Really complicated dns Problem

[u/Competitive-Army6187]

For the last couple of days I've been trying to figure this out on my own, but it's time to post here. I have a client who isn't tech-savvy at all. A company set up his .com.sa domain through a Saudi-based provider named Sahabah, and for some reason they transferred the DNS management of the domain to Cloudflare — I'm guessing it was for added security. They then configured his entire Outlook email setup on Cloudflare.

I'm delivering them a website, and ideally it would be a straightforward setup: just log into the Cloudflare account and add the Hostinger (the web hosting I set up for them) records. But the problem is they lost the login info for the Cloudflare account, and I tried contacting the company that set it up — they said since they did the domain setup so long ago, they don't have it either.

So my only option would be to log into the domain provider (Sahabah) where they purchased the domain and reset the nameservers to default, so I can add my website records there. My concern now is the email setup — what's the best way to make sure I add all the needed records so their email keeps working after the switch? I managed to get into the Outlook admin and added all the records that were provided — would that be enough, or am I forgetting something?

[u/hemohes222]

As long ad there is a mx record that points to yourdomain-com.mail.protection.outlook.com. email delivery should work was as expected.

[u/ginjaninja_10 → u/hemohes222]

They should also double check if there are any SPF or DKIM TXT records that could alter any email behaviors along with it, too.

[u/hemohes222 → u/ginjaninja_10]

Yes. OP should be able to get most of the resource records and apply them to the dns zone

[u/Competitive-Army6187 → u/hemohes222]

Yes I added all the records that outlook had listed in order to add the domain so hopefully it works, ill do the swap and hope for the best.

[u/Competitive-Army6187 → u/ginjaninja_10]

I believe I added DKIM TXT Records as well since outlook had that listed as a option

[u/Sufficient_Art_4607]

Before changing the nameservers, I’d make a full copy of the existing Cloudflare DNS records if you can get access to them, especially the MX, TXT, CNAME, SPF, DKIM, and any Microsoft 365 verification records. I'm curious how one.com manages cases like this.

[u/SecLens_ONE]

Before you touch Sahabah NS, dump every record still live on Cloudflare. MX, SPF, DKIM selectors, DMARC, Autodiscover, the Outlook CNAMEs. The Outlook admin list is a start. It is not the zone.

Once NS moves, those Cloudflare records vanish for anyone who follows the new delegation. If you only paste what Microsoft shows, you usually miss a selector or an include and mail starts failing about a TTL later.

If you can still open the Cloudflare zone via the domain pin or a support reset, do that first. Changing NS is the nuclear option.

[u/Competitive-Army6187 → u/SecLens_ONE]

I dont have access to the cloudfare account nor can I see the records live on Cloudfare. I had claude search and somehow it gave me back a list of records that are live on the domain and i added them as well.

[u/SecLens_ONE → u/Competitive-Army6187]

A list from a model is a guess, not the zone. Only the servers that are authoritative right now know what is actually published.

You can still read most of it without the account. Query the current nameservers directly for MX, the TXT at the apex, _dmarc, autodiscover, and the Microsoft CNAMEs like enterpriseregistration and enterpriseenrollment. Selectors are the annoying bit, 365 usually puts them at selector1._domainkey and selector2._domainkey, check both. Grab apex and www too so the site does not go dark with the mail.

Do it while Cloudflare is still answering. Once the delegation moves you cannot look anymore.

[u/Rhopegorn → u/SecLens_ONE]

Try dig txt _domainkey.<domain> for the dkim selectors.

Or use a tool like https://easydmarc.com/tools/domain-scanner to view most outgoing email related entries.

Edit: thank you u/SecLens_ONE, you are of course right.

[u/SecLens_ONE → u/Rhopegorn]

Small correction, the label is _domainkey, not _dkim. And you cannot enumerate selectors from DNS at all, there is no listing record, so you have to know or guess the name.

For 365 that is easy enough, it is always selector1._domainkey and selector2._domainkey, and on a real tenant those are CNAMEs into onmicrosoft.com rather than TXT. So query for CNAME too or you will think nothing is there.

Best source of the actual selector is a header from mail the domain already sent. The s= tag in DKIM-Signature tells you exactly what to copy.

[u/noirrespect]

Have you tried contacting cloudflare about resetting the password?

[u/Competitive-Army6187 → u/noirrespect]

They dont know the email that was used, I tried resetting it but none of the email accounts that they have access to received the resetting email from Cloudfare

[u/downundarob]

Is there something broken about cloudflare password recovery? Will they not reach out to the listed in whois technical or admin contact? perhaps ths page... https://dash.cloudflare.com/forgot-email