Run Rookery in a new Cloudflare account

Rookery can run in a Cloudflare account that you own. Your mail and your team's work stay there, and you pay Cloudflare directly for what it runs. This guide takes you from no account to a working Rookery with your own domain. It takes about 20 minutes, and most of it is waiting for Cloudflare.

Rookery Deploy, the page that sets Rookery up (steps 5 to 9), and Rook's help with moving a domain are still being built. Steps 1 to 4 work today. The rest describe what you'll see once they open, and this note goes when they do.

1. Create the account

1. Go to dash.cloudflare.com/sign-up.
2. Type your Email and a Password, then click Create Account.
3. Open the email Cloudflare sends you and click the link, then sign in to confirm the address. Look in your spam folder if it doesn't come. If it expired, sign in, go to My Profile and click Send verification email under Email Address.

Until the address is verified, Cloudflare won't let you add other members or register a domain.

If this account is for a team or a business, use a shared address like cloudflare@yourcompany.example rather than one person's inbox. Cloudflare sends your bills, usage notices and account recovery there. You can also rename the account to something like "Aisha Books Rookery": go to Configurations and click Change Name next to Account Name.

2. Turn on two-factor sign-in

Two-factor means a second proof when you sign in, like a code from an app on your phone. It matters here because this account holds your mail.

1. Open the My Profile dropdown and click My Profile, then Authentication.
2. Next to Mobile App Authentication, click Add.
3. Scan the QR code with an authenticator app on your phone and type the code it shows. Cloudflare asks for your password too.
4. Cloudflare shows your backup codes. Click Download, Print or Copy, keep them somewhere safe, then click Next.

Prefer a security key? Under Two-Factor Authentication click Set up, then Add under Security Key Authentication. Cloudflare suggests turning on two methods and saving the backup codes, so you can't lock yourself out.

3. Turn on Workers Paid

Rookery needs Cloudflare's Workers Paid plan. It costs a minimum of $5 a month for the account, and it's also what lets your Rookery send mail to anyone.

1. Open the Workers plans page in the dashboard (dash.cloudflare.com/?to=/:account/workers/plans).
2. Choose the Workers Paid plan and add your card when Cloudflare asks.

If you skip this, Rookery Deploy stops at its first step and says so, before it makes anything. You can come back and try again.

4. Add or move your domain

Rookery needs your domain in the same Cloudflare account as Rookery, because that's how your mail gets to it. Pick the one that fits you.

A. You don't have a domain yet

1. In the dashboard, open the Register domains page.
2. Type a name in the search box and click Search.
3. Click Purchase on the one you want. Cloudflare checks it's still free.
4. Choose how long to register it from the Payment option list, then fill in the contact details.
5. Choose how to pay, read the agreements, and click Complete purchase.

You need a verified email and a card on the account. A domain bought here must keep using Cloudflare's nameservers (the servers that say where the domain's records live), which is what Rookery wants anyway.

B. Your domain is at another registrar or DNS host

A registrar is the company you bought the domain from. A DNS host is where its records live (often the same company). Moving to Cloudflare means Cloudflare becomes the place the domain's records live. You can also keep your registrar, and your email can stay where it is.

Before you change anything, write down where your mail goes today. Your domain's MX records say that. Your website is usually an A or CNAME record. Mail signing and anti-spam records are TXT records, named like SPF, DKIM and DMARC. If your mail is at a big provider such as Google or Microsoft, these are the records that keep it working.

1. If DNSSEC is on for the domain (a security lock on its records), turn it off at your registrar first. Cloudflare warns the domain can stop working if you change nameservers with it on. Cloudflare says to remove the DS record at your registrar and wait for it to expire, which often takes 24 to 48 hours. You can check with dig DS yourcompany.example. You turn DNSSEC back on afterwards, in Cloudflare, under DNS Settings.
2. In the dashboard, open Domains and click Onboard a domain.
3. Type your domain without www, like yourcompany.example. Choose how to add its DNS records, then click Continue. Cloudflare can scan for your existing records and add them.
4. Choose a plan.
5. Look at the records Cloudflare found. Cloudflare says its scan might miss some, so compare them with what you wrote down: the ones for the domain itself, www and email. Add anything missing, especially the MX, SPF, DKIM and DMARC records. Click Continue.
6. Cloudflare gives you two nameservers. At your registrar, replace the old ones with these two, copied exactly.
7. Wait. Cloudflare says to allow up to 24 hours. The domain shows Pending Nameserver Update, and when it turns Active Cloudflare sends you an email.

Until you change the nameservers at your registrar, nothing changes: your website and email keep working where they are. Your mail keeps going to your old provider even after the move, because you copied its MX records. It only comes to Rookery when you choose that, as a separate step later.

