← Dns / dns / zone-setups

Subdomain setup

When you use a subdomain setup, you can manage the Cloudflare configurations for one or more subdomains separately from those associated with your apex domain. This means that, on your account homepage ↗, you would find websites like example.com or blog.example.com listed as separate zones.

You might use this setup when you want to share access to a specific subdomain's settings with different teams, but have stricter controls on your apex domain. For example, a subdomain setup could allow your documentation team to manage the Cloudflare configuration for docs.example.com, while preventing them from adjusting any settings on example.com.

Subdomain setups are also useful when different subdomains require entirely different settings. For example, you may have different requirements for docs.example.com, blog.example.com, and community.example.com.

To use subdomain setups with Cloudflare Access, note that:

• If the child zone is in a pending state when you create the Access application, your configuration will not automatically apply when you activate the zone. You must also re-save the Access application once your subdomain setup is active.

• If you split out a subdomain which already has an Access application, you will also need to re-save the Access application to associate it with the new child zone.

• Setup
• Enable DNSSEC
• Migrate to new account
• Rollback

If you have both a parent zone (for example, example.com) and a child subdomain zone (for example, sub.example.com) on Cloudflare, the parent zone's DNS analytics may show queries for hostnames belonging to the child zone.

This is normal DNS behavior — recursive resolvers query the parent zone first to get the referral (NS records) pointing to the child zone's nameservers. These referral queries appear in the parent zone's analytics even though the authoritative answer comes from the child zone.