What happens to Cloudflare domains when the owner dies
Cloudflare has a formal process for transferring domains after an account holder dies
Cloudflare Support
Cloudflare Data Protection Officer / Rights Requests (no dedicated estate or bereavement team is published)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attn: Data Protection Officer
No published timeline and no SLA. Cloudflare says only that it "may be able to assist you" when no succession instructions exist, and handles the request at its discretion. The deadlines that do bind are the registry's and ICANN's, not Cloudflare's: a domain expires on its renewal date and registrant rights cease at expiration, a Registrar inter-account transfer request auto-cancels if the target account does not accept within 5 days, a transfer out auto-approves on the fifth day, a Change of Registrant request auto-cancels after 7 days, and an approved registrant change locks the domain against any transfer for 60 days. Move on the renewal date first; the account questions can wait, the expiration cannot.
Cloudflare publishes no formal estate or bereavement process, no document checklist, no dedicated estate team, and no SLA. What it does publish is a single acknowledgement of the scenario on its Account and Domain Management Best Practices page, which lists the ways an account can be lost -- "Death, divorce, disgruntled employee, or simply missing an email notification" -- and says that "If you learn no instructions are available on how to access the account of the deceased, Cloudflare may be able to assist you." Assistance is discretionary. The Self-Serve Subscription Agreement (last updated September 12, 2025) Section 16 states: "You may not assign or transfer this Agreement or your rights hereunder, in whole or in part, by operation of law or otherwise, without our prior written consent." So the ACCOUNT does not pass to the estate by operation of law without Cloudflare's consent. The DOMAIN REGISTRATION is a different matter: it is transferable property with two documented paths (out to another registrar using the authorization code, or between Cloudflare accounts using the Registrar inter-account transfer), and the estate's central task is to get the registrations moved to an account it controls before they lapse. Two frictions govern that. First, changing the registrant's name, organization, or email triggers a Change of Registrant approval sent to the current registrant's email address -- the decedent's -- and an email change requires both the old and the new address to approve, so control of the decedent's mailbox (obtained through the email provider's own deceased-user process) is often the practical key. Second, the Domain Registration Agreement provides that a registrant's rights cease upon expiration, and auto-renewal bills the card on file, so a failed payment can end the asset outright.
How to request a transfer
Here is the process for transferring Cloudflare domains after the account holder dies:
- •Look up each of the decedent's domains in public WHOIS to see whether Cloudflare is the registrar, or only the DNS and CDN provider with the registration held elsewhere
- •Check the decedent's email for Cloudflare renewal, billing, and expiration notices, which name the domains and the account email
- •Check whether the deceased left written instructions for account access. Cloudflare's Account and Domain Management Best Practices page recommends exactly that, and notes that access is lost through "Death, divorce, disgruntled employee, or simply missing an email notification."
- •Separate the two asset classes: the domain REGISTRATIONS, which transfer, and the account-level services (Workers, Pages, R2, KV, D1, Zero Trust, account-owned API tokens), which do not move between Cloudflare accounts at all
- •Certified copy of the death certificate
- •Letters testamentary or letters of administration appointing the executor or personal representative
- •Government-issued photo ID for the executor
- •Proof the decedent held the domains (WHOIS records, registrar or renewal invoices, or proof of the business relationship to the account)
- •The digital-assets (RUFADAA) authorization clause from the will or trust, if the estate documents contain one
- •Registrar inter-account transfer (Cloudflare to Cloudflare): the source account submits a move request from the domain's Configuration tab and the target account accepts within five days, after which the request auto-cancels. The domain must have been registered at least 10 days earlier, the registrant email must be verified, the domain must not be in pendingDelete, redemptionPeriod, or pendingTransfer status, and DNSSEC and any zone or administrative lock must be cleared. Cloudflare states "No other configuration will be moved" -- only the WHOIS contact information travels with the registration, and the registration is transfer-locked for 30 days afterward.