Want Rook beside you for this? Skip this step for now and go on to steps 5 to 9. Then, on Today, click Add your domain. When the domain isn't on Cloudflare yet, Rook offers to help you move it. It looks the domain up in public DNS and tells you who your registrar and DNS host seem to be, and which records matter, including whether DNSSEC is on. You click through to Cloudflare's Onboard a domain yourself. Then Rook compares what Cloudflare imported with what's in public DNS today, for example "14 records match; 2 are missing", and offers to add the missing ones. It shows the two nameservers and, when it knows your registrar, the steps for it. It watches for the switch and puts a line on Today when the domain is active on Cloudflare. Then it goes on with your mail setup.

C. Your domain is already in another Cloudflare account

Your mail only reaches Rookery when the domain is in the same Cloudflare account as Rookery. So you move the domain into the new account. How depends on where it's registered. Read what happens first, so there are no surprises.

What happens to your website and email. Cloudflare's page on this says:

• The domain is added to the new account as if for the first time, and you change the nameservers at your registrar to the ones the new account shows. The new account's domain becomes Active once Cloudflare sees the change.
• Your DNS records don't come along. You recreate them in the new account and check them. Cloudflare recommends exporting them from the old account first, and importing only the right ones. Importing records that were set to go through Cloudflare's proxy can cause a "1000" error.
• Your settings and certificates don't come along either. Copy settings by hand, and have new certificates issued.
• While the new domain is Pending, it can't pass your website's traffic through Cloudflare, so visitors reach your server's own address until it's Active.
• In the old account the domain is marked Moved Away. After 7 days it becomes Deleted, and after 7 more it's removed for good.
• Cloudflare gives no time for the changeover beyond the pending wait. Nameserver changes can take up to 24 hours.
• Cloudflare's page doesn't mention email, Email Routing or Workers. So don't assume your mail moves: copy the MX and other email records exactly, check them before you change the nameservers, and send yourself a test email afterwards. If the old account used Email Routing for this domain, its rules don't come with it.

If the domain is registered somewhere else (Cloudflare only hosts its DNS):

1. In the old account, export the domain's DNS records. Turn off DNSSEC, and remove any add-ons or subscriptions on the domain.
2. In the new account, do the Onboard a domain steps of branch B above (its steps 2 to 7), import or add the records you exported, and update the nameservers at your registrar. Copy the new account's nameservers exactly, because they may not be the same two as before.
3. In the new account's Overview for the domain, click Re-check now.

If the domain is registered with Cloudflare Registrar, moving it is a separate request, and both accounts must agree:

1. In the new account, add the domain as a website and choose a plan. Note the new account's ID. Turn DNSSEC off.
2. Check the domain can move. It must have been registered for more than 10 days, with a verified registrant email, no pending change of registrant, and no lock.
3. In the old account, open Manage Domain, go to the Configuration tab and click Start.
4. In the new account, go to Manage Domains under Domain Registration, open View Actions and accept. You have 5 days, or the request cancels.

Cloudflare says all the domain's settings in the old account are lost, the contact details move unchanged, the new account pays the renewals, and the domain can't be moved again for 30 days. It doesn't say what happens to your DNS records, so export them first and add them to the new account.

If that sounds like more than you want to take on, you have two other choices: use a different domain for Rookery's mail, or use the account the domain is already in, if you're the only member of it.

5. Press Deploy

1. Go to userookery.com/deploy (or press Deploy to Cloudflare in the Rookery README). Read what it costs and what's kept, then click Start.
2. Name your Rookery, add your name and your email. The email is only for signing in to your own Rookery.
3. Click Continue to Cloudflare. Cloudflare asks you to let Rookery Deploy set up Rookery in one of your accounts. Pick the new account and click Allow.
4. Rookery Deploy shows "Installing into" and the account's name. If it's the wrong account, click Use another account. If it's right, click Set up Rookery.
5. Setup takes about 2 minutes. Each step is a row with its time. You can close the tab: setup keeps going, and you can come back to the same page and sign in to see it.
6. When it's ready, click Open your Rookery.

Rookery Deploy signs in once, sets things up, and lets go. It keeps nothing about you or your Rookery, and it keeps no key to your account. Your Rookery starts at a free Cloudflare address, ending in workers.dev. You can move it to one on your own domain later.

6. Claim it with a passkey

Your Rookery opens on a setup page. Type your name and click Make a passkey. A passkey is your fingerprint, face or device PIN, and there's no password to remember. You're now the owner. The link works once: nobody else can use it after you have.

7. Add your domain

Today has a checklist, Finish setting up. Click Add your domain.

1. Rook checks what your domain needs and shows each change with the reason for it: Email Routing, the routes to your Rookery, sending, and your SPF and DMARC records.
2. Click Approve in Cloudflare. A page on userookery.com lists the same changes and what Cloudflare will be asked to allow. Click Continue to Cloudflare, then Allow.
3. The changes are made, and you click Back to your Rookery. Rook checks them in public DNS and tells you what it found.

