Setup

Warning

Subdomain setup is only available for Enterprise accounts. If you only want to create a subdomain for your site in Cloudflare, refer to Create a subdomain record.

Subdomain setup relies on a process known as delegation. When, in a parent domain such as example.com, an NS record ↗ is created for a subdomain blog.example.com, this means that DNS management for the subdomain can be done separately, in its own DNS zone.

---

Available setups

The availability of different setups will depend on both the parent zone setup and the setup used for the child zone. A child zone holds DNS management for a delegated subdomain.

Parent zone	Child zone	Available
Full or Secondary	Full	Yes
Full or Secondary	Secondary	Yes
Full or Secondary	Partial	No
Partial	Full	Yes
Partial	Secondary	Yes
Partial	Partial*	Yes

* Subdomain zones in partial setup are not delegated

Subdomains using a partial setup represent an exception in the sense that delegation does not apply in this context. As explained in the dedicated Partial (CNAME) setup section, this setup is intended to simply proxy individual subdomains through Cloudflare. For completeness, however, this is listed as an option in this table and the how-to guide has detailed explanation on how to achieve a subdomain zone using partial setup.

This table assumes zones that are in an active status. For example, if you need to add the parent zone to Cloudflare when its child zone already exists in a partial setup, you can convert the parent zone to partial while it is still in pending status.

---

How to

Refer to the following guides to learn how to configure a subdomain setup depending on the setup used for the parent zone:

• Parent zone on full setup
• Parent zone on partial setup

Although the how-to guides in this documentation are focused on both parent domains and subdomains existing in Cloudflare, it is also possible to achieve a subdomain setup in Cloudflare while the parent domain exists in a different DNS provider.

---

SSL/TLS certificates

If the parent domain’s SSL/TLS certificate explicitly lists the delegated subdomain and is created after the subdomain’s SSL/TLS own certificate, the parent domain’s certificate will take precedence over the subdomain’s certificate.

For instance, if example.com creates an advanced certificate that directly lists docs.example.com, visitors to docs.example.com might see the SSL/TLS certificate for example.com.