Planning ahead for your Cloudflare domains
Lifetime transfer options and steps to take now for Cloudflare domains
Cloudflare Support
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107
Cloudflare Data Protection Officer / Rights Requests (no dedicated estate or bereavement team is published)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attention: Data Protection Officer
Cloudflare does not guarantee transfer of domains after death. Lifetime planning provides options for managing domains and controlling who has access to them.
How to protect your Cloudflare domains
Here are 8 steps to protect and manage your Cloudflare domains while the account is active:
- •In the dashboard, go to Manage Account > Members > Invite Members and enter the executor or successor's email
- •Assign the "Super Administrator - All Privileges" role, which "can edit any Cloudflare setting, make purchases, update billing, manage members, and create account-owned API tokens" and can revoke the access of other Super Administrators
- •The invitee receives an email to accept, and needs a verified email address; Enterprise accounts can use Direct Add to skip the email confirmation
- •Cloudflare states it "recommends having more than one user as Super Administrators for your accounts, so that if you are unable to login with your credentials for any reason, there is another one you can use to manage your domains"
- •This avoids the high-complexity process of moving domains between accounts, where almost nothing transfers automatically
- •Section 1.5 of the Domain Registration Agreement provides that the person named as administrative contact when the controlling account was secured "shall be deemed a designee of the Registrant with the authority to manage the domain name" -- so naming a trusted administrative contact is a registrar-level counterpart to the Super Administrator role
- •Keep the registrant email address current and reachable by someone other than you. A Change of Registrant approval goes to the registrant address on file, and an email change needs both the old and the new address to approve.
- •Do not let the registrant email go unverified. ICANN requires verification, and Cloudflare places a hold and swaps in parking nameservers when it lapses, which stops the site resolving.
- •Note in your estate documents which mailbox the registrant email is, and avoid using an address on the domain itself -- Cloudflare's own best-practices guidance recommends an address not tied to the domain name
- •Create tokens from Manage Account > Account API Tokens (not from My Profile > API Tokens); creating or updating one requires Super Administrator permission on the account
- •Cloudflare's own framing: "While user tokens act on behalf of a particular user and inherit a subset of that user's permissions, account API tokens allow you to set up durable integrations that can act as service principals with their own specific set of permissions" -- explicitly so that an integration "continues working, even long after the user who configured the integration may have left"
- •User tokens are better suited to ad hoc scripting, where acting as the user is the point and durability is not
- •Check the compatibility matrix before relying on one: a few products, Registrar among them, do not yet support account API tokens
- •The legacy Global API Key is tied to the individual user's login credentials
- •The source account gets the target account ID, adds the domain to the target account on a selected plan, and disables DNSSEC
- •The source account submits the move request from the Configuration tab of the Manage Domain page; the gaining account is emailed and must accept or reject within five days or the request auto-cancels
- •Eligibility: registered more than 10 days ago, registrant email verified, no pending Change of Registrant, not administratively locked (including by dispute or court order), no pendingDelete, redemptionPeriod or pendingTransfer registry status, and any zone lock released
- •Cloudflare states "No other configuration will be moved" -- only the WHOIS contact information travels with the registration, and all configuration and settings in the source account are lost
- •After a successful move the registration is transfer-locked for 30 days, and the target account becomes responsible for renewals
- •Export DNS records from the current account before starting (Cloudflare recommends this explicitly to avoid 1000-class errors)
- •Remove DNSSEC configurations and cancel any add-ons or subscriptions on the domain
- •Add the domain to the destination account and update nameservers at the registrar, then use "Re-check now" to verify; the domain becomes Active when the change is recognized
- •Import DNS records into the new account. SSL/TLS certificates are NOT transferred and must be reissued; ACM certificates deploy automatically once the domain is Active.
- •Custom or uploaded SSL certificates must be deleted from the old zone and re-uploaded to the new zone (upload while Pending; they go live when the zone becomes Active)
- •The old zone transitions to "Moved Away," then "Deleted" after 7 days, and is permanently removed after another 7 days
Family sharing
Cloudflare supports multi-user accounts with role-based access, and this is the lifetime planning mechanism that actually works. The "Super Administrator - All Privileges" role grants the highest level of access: a Super Administrator "can edit any Cloudflare setting, make purchases, update billing, manage members, and create account-owned API tokens" and can revoke the access of other Super Administrators. Cloudflare recommends this directly, in its own words: "Cloudflare recommends having more than one user as Super Administrators for your accounts, so that if you are unable to login with your credentials for any reason, there is another one you can use to manage your domains." Adding a trusted person in advance (Manage Account > Members > Invite Members) sidesteps the entire post-death recovery problem. The Domain Registration Agreement adds a second, registrar-level lever at Section 1.5: the person named as administrative contact when the controlling account was secured "shall be deemed a designee of the Registrant with the authority to manage the domain name." On top of that, a domain registration itself is transferable: it can be moved to another Cloudflare account through the Registrar inter-account transfer (the source account submits the move request, the target account accepts within five days), or transferred out to another registrar with the authorization (EPP) code. Neither path carries the surrounding configuration -- DNS records, SSL certificates, subscriptions, and every account-level service stay behind and must be rebuilt.