That's one approval. Each change has an Undo (and there's an Undo all), which asks you to approve once more.

8. Send a test email

The next row is Send yourself a test email. From your phone or another account, write to hello@yourcompany.example. Rook watches for it and tells you when it lands. If nothing comes in 10 minutes, Rook checks the records again and says what it found. Mail can take a few more minutes, and Check again tries once more.

9. Invite your team

Click Invite on the checklist, or go to Settings → Members.

1. Add each person's name and a role, like Member or Admin. Each one gets an address and inbox of their own at your domain when they join.
2. Choose how they get in: Copy invite link, Show QR code, or Email it to an address they already use.
3. Click Add 2 people (or however many).

Their new addresses can't receive anything they can open until they've joined, so the invite is never sent to the new address. The links work for 7 days, and Withdraw stops one.

There's also Meet Rook, a one-minute hello, on the checklist.

Keep the Cloudflare account to a few people

The Cloudflare account holds your mail's database and files. Rookery's own permissions decide who sees what inside Rookery, but they don't hold back someone who can manage the Cloudflare account itself. Cloudflare's roles go from Super Administrator, who can do everything including billing and members, and Administrator, with full access except members and billing, to read-only roles that can still read what's there. The Workers Platform roles read and manage Workers, R2 file storage and more, so assume they can reach your mail too. Cloudflare's page doesn't say which role covers the database.

So the fewer members, the fewer people who could read Rookery's mail. To add someone, a Super Administrator with a verified email goes to Members, clicks Invite members, adds the address under Add email addresses, chooses a role under Add permission policies and clicks Create policy, then Invite members. To remove someone, click ... on their row, then Remove member. Most teams can use Rookery's own members and leave the Cloudflare account to one or two people.

If something goes wrong

Nothing here costs you anything to try again. Every setup step checks what's already there before it makes anything.

• You cancelled on Cloudflare's screen. Nothing was made in your Cloudflare, because Cloudflare didn't give permission. Click Sign in again. Your name and email are still filled in.
• It's the wrong account. Before anything is made, click Use another account. If setup already finished in the wrong account, nothing is undone for you, because Rookery Deploy never deletes anything. Remove it in Cloudflare yourself, then set up again in the right account.
• Workers Paid is missing. Setup stops with "This account needs Cloudflare's Workers Paid plan ($5 a month). Nothing was created." Upgrade in Cloudflare (step 3), then click Try again.
• The name is taken. Either "This account already runs Rookery" (click Open it or Update it), or another app in the account is already called rookery. Rename that app in Cloudflare, or use another account.
• You closed the tab. Setup carries on without it. Go to userookery.com/deploy, click Start and sign in. The page reads your account and shows "Still setting up" or "Setup finished while you were away", with Open your Rookery.
• The claim link was used or is too old. If you used it, sign in. If not, open userookery.com/deploy and sign in with Cloudflare to get a new one. A new link works only until someone owns the Rookery.
• A setup step failed. That row says what happened. Click Try again: steps already done are checked, not repeated.

Updating later

Go to the same page, userookery.com/deploy, click Update it and sign in once. Updates never install themselves: you press Update. If one fails its check, the last version is put back and you're told.

To see whether a new version is out, owners and admins go to Settings → About and click Check now. Checking by itself is off until you turn it on. A tab you have open keeps its place when Rookery updates.

What your Cloudflare account can send, hold and cost is in What your Rookery can send, store and cost. To bring all of your domain's mail to Rookery, see Move your domain's mail to Rookery. To send as a second domain, see Send as your own domain.

Where this comes from

The Cloudflare steps are from Cloudflare's documentation, read on 20 October 2026:

• Create an account: developers.cloudflare.com/fundamentals/account/create-account/ (updated 17 Sep 2026) and /fundamentals/user-profiles/verify-email-address/ (20 Apr 2026).
• Two-factor: /fundamentals/user-profiles/2fa/ (20 Apr 2026).
• Workers Paid: /workers/platform/pricing/ (2 Oct 2026) and /browser-run/limits/ (14 Oct 2026), which gives the Workers plans page.
• Add a domain: /fundamentals/manage-domains/add-site/ (5 May 2026), /dns/zone-setups/full-setup/setup/ (29 Jul 2026) and, for DNSSEC, /dns/dnssec/ (24 Jun 2026).
• Move a domain between accounts: /fundamentals/manage-domains/move-domain/ (20 Apr 2026), /registrar/account-options/inter-account-transfer/ (24 Apr 2026) and /dns/zone-setups/reference/domain-status/ (21 Apr 2026).
• Register a domain: /registrar/get-started/register-domain/ (24 Apr 2026).
• Members and roles: /fundamentals/manage-members/manage/ (15 Oct 2026) and /fundamentals/manage-members/roles/ (12 Oct 2026).

Cloudflare changes its dashboard now and then. If a button has a different name when you get there, Cloudflare's own page for that step is the one to follow.