Exchange is excluded from this API/CLI release. Any historical Exchange API or CLI example in this guide is unavailable; native portal behavior is outside this exclusion. See current release scope.
Connect Cloudflare DNS to Binadit
You can use Cloudflare nameservers and keep managing DNS records in Binadit. Connect a restricted Cloudflare API token, explicitly link the domain, then import its existing Cloudflare records before editing them in Binadit.
Nameserver delegation and record management are separate. Nameservers determine which service answers public DNS queries. The API connection lets Binadit read and update records at Cloudflare. Changing nameservers does not save a token, link domains or migrate records automatically. Saving a token alone does not link domains either.
1. Prepare the domain in Cloudflare
Add your domain to the correct Cloudflare account and choose the intended plan. Review the records Cloudflare discovers: its scan can miss records. Compare with your current DNS configuration or export before moving delegation. Include the root domain, www, other subdomains, MX, SPF, DKIM, DMARC, verification TXT records and SRV records. Check values, priorities and TTLs. Cloudflare setup instructions
Keep mail server A/AAAA/CNAME records DNS only. MX, TXT and SRV records are not proxyable. Only enable the orange cloud on eligible web records when you want Cloudflare to proxy their web traffic. Proxy limitations, email records
Use exactly the nameservers assigned to this domain by Cloudflare. In Binadit, open the domain's nameserver change, select the group containing those servers and apply the change. A batch must contain only domains assigned that same nameserver set. Review any existing DNSSEC/DS configuration using Cloudflare's migration instructions before changing delegation; stale DS records can prevent resolution. Wait for Cloudflare to confirm activation. Full setup and DNSSEC
If the group does not exist in Binadit yet, open DNS → Nameservers → Add or create a nameserver group. Give it a recognizable name such as Cloudflare-example, choose Cloudflare, and enter the two assigned hostnames. Leave IPv4 and IPv6 empty. Save the group, return to the domain, select it and click Save nameservers. The group name is only a label; Binadit handles internal naming automatically. This step does not connect an API token.
2. Create a restricted API token
Use a user API token for this walkthrough. In Cloudflare, open My Profile → API Tokens → Create Token. Start with Edit zone DNS and set these permissions and resources:
| Setting | Value |
|---|---|
| Permission | Zone → DNS → Edit |
| Permission | Zone → Zone → Read |
| Zone Resources | Include → Specific zone → your domain |
Include only the zones you intend to manage through this connection. DNS Edit covers DNS record changes; Zone Read allows Binadit to discover and identify the zone. You do not need account administration permissions for this existing-zone workflow. Review the summary, create the token and copy it into a secure password manager; Cloudflare shows the secret once. Create a token, zone discovery permission
Keep the token private. Do not send it in email, chat, screenshots or support tickets. Prefer this restricted token over a Global API Key. If you configure expiry or IP restrictions, allow the Binadit server that actually makes the requests and plan renewal before expiry. Token resources and restrictions
3. Save the token in the correct Binadit company
Select the company that owns the domain in Binadit, then open DNS → Cloudflare → API Keys at Cloudflare API keys.
- Choose New API Key.
- Enter a recognizable name and paste the restricted token into API Token / Global API Key.
- Leave Cloudflare email address empty for an API token. That field selects the legacy Global API Key authentication method.
- Optionally fill Cloudflare account ID with the exact 32-character account ID that owns the zone. This is a Cloudflare ID, not the Binadit company ID or the zone ID.
- Choose Add. Saving checks the credential; it does not connect domains or import records.
The connection belongs to the active Binadit company. Its users still need the appropriate DNS permissions. An administrator can also manage platform connections; Platform connection in Binadit describes company scope and does not mean a Cloudflare Global API Key. A connection an administrator saved stays a platform connection, even when all domains linked to it belong to one company. See Domains Binadit manages through Cloudflare.
