #DNSProblem #DNSLookup #NSLookup #WebHosting #DomainHosting #CloudflareGuide #TechnicalSupport #ITSupport