DNS Migration Checklist
A DNS migration checklist for moving DNS providers: export every record, rebuild the zone, compare answers, lower TTLs, switch nameservers and handle DNSSEC.
- Typical schedule per migration
- The checklist 5 sections, 20 items
- Variables
{{domain}}{{new_provider}}
Use this checklist when you move a domain's DNS hosting to a new provider, for example from your registrar's DNS to a dedicated provider, or between cloud DNS services. Done carefully, it causes no downtime at all. Done carelessly, it breaks email for days, and nobody notices until customers complain about missing invoices. Run it once per domain.
Who owns it
One engineer owns the run, with access to the registrar, the old DNS provider and the new one. Whoever runs email or other services on the domain should review the new zone before the switch, because they know which records matter.
Common pitfalls
- Incomplete zone export. Some providers do not show every record in the UI or do not support zone transfers. Compare answers for real record names, including TXT, MX, CAA, SRV and subdomains used by third-party services.
- Provider-specific records. ALIAS, ANAME or "flattened" CNAME records at the apex and proxied records do not always exist at the new provider. Plan the replacement.
- DNSSEC left enabled at the registrar. If the DS record at the registrar does not match the new provider's keys, validating resolvers fail the whole domain. Handle DNSSEC before and after the switch.
- Cancelling the old provider too early. Resolvers may keep the old nameservers cached for up to the NS TTL. Keep the old zone running for a while.
The checklist: Move DNS for {{domain}} to {{new_provider}}
Inventory
-
Full zone for
{{domain}}exported from the current provider -
Records cross-checked against real use: web, email (MX, SPF, DKIM, DMARC), verification TXT, CAA, SRV
Check mail and SaaS settings for DKIM selectors and verification records that are easy to miss.
-
Provider-specific records identified: apex ALIAS or ANAME, proxied records, redirects
-
DNSSEC status checked at the registrar and the current provider
-
Current TTLs on records and on the NS records noted
Build the new zone
-
Zone created at
{{new_provider}}with every record recreated -
Provider-specific records replaced with equivalents that work at
{{new_provider}} -
Answers compared record by record by querying the new nameservers directly
e.g. dig @new-nameserver
{{domain}}MX. Compare with the same query against the old nameservers. -
TTLs on important records lowered at the old provider ahead of the switch optional
Switch nameservers
-
DNSSEC disabled by removing the DS record at the registrar, then waiting for its TTL to expire optional
Only if DNSSEC is enabled and you are not doing a coordinated key migration between providers.
-
Nameservers changed at the registrar to those of
{{new_provider}} -
Delegation confirmed with a query against the parent zone (e.g. dig NS
{{domain}}+trace)
Verify
-
Website, API and other public hostnames resolve and respond correctly
-
Inbound and outbound email tested, with SPF, DKIM and DMARC passing
-
Third-party services that depend on DNS verification still show as verified
-
DNSSEC re-enabled at
{{new_provider}}and the new DS record published at the registrar optional
Clean up
-
Old zone kept active until caches have expired, then deleted
-
Old DNS provider account closed or downgraded
-
TTLs restored to normal values
-
Documentation and access lists updated for
{{new_provider}}
Checklist as Markdown
Frequently asked questions
Does moving DNS providers cause downtime?
Not if the new zone is complete and correct before you change the nameservers. During the switch, some resolvers use the old provider and some the new one, and both give the same answers. Downtime only happens when records are missing at the new provider or DNSSEC is mismatched.
How long does a nameserver change take to propagate?
It depends on the TTLs of the NS records at the parent zone and in resolver caches, which are often hours and can be up to a couple of days. Keep the old zone running and unchanged during that time. Avoid editing records at either provider while the switch is in progress.
What is the difference between transferring a domain and moving DNS?
A domain transfer moves the registration to another registrar. Moving DNS changes which provider answers DNS queries for the domain. You can do one without the other, and doing them separately reduces risk.
Updated