- •Transfer out to another registrar: unlock the domain (Manage Domains > Configuration > Unlock), copy the authorization (EPP) code, and give it to the receiving registrar. Cloudflare auto-approves on the fifth day if it is not approved manually. ICANN blocks the transfer if the domain was registered or transferred within the last 60 days, or if the WHOIS registrant information was modified within the last 60 days.
- •Changing the registrant of record: editing the registrant's first name, last name, organization, or email triggers a Change of Registrant approval sent to the CURRENT registrant's email address, and an email change requires both the old and the new address to approve, with a seven-day window before the request auto-cancels. Approving without opting out places the domain on a 60-day transfer lock that "prevents the transfer of the domain to another registrar, and the transfer to another Cloudflare account" -- so sequence the registrant change and the transfer deliberately, not both at once.
- •Account-level services (Workers scripts, Pages deployments, R2 storage buckets, KV namespaces, D1 databases, Zero Trust configurations, account-owned API tokens) are tied to the account and cannot be moved to another Cloudflare account. Worker code can be redeployed from source control, but bindings, secrets, and stored data must be re-provisioned from backups.
- •Moving the zone (the domain's Cloudflare configuration) to another account is a separate, manual process from moving the registration: export DNS records first, remove DNSSEC, cancel add-ons and subscriptions, add the domain to the new account, update nameservers, and reimport DNS
- •Universal SSL and Advanced certificates re-provision automatically on the new account; custom uploaded SSL certificates must be deleted from the old zone and re-uploaded to the new one
- •The old zone transitions to "Moved Away," then "Deleted" after 7 days, and is permanently removed 7 days after that
Required Documents
- Certified copy of the death certificate
- Letters testamentary or letters of administration appointing the executor or personal representative
- Government-issued photo ID for the executor
- Proof the decedent held the domains (WHOIS records, registrar or renewal invoices, or proof of the business relationship to the account)
- The digital-assets (RUFADAA) authorization clause from the will or trust, if the estate documents contain one
- The deceased's Cloudflare account email address and the domain names at issue (Cloudflare Support identifies the account by these)
- Note: Cloudflare publishes no document checklist for deceased-account requests. This list is what an estate request calls for in practice; Cloudflare requests documents case by case and may ask for more, or decline.
Timeline
No published timeline and no SLA. Cloudflare says only that it "may be able to assist you" when no succession instructions exist, and handles the request at its discretion. The deadlines that do bind are the registry's and ICANN's, not Cloudflare's: a domain expires on its renewal date and registrant rights cease at expiration, a Registrar inter-account transfer request auto-cancels if the target account does not accept within 5 days, a transfer out auto-approves on the fifth day, a Change of Registrant request auto-cancels after 7 days, and an approved registrant change locks the domain against any transfer for 60 days. Move on the renewal date first; the account questions can wait, the expiration cannot.
Frequently asked questions
Nothing changes immediately. The account stays active and everything keeps running: domains resolve, Workers execute, R2 storage persists, Zero Trust policies enforce, and the card on file keeps getting charged. There is no formal estate process. Cloudflare's Account and Domain Management Best Practices page is its only published acknowledgement of the situation, and it says Cloudflare "may be able to assist you" on a discretionary basis. The danger is the renewal date, not the account: a Cloudflare Registrar domain that is not renewed expires, and under the Domain Registration Agreement the registrant's rights cease at expiration.
A domain registration is transferable property, and it is often the most valuable digital asset a person leaves behind. Cloudflare publishes two documented paths for moving one. It can be transferred out to another registrar using the authorization (EPP) code, which auto-approves on the fifth day after the receiving registrar submits the request. Or it can be moved to another Cloudflare account through the Registrar inter-account transfer: the source account submits a move request from the domain's Configuration tab, and the target account has five days to accept. That is a genuinely different position from the account around it, which the Self-Serve Subscription Agreement says cannot be assigned or transferred "by operation of law or otherwise" without Cloudflare's prior written consent.
