What happens to Cloudflare domains when the owner dies

A domain registration is transferable property, and it is often the most valuable digital asset a person leaves behind. Cloudflare publishes two documented paths for moving one. It can be transferred out to another registrar using the authorization (EPP) code, which auto-approves on the fifth day after the receiving registrar submits the request. Or it can be moved to another Cloudflare account through the Registrar inter-account transfer: the source account submits a move request from the domain's Configuration tab, and the gaining account has five days to accept before the request auto-cancels. That is a genuinely different position from the account around it, which the Self-Serve Subscription Agreement says cannot be assigned or transferred "by operation of law or otherwise" without Cloudflare's prior written consent.

There is no guaranteed route. Cloudflare publishes no estates portal, form, or email, and its Best Practices page says only that it "may be able to assist you" when no succession instructions were left. An executor opens a Cloudflare Support case (Free-plan accounts can submit cases for billing, account, and registrar issues) stating the domain names, the deceased's account email, and any associated email addresses, and supplying the death certificate, letters testamentary or of administration, photo ID, and proof the decedent held the domains. Cloudflare reviews it case by case. Two published limits are worth knowing going in: support cannot make configuration or account changes on a customer's behalf, and it will not answer questions about domains not associated with the account email address used to contact support. That is why obtaining lawful control of the decedent's registered email address, through the email provider's own deceased-user process, changes the position so much.

Because of who has to approve it. Editing the registrant's first name, last name, organization, or email address triggers a Change of Registrant approval, and Cloudflare sends that approval email to the current registrant's address, which is the deceased person's. If the email address itself is being changed, Cloudflare sends a second approval to the new address and both the old and the new address have to approve, with the request auto-cancelling after seven days. This is the wall estates hit, and it is why Cloudflare Support has to be involved. One more trap, and one escape from it: approving a registrant change places a 60-day transfer lock that blocks both a transfer to another registrar and a move to another Cloudflare account, unless the "Do not apply 60 day transfer lock" box is selected before accepting. Only the current registrant's approval page offers that checkbox, so the order in which a registrant change and a transfer are attempted matters a great deal.

Find the renewal dates and make sure the renewals get paid. Everything else can wait; expiration cannot. Domain auto-renewals bill the card on file, and Cloudflare states there is no guarantee a renewal will succeed, so if an executor closes the decedent's bank account or card before the domains are moved, the renewal fails and a published clock starts. For most top-level domains: the domain still resolves for 30 days after expiry, shows a suspension page from day 31 to day 40, enters a redemption period from day 41 to day 70 where restoring it costs a restore fee on top of the renewal, and goes to pending delete from day 71 to day 75, after which it is released for anyone to register. Keep that payment method alive until the registrations are out, then close the account.

Yes, and the cause is the mailbox rather than the money. ICANN requires the registrant email address on a Cloudflare Registrar domain to be verified. If that address is unverified or the verification link expires, ICANN requires the registrar to place a hold on the domain, and Cloudflare temporarily replaces the nameservers with parking nameservers, at which point the site stops resolving. Once verification is completed the nameservers are restored automatically. So if the decedent's email account has been closed or is unreachable, getting the registrant contact onto an address the estate can actually receive mail at is as urgent as the renewal itself. Cloudflare also notes that ICANN rules allow a domain to be suspended or cancelled if the registrant information is invalid.

Very little moves, and this catches people out. Moving the REGISTRATION through the Registrar inter-account transfer moves the WHOIS contact information and nothing else; Cloudflare states plainly that "No other configuration will be moved," all configuration and settings in the source account are lost, and the registration is transfer-locked for 30 days afterward. Moving the ZONE is a separate manual job: DNS records must be exported and reimported, DNSSEC removed first, subscriptions and add-ons cancelled, and SSL/TLS certificates reissued, because certificates associated with the previous account are not transferred (ACM certificates deploy automatically once the domain is Active, and custom certificates must be deleted from the old zone and uploaded to the new one). The old zone goes to "Moved Away," then "Deleted" after 7 days, and is permanently removed 7 days after that. As for Workers scripts, R2 buckets, Pages deployments, KV namespaces, D1 databases, Zero Trust configurations and account-owned API tokens, Cloudflare documents no path for moving them to another account at all. Treat the domain registrations as the recoverable asset and the account-level services as something the estate rebuilds from source control and backups, or writes off.