Connect your domain without losing email

This lesson uses a domain registered at Porkbun with DNS moving to Cloudflare. If your registrar differs, use its equivalent nameserver settings. Keep registration at the current registrar unless you independently want to transfer it.

1. Capture the current zone

Before modifying anything, export the DNS zone if supported and review the provider’s complete record list. Keep a private copy with record type, hostname, value, priority, TTL, and any provider-specific settings. An automatic scan can miss records at hostnames it did not discover.

Include A/AAAA/CNAME website records; MX mail records; TXT SPF, DKIM, DMARC, and verification records; and SRV or other application records. Check the mail provider’s own setup screen for generated DKIM records. Note current nameservers and DNSSEC/DS status at the registrar.

Do not publish that inventory as a course exercise. It may reveal services and verification values unrelated to the blog.

2. Prepare Cloudflare DNS

In the intended account, add your domain and select the Free zone plan. Review the imported records line by line against your inventory. Keep mail-related hostnames DNS-only; mail records must not be treated as web traffic.

If you actually use Porkbun email forwarding, its current documented baseline is:

Type	Host	Value	Priority
MX	@	fwd1.porkbun.com	10
MX	@	fwd2.porkbun.com	20
TXT	@	v=spf1 include:_spf.porkbun.com ~all	—

These examples apply to that service, not every mail setup. Preserve your actual provider’s complete records. If you already have SPF for another sender, merge the permitted senders into one SPF record using the provider’s instructions. Do not add two independent SPF records. See Porkbun’s external-DNS email instructions.

Do not enable another forwarding service during this DNS migration. Changing mail routing is a separate project. Receiving forwarded messages also does not by itself configure sending or replying as your domain address; that needs the appropriate mailbox or authenticated sending service.

3. Handle DNSSEC before changing nameservers

DNSSEC authenticates DNS answers. A registrar DS record pointing to the old provider’s keys can break lookup after a move. Follow Cloudflare’s full-zone migration procedure: address the old DNSSEC/DS configuration before delegation changes, wait for the required propagation, and enable the new DNSSEC setup after the zone is active.

If old DNSSEC is enabled, record the current configuration and follow the registrar/provider steps to remove the old DS record and disable old signing as required. Confirm the DS change has propagated before changing nameservers. After activation, enable Cloudflare DNSSEC and register the new DS details at the registrar. Never reuse the old provider’s DS values.

If you cannot establish the current DNSSEC state, resolve that before switching delegation. A temporary working answer from one resolver is not proof all cached DNSSEC state has updated.

4. Change delegation at the registrar

Cloudflare assigns two nameservers to your zone. In Porkbun’s domain settings, replace the existing nameservers with exactly those two values. Do not copy nameservers from another person’s domain.

Keep the old zone available during propagation. Cloudflare should eventually show the zone as Active. You can inspect delegation with:

dig NS example.com +short
dig MX example.com +short
dig TXT example.com +short

Replace example.com with your domain. dig is normally available on macOS/Linux; on Windows, use a DNS lookup tool or nslookup. Check more than one resolver when investigating propagation. Sending an actual message through your forwarding address is a separate test from checking DNS records.

5. Attach the Worker Custom Domain

Once the Cloudflare zone is active, add this top-level routes property to your existing wrangler.jsonc (this is a fragment, not a replacement file):

"routes": [
  { "pattern": "example.com", "custom_domain": true }
]

Use your own domain. Review the existing web record at that exact hostname. Replace only a conflicting parking/old web record that you intend to retire; preserve unrelated records. Cloudflare creates the needed DNS/certificate configuration for the Workers Custom Domain path. Do not guess an origin IP or add an arbitrary CNAME to the Workers hostname.

Confirm astro.config.mjs and public/robots.txt also use the same canonical domain. Then:

pnpm verify
pnpm deploy:dry-run
pnpm deploy

The Custom Domain route must remain in source configuration so later deployments retain it. Wait for certificate provisioning if the dashboard reports it is pending. If you want www, add it intentionally and use a redirect to your chosen canonical hostname; it is optional for this course.

Checkpoint and reversibility

Check the real domain: homepage, article, About page, RSS, appearance, and a true 404. Inspect the page source for canonical links to your own domain. Verify all mail records and send an actual test message through the forwarding address.

DNS hosting is reversible. Prepare the same zone at a new provider, handle DNSSEC, then change nameservers at the registrar. This Workers Custom Domain setup depends on Cloudflare DNS, so plan a different compatible hosting/routing arrangement too if you leave Cloudflare DNS. Changing nameservers alone does not migrate a website or its comments database.

Commit and push the domain configuration after verification.