Zone stuck in Pending Nameserver Update

A zone stays in Pending Nameserver Update when Cloudflare cannot confirm that your domain is delegated to the Cloudflare nameservers assigned to it.

The most common reasons are that the nameserver change was not fully published at the registrar, that the domain is not using the exact nameservers assigned to it, or that stale DNSSEC records at the registrar are blocking the delegation.

The rest of this page walks through what to check, in order, and shows how to verify each item independently of your registrar's control panel.

For details on how zone status is evaluated, refer to Zone status.

In the Cloudflare dashboard, open the domain and go to the Overview page. Copy the full list of nameservers Cloudflare has assigned to this zone. The number of nameservers and their hostname format depend on your setup:

Whichever format applies, the exact values shown in your dashboard are the ones the parent zone must publish. Do not assume the assignment is the same as one you have used before on another domain or in another account. For details, refer to Nameserver assignments.

The registrar control panel shows what you asked the registrar to publish. It does not show what the parent zone (the TLD) is actually returning to the Internet. These can differ when a change was not saved, not yet propagated, applied to a different domain, or applied in a different registrar account.

Use one of the following methods to query the parent zone directly.

dig +trace follows the delegation from the root zone down. Adding +noall +authority +nodnssec trims the output to just the delegation section from each level, which is what you care about when checking where the parent zone points your domain. In a terminal, run:

dig +trace example.com NS +noall +authority +nodnssec

• +trace — follows the delegation step by step, from the root nameservers down to your domain, instead of asking a single recursive resolver.
• +noall +authority — hides everything except the AUTHORITY section returned at each hop, which is where each parent zone lists the nameservers it delegates to. The last hop shown before your domain is the parent zone (com., co.uk., etc.), and its authority section is what actually delegates your zone.
• +nodnssec — hides DNSSEC-related records (RRSIG, NSEC, NSEC3, and DNSKEYs) so the output is easier to scan.

The last non-empty section of the output should return only the Cloudflare nameservers assigned to your zone (or, if you use multi-provider DNS, it should include them alongside your other provider's nameservers).

If you are on Windows or prefer nslookup, query the NS records for your domain. Add the -debug flag to see the full response, including the authority section. In a terminal, run:

nslookup -type=ns -debug example.com

By default, nslookup queries your system's configured resolver, which may return a cached answer. For a definitive check against the parent zone (equivalent to dig +trace), query a TLD nameserver directly by adding it as the last argument. For a .com domain, this looks like:

nslookup -type=ns -debug example.com a.gtld-servers.net

For other TLDs, refer to IANA's root zone database ↗ to find the authoritative nameservers for your TLD.

If the output shows nameservers other than the ones assigned to your Cloudflare zone, the delegation is not yet correct.

If you do not have dig or nslookup locally, use a public lookup tool:

• digwebinterface.com ↗ - enable the Trace option to follow the delegation from the root zone down, which is the equivalent of dig +trace.
• whatsmydns.net ↗ - useful to see the NS record as observed from resolvers in multiple regions.

Query the NS record for your domain. The result must match the nameservers assigned in your Cloudflare dashboard.

Use the following table to decide the next step based on what your lookup returns:

If the parent zone does not return the correct Cloudflare nameservers, the registrar has not published your change. Common patterns:

• The nameserver change was entered in the registrar UI but not saved or submitted.
• The change was made on a different domain, on a subdomain, or in a different registrar account.
• The domain is under a Transfer, Registrar Lock, or Redemption state that prevents nameserver changes. Complete or cancel the pending state first.
• The registrar requires an additional confirmation step (email confirmation, admin approval, two-factor prompt).
• The registrar publishes changes on a delay. Ask your registrar's support for their expected propagation window.
• Your domain is at a reseller and the nameserver setting must be changed one level up. Refer to Update your nameservers at your registrar.

After fixing the change at the registrar, re-run the check from Step 2.

If Step 2 shows the correct Cloudflare nameservers at the parent zone but the zone is still Pending, check whether DNSSEC is still enabled from a previous DNS provider.

DS records live at the registrar, not at the DNS provider, and they must be removed or updated when you move DNS providers. If they are not, the DNSSEC chain of trust breaks and resolvers return SERVFAIL for your domain.

To check for DS records:

dig DS example.com

If DS records are returned and you did not intentionally configure DNSSEC on Cloudflare, they are stale from your previous provider and will block activation.

To remove them:

1. Sign in to your registrar's control panel.
2. Find DNSSEC settings (often under Advanced DNS or Security).
3. Remove all existing DS records.
4. Wait up to 24 hours for the removal to propagate through DNS caches.

After the stale DS records are removed and expire from cache, your Cloudflare zone will activate automatically. You can then enable DNSSEC in Cloudflare if you want to.

For more information on DNSSEC configuration, refer to Configure DNSSEC and Troubleshoot DNSSEC.

If Steps 1-4 all check out, and the parent zone returns the correct Cloudflare nameservers, wait for Cloudflare's next activation check. Checks happen on an increasing interval.

You can request an earlier check from the Overview page or by triggering one via API. This endpoint is rate-limited and may return an error if you have requested a check recently. A successful request does not activate the zone immediately — it places your zone in a prioritized queue, and activation can take a few minutes to a few hours, depending both on when the recheck runs and on whether the nameserver change at your registrar has taken effect by then.

If the parent zone matches, DS records are clean, and the zone still does not activate after several rechecks, contact Cloudflare Support and include:

• Your domain name.
• The Cloudflare nameservers assigned in the dashboard.
• The output of dig +trace <YOUR_DOMAIN> NS.
• The output of dig DS <YOUR_DOMAIN>.
• The registrar you use.