Subdomain delegation
Subdomain setup relies on a process known as delegation. When, in a parent domain such as example.com, an NS record is created for a subdomain blog.example.com, this means that DNS management for the subdomain can be done separately, in its own DNS zone.
Available setups
The availability of different setups will depend on both the parent zone setup and the setup used for the child zone. A child zone holds DNS management for a delegated subdomain.
| Parent zone | Child zone | Available |
|---|---|---|
| Full or Secondary | Full | Yes |
| Full or Secondary | Secondary | Yes |
| Full or Secondary | Partial | No |
| Partial | Full | Yes |
| Partial | Secondary | Yes |
| Partial | Partial* | Yes |
This table assumes zones that are in an active status. For example, if you need to add the parent zone to Cloudflare when its child zone already exists in a partial setup, you can convert the parent zone to partial while it is still in pending status.
How to
Refer to the following guides to learn how to configure a subdomain setup depending on the setup used for the parent zone:
Although the how-to guides in this documentation are focused on both parent domains and subdomains existing in Cloudflare, it is also possible to achieve a subdomain setup in Cloudflare while the parent domain exists in a different DNS provider.
SSL/TLS certificates
If the parent domain’s SSL/TLS certificate explicitly lists the delegated subdomain and is created after the subdomain’s SSL/TLS own certificate, the parent domain’s certificate will take precedence over the subdomain’s certificate.
For instance, if example.com creates an advanced certificate that directly lists docs.example.com, visitors to docs.example.com might see the SSL/TLS certificate for example.com.