Fix the Cloudflare "zone is subject to a hold" error
Trying to add your domain to Cloudflare and getting told the zone is subject to a hold? A zone hold is a Cloudflare security lock that stops the same domain being activated in two accounts at once. It's a normal, deliberate feature — but it can strand a domain when the account that first added it doesn't release the hold before removing the zone. Here's how to tell what's happening and clear it.
Before you start
You'll need access to the Cloudflare account that first added the domain — that's where the hold lives. If that was a consultant, agency, or IT team running a demo or test, loop them in; only that account (or Cloudflare Support) can release it. This is unrelated to DNSSEC, so leave that setting however you prefer.
-
1
Confirm it's a zone hold (not DNSSEC or DNS)
If adding your domain fails with "The zone name provided is subject to a hold which disallows the creation of this zone. Please contact the owner of the Cloudflare account that manages this domain to have the hold removed," you're looking at a zone hold. It's a security lock tied to the domain name, not a DNS or DNSSEC problem — toggling DNSSEC won't clear it, so don't chase that. -
2
Find the account that added the domain first
A hold is created when a domain is added to a Cloudflare account — often during a demo, a migration, or a test in an agency or IT account. The hold lives on that account, so start by identifying who added the domain to Cloudflare before you. Only that account (or Cloudflare Support) can release it. -
3
If the zone still exists there, release the hold in the dashboard
Log in to the account that holds it, open the zone, and go to the zone's Overview → Quick Actions. Switch Zone Hold to Off, choose the release option, and confirm. The domain can then be added to your account normally. -
4
If the zone was already deleted, email Cloudflare Support
A hold is not removed automatically when a zone is deleted — and once the zone is gone there's no dashboard toggle left to switch off. The hold is now orphaned and blocks the domain everywhere. From the account that originally added the domain, open a Cloudflare Support ticket. Keep it short and specific — you can adapt this:Subject: Release a zone hold on your-domain.com
Hi Cloudflare Support,
I'd like to release a zone hold on your-domain.com. The domain was added to this account previously and the zone was later deleted without releasing the hold first, so it's now orphaned — there's no zone left in the dashboard to toggle it off.
Adding the domain now returns: "The zone name provided is subject to a hold which disallows the creation of this zone."
Could you please release the hold so the domain can be added again? Since the zone was deleted there is no Zone ID. Happy to complete any ownership verification you need.
Thanks,
[your name] -
5
Expect a domain-ownership check (a TXT record)
Cloudflare usually verifies that you own the domain before releasing the hold. They'll reply asking you to add a TXT record at your authoritative DNS — something likecf-dns-verify.your-domain.comwith a random value. "Authoritative DNS" means wherever your DNS actually lives — your registrar, or a managed host like WP Engine — not necessarily a Cloudflare account. Add the record, reply to confirm it's live, and Cloudflare releases the hold. Whoever controls the domain's DNS has to add this, so if that's a different team — IT, an agency, or your host — loop them in early to avoid a slow back-and-forth. -
6
Add the domain and continue your MetaPilot setup
Once the hold is released, add the domain to your Cloudflare account and follow the normal path — review DNS, update nameservers, wait for Active, then connect it in MetaPilot under Settings → Cloudflare. See the Connect Cloudflare guide for the full walkthrough.
Already hosted behind Cloudflare? (WP Engine, Shopify, and similar.) If a curl -I on your domain shows server: cloudflare but the domain isn't in your own Cloudflare dashboard, your host is probably fronting your site with their Cloudflare. Managed platforms like WP Engine and Shopify do this through Cloudflare for SaaS, where your domain is a custom hostname under the host's Cloudflare account — not a full zone you control. Two things follow from that. First, a zone hold can still block you from adding the domain as a full zone even though it already resolves through Cloudflare (the two live at different layers). Second, MetaPilot's Worker needs a full zone in your own Cloudflare account, so connecting MetaPilot means moving the domain's nameservers to your account — which shifts the edge layer off your host. Check with whoever manages your hosting before repointing nameservers.
Preventing a stranded hold next time. If you add a domain to Cloudflare for a demo or test and plan to remove it, release the zone hold before you delete the zone (Overview → Quick Actions → Zone Hold → Off). Deleting the zone first strands the hold and forces a support ticket. Better still, don't add a domain you don't control to your own account just to demo the flow — use a domain you own.
Hold cleared? Finish connecting Cloudflare
Pick up the full setup from adding your site to going live in MetaPilot.
Stuck? Ask an AI to walk you through it