There is no guaranteed route. Cloudflare publishes no estates portal, form, or email, and its Best Practices page says only that it "may be able to assist you" when no succession instructions were left. An executor opens a Cloudflare Support case (Free-plan accounts can open cases for billing, account, and registrar issues) stating the domain names, the deceased's account email, and any associated email addresses, and supplying the death certificate, letters testamentary or of administration, photo ID, and proof the decedent held the domains. Cloudflare reviews it case by case. In practice, obtaining lawful control of the decedent's registered email address through the email provider's own deceased-user process changes the odds substantially, because Cloudflare's registrant-change and recovery flows run through that mailbox.
Because of who has to approve it. Editing the registrant's first name, last name, organization, or email address triggers a Change of Registrant approval, and Cloudflare sends that approval email to the current registrant's address, which is the deceased person's. If the email address itself is being changed, both the old and the new address have to approve for the change to complete, and the request auto-cancels after seven days. This is the wall estates hit, and it is why Cloudflare Support has to be involved. One more trap: once a registrant change is approved, the domain goes on a 60-day transfer lock that blocks both a transfer to another registrar and a move to another Cloudflare account, so an executor should sequence the registrant change and the transfer deliberately rather than attempting both at once.
Find the renewal dates and make sure the renewals get paid. Everything else can wait; expiration cannot. Domain auto-renewals bill the card on file, so if an executor closes the decedent's bank account or card before the domains are moved, the renewals fail, the registrations enter the ICANN redemption and deletion lifecycle, and the Domain Registration Agreement provides that the registrant's rights cease at expiration. Keep that payment method alive until the registrations are out, then close the account.
These are the parts that do not transfer. Workers scripts, R2 storage buckets, Pages deployments, KV namespaces, D1 databases, Zero Trust configurations, and account-owned API tokens are all account-level resources and cannot be moved to another Cloudflare account. If account access is lost, they become inaccessible. Worker code can be redeployed to a new account from source control, but the bindings around it (KV data, R2 objects, D1 databases, secrets) have to be re-provisioned from backups. Treat the domain registrations as the recoverable asset and the account-level services as something the estate rebuilds or writes off.
Very little, and this catches people out. Moving the REGISTRATION through the Registrar inter-account transfer moves the WHOIS contact information and nothing else; Cloudflare states plainly that "No other configuration will be moved," and the registration is transfer-locked for 30 days afterward. Moving the ZONE (the domain's Cloudflare configuration) is a separate manual job: DNS records must be exported and reimported, DNSSEC must be removed first, subscriptions and add-ons must be cancelled, Universal and Advanced SSL certificates re-provision automatically but custom uploaded certificates must be deleted and re-uploaded, and the old zone goes to "Moved Away," then "Deleted" after 7 days, and is permanently removed 7 days after that.
Partially. If the domain is registered somewhere other than Cloudflare, the estate can repoint its nameservers away from Cloudflare, which restores DNS control but abandons every Cloudflare-only configuration (Workers, Pages, R2, cache rules, WAF, Zero Trust). If the domain is registered at Cloudflare Registrar, the estate needs account access to unlock it and obtain the EPP code, which is exactly why the support request and the registrant question matter so much. This is also the strongest argument for adding a Super Administrator while the account holder is alive.
Once transferred, domains are subject to the program's standard terms. Having the deceased account holder's details documented in advance makes the transfer process significantly easier for the family.
Sources
Data sourced from Cloudflare primary sources (12 pages reviewed). How we research.
Cloudflare Support
Cloudflare Data Protection Officer / Rights Requests (no dedicated estate or bereavement team is published)
Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, Attn: Data Protection Officer
No published timeline and no SLA. Cloudflare says only that it "may be able to assist you" when no succession instructions exist, and handles the request at its discretion. The deadlines that do bind are the registry's and ICANN's, not Cloudflare's: a domain expires on its renewal date and registrant rights cease at expiration, a Registrar inter-account transfer request auto-cancels if the target account does not accept within 5 days, a transfer out auto-approves on the fifth day, a Change of Registrant request auto-cancels after 7 days, and an approved registrant change locks the domain against any transfer for 60 days. Move on the renewal date first; the account questions can wait, the expiration cannot.