Should you save your passwords for your family?
Some people store account passwords so a family member can sign in later. The practice has three practical limits:
- Two-factor authentication often blocks it. Most accounts require a second factor — a code sent to a phone, an authenticator app, a passkey, or a physical key. A saved password alone frequently does not grant access, and the recovery codes that would are easy to lose or let go stale.
- It usually conflicts with the platform's terms. Most operators prohibit account sharing and signing in as another person, including after a death. Stored credentials are not the operator's recognized access path, and using them can violate the terms of service.
- Operators provide other paths. Where an operator offers a designation tool — Apple's Legacy Contact, Google's Inactive Account Manager, a beneficiary designation — that mechanism grants access the operator recognizes. A password manager's own emergency-access or legacy feature passes credentials through a controlled process. Digital assets named in a will or trust give a fiduciary authority under each state's Revised Uniform Fiduciary Access to Digital Assets Act (RUFADAA).
Frequently asked questions
Add a trusted person as a "Super Administrator - All Privileges" on the account, in advance. That role can edit any Cloudflare setting, make purchases, update billing, manage members, create account-owned API tokens, and revoke other Super Administrators. Cloudflare recommends it in its own documentation, advising more than one Super Administrator so that there is another way in if you cannot log in with your credentials. Two things pair with it. Name a trusted administrative contact on the domain: the Domain Registration Agreement provides that the administrative contact named when the controlling account was secured is deemed a designee of the registrant with authority to manage the domain name. And generate a domain ownership certificate, the PDF Cloudflare issues certifying it is the registrar of record and listing the registration data, and keep it with your estate documents.
No. Cloudflare does not support beneficiary designations or legacy contacts. Adding a Super Administrator is the reliable continuity mechanism. Beyond that: list your domains in your estate documents with the registrar, renewal date, registrant email, and who should inherit each one; keep the registrant email address reachable by someone other than you, and not on the domain itself; and use account-owned API tokens for any automated integration. Cloudflare designs those tokens so an integration keeps working "even long after the user who configured the integration may have left," whereas user tokens act on behalf of a particular user and inherit that user's permissions, and the legacy Global API Key is tied to the individual's login credentials. Check the compatibility matrix first, since a few products including Registrar do not yet support account API tokens.
Listing the Cloudflare account in an estate inventory identifies it for a fiduciary, who works through the operator's official channels to manage or close it.
Cloudflare does not offer beneficiary designations, so there is no program-level mechanism for directing domains to a specific person at death.
Sources
Data sourced from Cloudflare primary sources (16 pages reviewed). How we research.
Cloudflare Support
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107
Cloudflare Data Protection Officer / Rights Requests (no dedicated estate or bereavement team is published)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attention: Data Protection Officer
Is this your situation?
Get a complete guide for your specific circumstances.
New Baby or Adoption
Your family is growing. Your protection should too. Guardian nominations, trusts for minors, beneficiary updates, and the documents new parents need in place.
Learn more
Marriage
What married couples need in place: one joint trust or two, wills, beneficiary updates, and the spousal rights your state grants you automatically.
Learn more
New Home
How to put your house in a revocable trust: the deed you record, what it does to your mortgage and property taxes, and when a TOD deed is simpler.
Learn more
Retirement
Retirement changes your financial picture. Healthcare directives, beneficiary reviews, long-term care planning, and protecting what you've built.
Learn moreMore estate planning resources
Explore related tools and documents to complete your estate plan.
How Much Does Probate Cost?
Estimate attorney fees, executor fees, court costs, and timeline for probating an estate in your state. See if the estate qualifies for simplified probate procedures.
Who Inherits Without a Will?
Find out who inherits your estate and how much they get if you die without a will. Based on your state's intestate succession laws.
How Much Are Estate & Inheritance Taxes?
Calculate federal estate tax, state estate tax (12 states + DC), and inheritance tax (5 states) for an estate or trust.
What Does Estate Planning Actually Cost?
See the true cost of estate planning. Compare SimplyTrust, Trust & Will, LegalZoom, and attorneys including life events like marriage, divorce, and having children.
How Much Does a Revocable Living Trust Cost?
Compare the cost of creating a revocable living trust. See how SimplyTrust, Trust & Will, LegalZoom, and attorneys compare over 5 years including life events.
How Much Does a Will Cost?
Compare the cost of creating a will. See document costs plus probate fees your heirs will pay. Compare SimplyTrust, Trust & Will, LegalZoom, and attorneys.
