A runbook for pointing 200 parked domains at one site

Search for how to redirect several domains to one site on Cloudflare and every result answers for one domain. The tutorials are correct and they do not scale, because the part that costs you at two hundred domains is not the redirect. It is everything around it.

The redirect itself is one list. Here is the rest.

What you are actually signing up for

A redirect on Cloudflare needs the hostname proxied through Cloudflare, which means every domain has to exist in your account as its own zone. Two hundred domains is two hundred zones, each with its own nameserver change at the registrar and its own activation to wait for.

That is the real work. Budget for it before you start rather than discovering it at domain forty.

Only the last box is shared. The first four happen two hundred times.

Do not preset the nameservers

The instinct at scale is to set Cloudflare’s nameservers at the registrar first, in bulk, then add the domains. That instinct is now wrong, and the failure is quiet.

Cloudflare’s wording:

To prevent domain hijacking, you can no longer preset Cloudflare nameservers at your registrar before creating the respective zone in Cloudflare.

Preset them anyway and the zone you create afterwards is assigned a different pair. The registrar is then pointing at nameservers that are not the ones serving your zone, the domain never activates, and nothing in either interface says why. At two hundred domains this is the mistake that produces a long tail of half configured names nobody can account for.

The order that works is: create the zone, read the pair Cloudflare gives you for that zone, then set exactly that pair at the registrar.

Onboarding, and the two numbers that govern it

Cloudflare throttles zone creation. Both numbers are documented:

you can only sign up a maximum of 25 domains every 10 minutes

if you have over 50 domains and, of those domains, more are pending than active, you will be blocked from adding more

The second one is widely misquoted as “fifty pending domains blocks you”. Read it again: the condition is more than fifty domains and more pending than active. It is a ratio, not a ceiling. Which means the pattern that works is not one big batch. It is add a batch, activate it, then add the next, so the pending side never outweighs the active side.

At twenty five per ten minutes, two hundred domains is a minimum of eighty minutes of adding even if activation were instant, which it is not. Plan it as a job that runs for an afternoon with pauses, not as a script you launch and watch.

The DNS record for a domain that only redirects

A parked domain has no origin, and a redirect never reaches one, but Cloudflare still needs something proxied to attach rules to. The documented answer is an address that goes nowhere on purpose:

Use the IP address 192.0.2.1 for the A record. This address does not route traffic to an origin server but allows Cloudflare to apply rules, redirects, and Workers to incoming traffic.

So each zone gets an A record on the apex pointing at 192.0.2.1, proxy status Proxied, and the same for www if you want the www form to answer too. The address is from a range reserved for documentation, which is exactly why it is safe: nothing is ever going to be there.

If the record is left unproxied, the redirect does not happen and the visitor gets an error from an address that does not exist. That single toggle is worth checking twice.

The redirect: one list, not two hundred rules

This is where the account level nature of Bulk Redirects pays for the whole exercise. Cloudflare’s description: they “allow you to define a large number of URL redirects at the account level, which can apply across domains in your account”.

One list, uploaded once, covering every zone. The free plan holds 10,000 URL redirects across 5 lists and 15 rules, which is not the constraint at two hundred domains.

Two things to get right in the list itself:

Include subdomains and subpath matching decide whether old.example.com/anything is covered by an entry for example.com, or whether you need a row per path. For parked domains you almost always want the whole domain caught by one entry.

Preserve query string is off by default, and turning it on discards whatever the target URL carried. If these domains appear in advertising, that matters more than it sounds: a redirect that drops the click ID looks perfectly healthy.

And before you size the job around ten thousand, check what your account was actually given. The documented allowance and the provisioned one still disagree on some accounts.

Checking that it worked, which is the step people skip

Two hundred redirects configured is not two hundred redirects working. The realistic outcome of a first pass is that most of them work and a minority fail in ways that look identical from the dashboard: a zone that never activated, a record left unproxied, a nameserver pair that does not match what the registrar has.

You cannot see this by looking. You have to ask each hostname:

while read -r domain; do
  code=$(curl -s -o /dev/null -w '%{http_code}' --max-time 10 "https://$domain/")
  dest=$(curl -s -o /dev/null -w '%{redirect_url}' --max-time 10 "https://$domain/")
  printf '%-30s %s %s\n' "$domain" "$code" "$dest"
done < domains.txt

Anything that is not a redirect status pointing at the destination you expect is a domain to go back to. Run it after the first pass, and again a day later, because activation is not instant and a name that failed at noon may pass by evening.

When the shape of the problem is different

Everything above assumes the domains are yours to move onto Cloudflare’s nameservers. When they are not, or when you need hundreds of hostnames answering with certificates without taking over their DNS, the mechanism is Cloudflare for SaaS: 100 custom hostnames are included on Free, Pro and Business, then $0.10 per month for each additional one, up to 50,000.

That is a different tool for a different constraint, and it does not replace the list. It replaces the two hundred zones.

The part a tool actually removes

None of this is difficult. Every step is documented and each one takes a minute.

It is the multiplication that hurts, and then the not knowing: which of the two hundred activated, which record is still grey, which domain was supposed to point where, and whether anyone has checked since the last time somebody edited the list. Doing it once is an afternoon. Keeping it true is the job that 301.st exists for. For five domains, the dashboard and the loop above are the whole answer.