Connect Cloudflare to bernard without giving it control of my DNS

Cloudflare can be connected to bernard read-only. The normal connection asks for Zone Read, which lets bernard check whether the exact domain for the site is visible in a Cloudflare account you choose.

It does not hand over control of your domain. It cannot create, edit or delete DNS records, change nameservers, affect email, move the website, transfer registration or start a charge.

What you approve

Ask bernard for the secure connection link from Manage my domain. The link opens on bernard first, checks that you are an account owner, then takes you to Cloudflare. Sign in there yourself and choose the Cloudflare account you want to connect.

The normal permission is Zone Read. Cloudflare asks you to choose an account, not one domain. Bernard applies its own tighter rule after consent: for each site, it checks only that site's exact domain.

If you later choose the managed inventory step of a DNS move, bernard asks the account owner again for DNS Read. That second read-only permission lets it compare the records already inside the exact target zone. It is not requested for an ordinary status check, and there is no write permission in either flow.

Do not paste your Cloudflare password, a token or any other secret into chat. They are not needed.

What you see afterwards

The connection appears under Account settings because one authorization can serve several bernard sites. Each site's Manage my domain page shows its own result separately:

• the exact domain was found;
• the exact domain was not visible in the account you chose;
• the connection needs renewing; or
• the check could not be refreshed just now.

A temporary problem does not turn an earlier result into a false "not found". Bernard shows when the last successful check was made.

Nothing has been changed. Finding the domain means only that Zone Read can see that exact zone. If you later approve DNS Read, reading its record list creates evidence for comparison, not permission to change DNS and not approval to move nameservers.

If you have several domains

Yes, it usually makes sense to keep the domains you intend to retain in one customer-owned Cloudflare account. It can reduce the number of accounts and renewal arrangements you have to manage, and eligible registration transfers may save money after you compare the real renewal costs and attached services.

One read-only connection can check every bernard site whose exact domain is in the Cloudflare account you approved. Bernard is designed to manage them all as the later migration capability is added. Any DNS move still happens one domain at a time, with its own record check and approval.

Reconnect or disconnect

If Cloudflare's permission expires or can no longer be refreshed, an account owner can choose Reconnect in Account settings. The new consent replaces the old one for the account.

An account owner can also choose Disconnect. This affects every bernard site using that account connection. Disconnecting does not remove DNS records, change nameservers, stop email, move registration or take a site offline. It only stops bernard from checking Cloudflare with the saved permission.

Three different journeys

Keep these jobs separate:

• To point a Cloudflare-managed domain at your site, follow Connect my domain when I manage it at Cloudflare.
• To move the whole DNS address book from another provider into Cloudflare, follow Move my domain's DNS to Cloudflare without breaking anything.
• To change which company renews the domain after DNS is settled, follow Move my domain registration to Cloudflare.

Connecting Cloudflare read-only completes none of those changes. It simply lets bernard check the exact-domain prerequisite more clearly.