Verify checks whether the saved connection is accepted. A successful check does not by itself prove the token can edit DNS records for a particular domain. Complete domain discovery and import as well; if either fails, check both permissions and the selected zones in the token. Cloudflare token verification
4. Link the domain, then import Cloudflare records
On the API key row, use the refresh button labelled Review and connect domains. Check the company and matching domain names, select the intended domains and choose Connect selected domains. This explicitly links the existing Cloudflare zones without changing records or nameservers.
For a registered domain, open its details under Domains and choose Cloudflare in the DNS/nameservers card. Select the saved API key and choose Pull van Cloudflare. This button currently uses its Dutch label in both portal languages. Alternatively, open the linked domain's DNS settings: when the comparison panel offers Importeer van Cloudflare, that also imports from Cloudflare. This route also works for a DNS-only domain without a registration details page.
Use Pull/import for the first synchronization. It replaces the local Binadit record copy with the current Cloudflare records. Export or back up any local records you still need first. Push naar Cloudflare sends local records to Cloudflare and can change live DNS; use it only after reviewing the intended records. Save in the configuration links the credential without synchronizing records. Leave the option to create a missing Cloudflare zone unchecked for this existing-zone setup.
5. Check the connection and manage records
Confirm the domain shows Cloudflare and Connected. Compare the imported records, proxy settings and mail configuration with Cloudflare. Check Versions for the DNS history and review any original change receipt that still needs attention. Once connected, DNS edits in Binadit use this Cloudflare connection; verify a planned change in Cloudflare and check the resulting DNS answers.
Connecting or importing does not update registrar nameservers. A successful nameserver change also does not prove the API connection is ready. Check both independently.
Domains Binadit manages through Cloudflare
Sometimes Binadit has already set up the Cloudflare connection for you. An administrator saves the token as a platform connection and links your domain to it. You do not need to create or save a token yourself. The domain then shows Managed via Cloudflare by Binadit instead of the connection settings.
For such a domain, users of the company that currently owns it work with the records as on Binadit DNS:
- With DNS read access you can view the records and the comparison with Cloudflare.
- With DNS write access you can also add, change and delete records and choose Importeer van Cloudflare. Each change uses the same review, versions, history and original change receipts as any other DNS change. Your name is recorded as the person who made it.
- Without DNS access you see nothing of the domain.
Binadit only sends requests for the Cloudflare zone of that domain. You never see the token, the other domains behind it or the connection itself. You cannot change, verify, remove or reuse the connection, link other domains to it or unlink the domain. Ask Binadit for that.
Access is checked again on every request against the current owner of the domain and the current link. If the domain moves to another company, or Binadit unlinks or disables the connection, access stops at the next request. Administrators can see under DNS → Cloudflare → API Keys which customer domains and companies use each platform connection.
If the connection does not work
| Symptom | What to check |
|---|---|
| Token rejected or inactive | Copy the complete token; check expiry, revocation, IP restrictions and token permissions. Leave the email field empty for token authentication. |
| No matching domains | Select the correct Binadit company; the domain must already exist there and in Cloudflare. Include its exact zone in the token and check the Cloudflare account ID filter. |
| Verify succeeds but discovery or edits fail | Check both Zone Read and DNS Edit on that zone. Token status alone does not establish resource permissions. |
| Domain uses a different connection | Open that domain separately and review its current connection before changing it. |
| Original change needs review | Open its saved receipt and check its result before starting another change. |
| Cloudflare still shows pending nameservers | Compare the registrar delegation with the exact assigned Cloudflare nameservers and review DNSSEC/DS settings. API verification does not activate delegation. |
| Mail or another service stops working | Compare its MX, TXT, SRV and target address records with the previous configuration; mail host addresses must remain DNS only. |
When rotating a token, update the existing saved connection with the replacement and verify it before revoking the old token. Revocation or expiry stops Binadit from making further API changes through that credential; it does not move nameservers or delete the Cloudflare zone. Never share either token. If a token leaks, revoke it promptly and replace it.
For pending DNS changes and recovery, see DNS changes and original-request recovery.