Skip to content
DNSmigrator
Try the zone file translator

DNSMigrator: the DNS migration toolMove your DNS.Keep every record.

DNSMigrator is a DNS migration tool. Connect the provider you're leaving and the one you're moving to: it reads every record, shows how each one translates, verifies the destination, and changes nothing until you've reviewed the plan.

  • Free preview
  • No account needed
  • Read-only

example.com

Route 53Cloudflare

  • TranslatedCNAME@

    d1a2b3c4.cloudfront.net.

    Stored as an apex CNAME to d1a2b3c4.cloudfront.net. Cloudflare flattens it automatically.

  • ExactMX@

    1 aspmx.l.google.com. +1

  • ExactTXT@

    "v=spf1 include:_spf.google.com ~all"

  • ExactCAA@

    0 issue "amazon.com"

  • ExactTXT_dmarc

    "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"

  • ExactSRV_sip._tls

    100 1 443 sipdir.online.lync.com.

  • ReviewAapi

    192.0.2.10 +1

    Weighted routing isn't available at the destination. All 2 answers are served together as simple round-robin.

Showing 7 of 11 records.

Moves zones between

Five steps, each one reversible.

A migration is a plan you can read, not a script you have to trust. Here's the whole flow on an example zone. Click through it.

Source

Connected

Amazon Route 53

Cross-account IAM role with an external ID · Read only

IAM role with an external ID, created by a one-click CloudFormation stack in your account.

  • route53:ListHostedZones
  • route53:ListResourceRecordSets

Destination

Connected

Cloudflare DNS

Scoped API token · Edit, one zone

API token limited to DNS on example.com. Revoke it from your dashboard when you're done.

  • Zone · DNS · Edit
  • Zone · Zone · Read

Example data for example.com, produced by the real translation engine.

The records that break migrations.

Copying records is the easy part. These six problems are why DNS moves go wrong, and the preview checks for each one on your zone.

  • Proxied records

    Cloudflare's orange cloud hides your origin. Move it as-is and the origin IP becomes public. Every proxied record is flagged with the address it would expose.

  • Apex CNAMEs and aliases

    Route 53 aliases, Cloudflare flattening and Namecheap ALIAS all behave differently. Each one is mapped to the closest thing the destination supports, or stopped with a reason.

  • Routing policies

    Weighted, latency and failover sets don't exist at most providers. You'll see exactly how they collapse before you agree to it.

  • DNSSEC

    A stale DS record at the registry makes the whole domain fail to resolve. The cutover plan removes it first and re-signs after the switch.

  • Cached answers

    Long TTLs keep resolvers on old data for days. The plan lowers them ahead of time and clamps values the destination won't accept.

  • Whole-zone overwrites

    Some APIs, like Namecheap's, replace every record on each write. We read, merge and write once, so records outside the plan survive.

Find the holes. Watch the providers.

Every zone gets a security check that reports only real problems, and a public page tracks whether each DNS provider is answering.

Security check· 35 rules

Security issues and broken records. No best-practice nagging.

  • CriticalSubdomain can be taken overCNAMEshopold-shop.azurewebsites.net.
  • CriticalZone transfer open to anyoneNS@ns2.example.net.
  • HighDKIM key is too shortTXTs1._domainkey512-bit RSA key
Example findings for example.com
  • DNSSEC validates
  • Zone transfer closed on every nameserver
  • Targets still exist
  • Nameservers can't be hijacked
  • Public resolvers agree
  • Registration not expiring

Live checks ask your nameservers, five public resolvers and the registry. They run in the Assistant for any migration or zone.

Check your domainHow the rules work

DNS provider status

Which DNS provider stays up, measured every minute.

Providers
61
Nameservers
180
Resolvers
6

Each nameserver gets a direct query, and Cloudflare, Google Public DNS, Quad9, OpenDNS, AdGuard DNS, CleanBrowsing are asked for a fresh random name under every provider's zone. A provider is only marked down when the resolvers fail too.

30-day uptime rankings, per-nameserver detail and every incident, free and public.

See live provider status

Not every provider speaks the same DNS.

The same table drives the translation engine, so what you read here is what the migration does.

What each DNS provider supports
FeatureCloudflareRoute 53Azure DNSGoogle CloudGoDaddyNamecheapAkamaiBunny
Apex CNAME
Apex alias
CDN proxy
Routing policies
DNSSEC via API
SRV records
Minimum TTL60s0s1s0s600s60s60s60s

Moving between two of these? See the guide for your pair, or compare all 74 providers.

Free during the preview. Every feature unlocked.

A limited-time launch offer. The per-zone prices apply after the preview ends.

Preview

Limited time

Freeduring the preview

Limited-time launch offer: every paid feature is unlocked while DNSMigrator is in preview.

  • Apply, verify and roll back any zone size
  • Guided or automated cutover, DNSSEC handled
  • Backups, drift alerts and multi-provider sync
  • Bulk CSV moves, client reports and team seats
Start free

Migrate

$9per zone, after the preview

Simple zones up to 50 record sets.

  • Everything in Preview
  • Apply with destination snapshot
  • Verification against new nameservers
  • One-click rollback for 7 days
Start with a preview

Migrate + cutover

$29per zone, after the preview

Any size, guided switch, DNSSEC handled.

  • Everything in Migrate, any record count
  • TTL-lowering and cutover plan
  • Safe DNSSEC transition
  • Propagation monitoring + email alerts
  • Rollback for 30 days
Start with a preview

Automated

$49per zone, after the preview

Nameservers changed at your registrar for you.

  • Everything in Migrate + cutover
  • Registrar nameserver switch via API
  • Pauses and alerts you if a check fails
  • Priority email support
Start with a preview

Questions people ask before they move.

Do you ever change my current DNS provider?

Only if you ask. Preview, apply, verification and rollback only read from the provider you're leaving; changes are written to the destination, and nothing goes live until you switch nameservers. The one exception is optional: the cutover can lower TTLs at the old provider before the switch, which needs write access there.

What happens to records the destination can't represent?

They're never dropped silently. Each one is marked Unsupported with the reason and what to do instead, like recreating a Namecheap URL redirect as a Cloudflare redirect rule.

How do you store my API credentials?

Encrypted with AES-256-GCM under AWS KMS keys, decrypted in memory only when a job needs them, and deleted after 24 hours without use. For the preview, read-only access is enough.

Will my site go down during the switch?

Done in the right order, the switch itself shouldn't cause downtime: both providers serve the same answers while resolvers catch up. The usual culprits are DNSSEC and proxied records, and the preview flags both before you start.

Can I migrate without giving you any credentials?

Yes. Export a zone file from your current provider, paste it into the zone translator, and download a file ready for the destination. It runs entirely in your browser.

Does DNSMigrator check my DNS for security problems?

Yes. Every migration and managed zone gets a security check that reports security issues and misconfigurations only, such as subdomain takeover, open zone transfers, broken DNSSEC and weak DKIM keys. Live checks also ask your nameservers, five public resolvers and the registry. The free DNS security checker runs the same rules against public DNS.

Is there a subscription?

Not right now. During the public preview everything is free, including migrations, cutover, backups and agency features. Paid plans stay available if you'd like to support the project. This is a limited-time offer; after the preview, migrations are paid once per zone and plans stay optional.

See your zone at the new provider.

Or translate a zone file without sharing any credentials.