This article was co-authored with generative AI. Facts have been checked against public documentation where feasible, but errors may remain. Please verify primary sources before relying on this for important decisions.
Overview
The DNS of an organization's domain (e.g. example.or.jp) for a university, foundation, municipality, and the like is often managed by the organization's existing provider, and it's hard to ask "please move the name servers to Cloudflare" for the sake of an individual project.
Even so, if the site is hosted on Cloudflare Pages, you can assign a subdomain like xxx.example.or.jp on the free tier just by having the organization add a single CNAME record. Neither a zone migration nor a name-server change is required.
This article is a summary of the results of fact-checking whether this setup is possible against Cloudflare's official documentation (as of July 2026). Along with it, I organize the easily-confused difference in custom-domain specs between Workers and Pages (this is the trap).
Conclusion: whether each of the 3 patterns is possible
| Pattern | Possible on the free tier |
|---|---|
| ① Register only the subdomain as a Cloudflare zone (Subdomain setup) | ❌ Enterprise plan only |
| ② Migrate the entire domain (apex) to Cloudflare | ✅ Possible, but heavy — requires migrating all the org's DNS records + changing name servers |
| ③ Cloudflare Pages custom domain + one CNAME on external DNS | ✅ Possible (recommended) |
① Subdomain setup is Enterprise-only
Cloudflare has a feature, "Subdomain setup," that manages a subdomain as a separate zone independent of the apex domain, but its availability by plan is No for Free / Pro / Business and Yes only for Enterprise. "Bring in just a subdomain's zone on the free tier" is impossible.
③ Pages' external-DNS custom domain is officially supported
It's stated explicitly in the Pages official documentation.
If you do not want to point your nameservers to Cloudflare, you must create a custom CNAME record to use a subdomain with Cloudflare Pages.
However, it is subdomain-only. To assign an apex domain (example.or.jp itself) to Pages, it's stated explicitly that the domain must be a zone on your Cloudflare account.
Procedure
Premise: the site is already deployed to Cloudflare Pages (running at <project>.pages.dev).
1. Cloudflare side: register the custom domain first
Dashboard → Workers & Pages → target project → Custom domains → add xxx.example.or.jp with "Set up a custom domain." Because the zone is outside Cloudflare, you'll get an instruction to "add a CNAME record," and it enters a pending-verification state.
Note: order matters. The official documentation states explicitly that if you point the CNAME before registering in the dashboard, name resolution fails and you get a 522 error. Be sure to finish the registration on the Cloudflare side first, then ask the DNS administrator.
2. Organization side: request the addition of one CNAME record
The request to the DNS administrator is only this.
xxx.example.or.jp. CNAME <project>.pages.dev.
Once the record can be resolved, Cloudflare verifies it automatically, and the SSL certificate is also issued and renewed automatically. Propagation depends on DNS, usually a few minutes to a few hours.
3. (Advance check) Whether a CAA record exists
If the target domain has a CAA record (a record that restricts which certificate issuers are allowed), you need to have the certificate authorities Cloudflare uses permitted (the example in the Pages official docs lists letsencrypt.org, pki.goog, ssl.com; the CA composition can change, so also see the CAA docs on the SSL/TLS side). Checking in advance avoids rework.
dig CAA example.or.jp +short
If nothing is returned, there's no CAA restriction and no additional request is needed.
Supplement
- Even after adding the custom domain,
<project>.pages.devstays alive. If you want to unify the canonical URL, you can handle it with a redirect via_redirectsor with<link rel="canonical">. - You can attach up to 100 custom domains per project even on the free tier.
Trap: this setup is possible only with Pages (not Workers)
If you have the impression that "Cloudflare's custom-domain setup is hard, requires a zone," that's probably the spec of Workers. The two are clearly distinguished in the Workers vs. Pages compatibility matrix.
| Custom domains outside Cloudflare zones | Possible |
|---|---|
| Workers | ❌ |
| Pages | ✅ |
It's also stated explicitly in the note on the same page.
Unlike Pages, Workers does not support any domain whose nameservers are not managed by Cloudflare.
In other words, only Pages can attach a custom domain via CNAME from external DNS.
Where this comes into play is the interplay with the recent trend that "new projects should use Workers." Since Cloudflare added the Static Assets feature to Workers, it has been putting new features only on the Workers side, and even a migration guide from Pages to Workers is provided. But if you have the requirement of external DNS + a subdomain, migrating to Workers makes this setup no longer viable. This is a case where you should not swallow the general "Workers recommended" whole, and staying on Pages is the right answer.
SSR also works on Pages (but watch the framework adapters' trajectory)
"Pages is only for static sites" is also an outdated understanding; SSR works via Pages Functions (whose substance is the same runtime as Workers).
Billing caveats (from the official Functions pricing):
- Requests to static files are free and unlimited ("Requests to static assets are free and unlimited")
- Requests that go through SSR (Functions) consume the same free tier as Workers (100,000 requests/day)
For a site that's mostly static serving, there's plenty of room, but for all-page SSR you need to be conscious of this tier.
However, framework-side adapters are shifting to Workers, and the SSR options are narrowing (as of July 2026):
| Framework | SSR on Pages |
|---|---|
| Next.js | ❌ next-on-pages is deprecated and its repo is archived (September 2025). Its successor, OpenNext, is Workers-only (a static export can be done on Pages) |
| Astro | ❌ @astrojs/cloudflare v13 (Astro 6) dropped Pages support, going Workers-only |
| Nuxt | 🟡 the cloudflare_pages preset remains but is treated as legacy (the recommendation is the Workers module) |
| SvelteKit | ✅ adapter-cloudflare continues to support both Workers and Pages |
In other words, if you want to have both "an external-DNS subdomain + SSR," the options you can choose with confidence at this point are SvelteKit, or a setup where you write Pages Functions directly. If you design it so that most of the site is statically generated and SSR is kept to a minimum, you can make this problem itself small.
Summary
- Even if you can't move the org domain's DNS, with Pages you can assign a subdomain for free (one CNAME on external DNS)
- Bringing in a subdomain-only zone (Subdomain setup) is Enterprise-only
- Always register the custom domain on the Cloudflare side first (the reverse order gives a 522 error)
- Check for CAA records in advance with
dig CAA <domain> +short - External-DNS custom domains are Pages-only, not available for Workers. Even with the "new projects should use Workers" trend, if you have this requirement, stay on Pages
- SSR also works with Pages Functions, but framework adapters are migrating to Workers (Next.js and Astro are going Workers-only; the one maintaining dual Pages support is SvelteKit)
Comments
…