Preserve Cloudflare proxy and record attributes when moving DNS through a zone file

A BIND-format import can carry configuration beyond the visible address values.

Source facts

Cloudflare documents BIND zone-file import and export, with fully qualified targets ending in a period for relevant record types. Imported applicable records can be proxied unless that option is disabled. Comments and tags use inline metadata, including reserved cf- tags that represent Cloudflare-specific settings. An exported file therefore needs more review than a simple list of hostnames and addresses.

Source: Cloudflare — Import and export records.

Applicability

This concerns Cloudflare DNS record import/export.

DSE recommendation

DSE recommends retaining an untouched export and reviewing a working copy before import. Validate target-name qualification, record types, TTLs, and proxy intentions alongside comments and reserved tags. Keep mail and third-party verification records in the review rather than importing only web addresses. Use the narrow permissions needed for the operation and keep API credentials separate from the zone file and change evidence. Keep a comparison column for values and another for Cloudflare-specific attributes. Ask the destination owner to approve proxy intent for mail, proof, and web names individually. Reject a migration comparison that ignores reserved inline tags merely because the visible record targets appear to match.

Verification

Import a representative file into a controlled zone and compare its records and relevant attributes with the source. Query fully qualified targets to detect accidental suffix expansion. Confirm intended proxy state and dependent web, mail, or verification behavior separately before using the same process for a production migration.

Official reference

Cloudflare — Import and export records. Reviewed October 20, 2026.