Nick Little wrote the move on 2 November 2022. Cloudflare had been DNS, CDN, DDoS, cache, and the registrar. GitHub Pages had been the free origin. He is an AWS Solutions Architect and wanted the site on S3 and CloudFront.
The hosting half is Hugo, an ACM cert, Origin Access Control, and a Lambda@Edge rewrite for directory URLs. This post stays on the DNS cut. That is the part that bit him on the zone import.
If you are looking at the same route, start with the Cloudflare DNS → Amazon Route 53 playbook. Cloudflare will export BIND. Route 53 will import a zone. The apex record is where those two formats disagree.
Export, then strip records Route 53 already owns
He used the Export button on the Cloudflare DNS page. New AWS account under Control Tower, IAM Identity Center via Google Workspace, public hosted zone for nlittle.com.
Paste the BIND file. Remove or comment the SOA. Remove NS records unless you added custom ones. Cloudflare owns those for the TLD.
The import still failed. Route 53 rejected CNAME nlittle.com. at the apex. RFC 1912 does not let a CNAME sit next to other data. Cloudflare had been flattening that CNAME to an A on each lookup. Route 53 wants an alias instead, and only to AWS targets.
He deleted the apex CNAME and imported again. Then he dropped the Route 53 NS TTL to 60 so the later nameserver change would expire faster.
The registrar cannot stay on Cloudflare
Cloudflare as registrar does not let you point the domain at third-party DNS. He had to transfer the TLD.
Remove DNSSEC. Remove locks. Fix the ICANN contacts. Copy the EPP code. Request the transfer in Route 53, tell it to keep the existing hosted zone, accept the AWS email. The documented wait is five days. He found a Cloudflare console action that accepted the transfer sooner.
After the move, Route 53 had created a DNSSEC key that was not in use and had no DS records in the public zone. Deleting that key fixed resolution. He had changed a dozen things at once and could not name the single fix with certainty.
Then he raised the NS TTL again and closed the Cloudflare account.
What I would copy
Turn the apex CNAME into an alias before you import, not after the error. Cloudflare flattening is a product feature. It is not a record you can paste.
Do the DNSSEC teardown on the old registrar before you start the transfer. Then inspect the new zone for a key you did not ask for.
Lower NS TTLs before you touch nameservers. Keep dig open while the transfer completes.
The rest of Nick’s post is the S3 and CloudFront origin. Useful if you are leaving GitHub Pages in the same weekend. Not required for a DNS-only cut.
The Cloudflare DNS → Amazon Route 53 playbook is the checklist. Use his write-up for the flattening error and the unused DNSSEC key.