Planning ahead for your Cloudflare domains
Lifetime transfer options and steps to take now for Cloudflare domains
Cloudflare Support
Cloudflare Data Protection Officer / Rights Requests (no dedicated estate or bereavement team is published)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attn: Data Protection Officer
Cloudflare does not guarantee transfer of domains after death. Lifetime planning provides options for managing domains and controlling who has access to them.
How to protect your Cloudflare domains
Here are 9 steps to protect and manage your Cloudflare domains while the account is active:
- •In the dashboard, go to Manage Account > Members > Invite Members and enter the executor or successor's email
- •Assign the "Super Administrator - All Privileges" role, which can edit any Cloudflare setting, make purchases, update billing, manage members, create account-owned API tokens, and revoke access from other Super Administrators
- •The invitee receives an email to accept; Enterprise accounts can use Direct Add to skip the email confirmation
- •Super Administrators can manage all account-level services (Workers, R2, Pages, Zero Trust, KV, D1) and all domain configurations
- •This avoids the high-complexity process of moving domains between accounts, where almost nothing transfers automatically
- •Create tokens from Manage Account > API Tokens (not from User Profile > API Tokens)
- •Account-owned tokens are not tied to any individual user and persist through personnel changes
- •User-level API tokens stop working if the user is removed from the account
- •The legacy Global API Key is tied to the individual user's login credentials and dies with them
- •The source account gets the target account ID, adds the domain to the target account on a selected plan, and disables DNSSEC
- •The source account submits the move request from the Configuration tab of the Manage Domain page; the target account is emailed and must accept or reject within five days or the request auto-cancels
- •Eligibility: the domain must have been registered at least 10 days earlier, the registrant email must be verified, there can be no pending registrant change, the domain cannot be administratively locked or in pendingDelete, redemptionPeriod, or pendingTransfer status, and the zone lock must be released
- •Cloudflare states "No other configuration will be moved" -- only the WHOIS contact information travels with the registration
- •After a successful move the registration is transfer-locked for 30 days
- •Export DNS records from the current account before starting (Cloudflare recommends this explicitly to avoid 1000-class errors)
- •Remove DNSSEC configurations and cancel any add-ons or subscriptions on the domain
- •Add the domain to the destination account and update nameservers at the registrar
- •Use "Re-check now" in the dashboard to verify the nameserver change; the domain becomes Active when recognized
- •Import DNS records into the new account; Universal SSL and Advanced certificates re-provision automatically
- •Custom or uploaded SSL certificates must be deleted from the old zone and re-uploaded to the new zone (upload while Pending; they activate when the zone becomes Active)
- •The old zone transitions to "Moved Away," then "Deleted" after 7 days, and is permanently removed after another 7 days
- •Unlock the domain in the Cloudflare dashboard (Manage Domains > select domain > Configuration > Unlock)
- •Copy the generated authorization (EPP) code (regenerate it if lost)
- •Provide the code to the receiving registrar; approve manually in Cloudflare, or let it auto-approve on the fifth day after Cloudflare receives the request
- •ICANN blocks the transfer if the domain was registered or transferred within the last 60 days, or if the WHOIS registrant information was modified within the last 60 days
- •When the transfer completes, Cloudflare removes the domain from the account and does not charge for future renewals
- •To change the registrant itself (Manage > Contacts), note that editing the first name, last name, organization, or email triggers a Change of Registrant approval emailed to the CURRENT registrant address; an email change needs BOTH the old and new addresses to approve; the request auto-cancels after seven days; and approving it places the domain on a 60-day lock that blocks both a registrar transfer and a move to another Cloudflare account
Family sharing
Cloudflare supports multi-user accounts with role-based access, and this is the lifetime planning mechanism that actually works. The "Super Administrator - All Privileges" role grants the highest level of access: a Super Administrator can edit any Cloudflare setting, make purchases, update billing, manage members, create account-owned API tokens, and revoke access from other Super Administrators. Adding a trusted person as a Super Administrator in advance (Manage Account > Members > Invite Members) is what Cloudflare's own best-practices guidance points to, and it sidesteps the entire post-death recovery problem. On top of that, a domain registration itself is transferable: it can be moved to another Cloudflare account through the Registrar inter-account transfer (the source account submits the move request, the target account accepts within five days), or transferred out to another registrar with the authorization (EPP) code. Neither path carries the surrounding configuration -- DNS records, SSL certificates, subscriptions, and every account-level service stay behind and must be rebuilt.
Should you save your passwords for your family?
Some people store account passwords so a family member can sign in later. The practice has three practical limits:
- Two-factor authentication often blocks it. Most accounts require a second factor — a code sent to a phone, an authenticator app, a passkey, or a physical key. A saved password alone frequently does not grant access, and the recovery codes that would are easy to lose or let go stale.
- It usually conflicts with the platform's terms. Most operators prohibit account sharing and signing in as another person, including after a death. Stored credentials are not the operator's recognized access path, and using them can violate the terms of service.
- Operators provide other paths. Where an operator offers a designation tool — Apple's Legacy Contact, Google's Inactive Account Manager, a beneficiary designation — that mechanism grants access the operator recognizes. A password manager's own emergency-access or legacy feature passes credentials through a controlled process. Digital assets named in a will or trust give a fiduciary authority under each state's Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA).
Frequently asked questions
Add a trusted person as a "Super Administrator - All Privileges" on the account, in advance. That role can edit any Cloudflare setting, make purchases, update billing, manage members, create account-owned API tokens, and even revoke other Super Administrators. It is Cloudflare's own recommendation, and it makes the entire post-death recovery problem disappear. The alternative is leaving your family with a discretionary support request, a mailbox they may not control, and a renewal clock they may not know about.
No. Cloudflare does not support beneficiary designations or legacy contacts. Adding a Super Administrator is the reliable continuity mechanism. Beyond that: list your domains in your estate documents with the registrar, renewal date, and who should inherit each one; keep the registrant email address on your domains reachable by someone other than you; and use account-owned API tokens (created from Manage Account > API Tokens, not from User Profile) for any automated integration, because user-level tokens and the legacy Global API Key are tied to the individual and stop working when that user is removed.
Unlock the domain in the dashboard (Manage Domains > select the domain > Manage > Configuration > Unlock), copy the authorization (EPP) code, and give it to the receiving registrar. Approve the transfer in Cloudflare, or let it auto-approve on the fifth day after Cloudflare receives the request. ICANN blocks the transfer if the domain was registered or transferred within the last 60 days, or if the WHOIS registrant information was modified within the last 60 days. This moves only the registration: DNS, caching, security rules, Workers, and every other Cloudflare service have to be set up again at the new provider.
Listing the Cloudflare account in an estate inventory identifies it for a fiduciary, who works through the operator's official channels to manage or close it.
Cloudflare does not offer beneficiary designations, so there is no program-level mechanism for directing domains to a specific person at death.
Sources
Data sourced from Cloudflare primary sources (12 pages reviewed). How we research.
Cloudflare Support
Cloudflare Data Protection Officer / Rights Requests (no dedicated estate or bereavement team is published)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attn: Data Protection Officer
