Glossary

This glossary defines DNS and DNSMigrator terms as they are used in migration plans, managed zones, provider pages, tools, and the CLI. The key point is to distinguish desired DNS data from delegation: applying records prepares a destination, while changing nameservers tells the public DNS hierarchy to use it.

A–D#

Apex#

The root owner name of a zone. For example.com, the apex is example.com. and is shown as @ in many zone files. Ordinary DNS forbids a CNAME at an owner that also has required apex records, so providers implement apex aliasing in different ways. See Translation rules.

Authoritative nameserver#

A server that answers from a zone it serves, rather than from a recursive cache. DNSMigrator verifies an apply against the destination provider’s authoritative nameservers. See Apply and verify.

AXFR#

A full DNS zone transfer over TCP. It can provide a complete protocol-visible zone when the primary allows the requester. Provider-only settings, flattened aliases and CDN proxy intent still may not be recoverable. See BIND zone files.

Canonical zone#

DNSMigrator’s provider-neutral representation of a zone: fully qualified owner names, record type, TTL, normalized value sets, and optional metadata such as proxy, alias or routing state. Provider adapters and the BIND parser convert into this model. See How it works.

Change plan#

The create, update, delete, and unchanged record sets produced by comparing desired data with a destination’s live state. Apply recalculates this plan from a fresh destination read before record writes.

Connection#

A workspace-scoped, encrypted provider or registrar credential plus its checked access scope. Creating one runs an access check; Check access runs it again. See Connecting providers.

Cutover#

The stage that changes public delegation from old nameservers to new nameservers. It is separate from applying destination records. DNSMigrator supports guided and automatic cutover. See Nameserver cutover.

Delegation#

NS data published by the parent zone that tells resolvers which nameservers are authoritative for a child. For a registered domain, the registrar normally controls this registry-facing setting.

Destination#

The provider or zone file receiving translated records. A connected destination requires write access to apply; a zone-file destination only produces a download.

DNS host#

The service operating authoritative nameservers and storing records. It can be the same company as the registrar, but it is a separate role and API.

DNSKEY#

A public key published inside a signed zone. A parent DS record commits to a child DNSKEY. DNS providers usually manage apex DNSKEY records, so ordinary migration plans do not copy them.

DNSSEC#

DNS Security Extensions, which let validating resolvers authenticate DNS data. A migration must coordinate provider signing with the parent DS record to avoid validation failure. See DNSSEC transitions.

Drift#

A difference between a managed zone’s saved desired state and what an attached provider currently serves. Check for drift runs an on-demand comparison; paid plans can schedule checks. See Drift monitoring.

DS record#

A Delegation Signer record in the parent zone that identifies a child zone’s signing key. Stale DS data can make a nameserver migration return SERVFAIL to validating resolvers.

E–N#

Exact#

A translation status meaning the destination representation requires no conversion note. It does not mean the record is already present at the destination; that is shown separately as Already correct in the change plan.

FQDN#

Fully qualified domain name. DNSMigrator canonical names end with a dot, such as www.example.com.. In BIND text, a target without a trailing dot is relative to $ORIGIN.

Glue#

Address records the parent may need for nameservers located below the delegated name. DNSMigrator’s ordinary record plan and registrar nameserver switch are distinct; follow the registrar’s requirements when in-bailiwick nameservers need glue.

Ignore rule#

A name, type and target pattern that preserves matching live records from provider changes. IGNORE, IGNORE_NAME, IGNORE_TARGET and external-dns ownership handling map to the managed-zone settings. See Ignore rules.

Live re-planning#

Before a migration apply or managed-zone push writes records, DNSMigrator reads the destination again and builds operations from current live state. This release applies that fresh plan rather than freezing the operation list produced by the preview.

Managed record#

A record a DNS provider creates or controls itself. In migration translation, SOA, DNSKEY and apex NS are marked Skipped rather than copied as ordinary records.

Managed zone#

A saved desired zone under Zones, with zero or more attached provider connections. You can edit and save without one; preview requires at least one attached provider, and push is always explicit. This is the closest app equivalent to DNSControl’s ongoing desired-state workflow.

Merge mode#

The migration mode labeled Keep extra records. Destination-only records are left in place. The managed-zone equivalent is NO_PURGE or Never delete records at the provider.

Mirror mode#

The migration mode labeled Make an exact copy. Destination-only records enter the delete plan. Managed zones use normal purge behavior when Never delete records at the provider is off.

Nameserver#

A DNS server name in an NS delegation or zone record. Managed-zone planning can combine declared nameservers with provider nameservers returned when a destination zone is created.

Normalization#

Canonicalization that fully qualifies names, normalizes type-specific values, removes duplicate values, merges matching record sets, and sorts output. It makes diffs and generated exports deterministic.

O–Z#

Provider#

In DNSMigrator, a catalog entry for a DNS host, registrar, or both. A DNS provider can read or write zone records. A registrar adapter can list domains and change nameservers and, for some registrars, DS records. See Supported providers.

Propagation#

The period when recursive resolvers hold different cached answers or delegations after a change. The propagation checker compares public recursive resolvers; authoritative verification checks the destination directly and is a different test.

Record set#

All values with the same owner name, type and routing identity, stored with one TTL. Two A values at www.example.com. are one record set in plans and pricing counts.

Recursive resolver#

A DNS service that follows delegations, validates when configured, caches answers, and replies to clients. Cloudflare, Google and Quad9 operate public recursive resolvers queried by propagation checks.

Registrar#

The service through which a domain is registered. It controls registry-facing nameserver delegation and often DS records. Connecting a registrar is optional for guided cutover and required for automatic cutover.

Rollback#

An inverse plan built only from operations DNSMigrator successfully applied. It removes unchanged writes, restores changed records, and skips records modified later by someone else. See Rollback.

Skipped#

A translation status for provider-managed data that should not be copied as an ordinary destination record.

Source#

The connected provider or BIND file from which a migration reads records. Standard preview, apply, verification, and rollback never write to it. Optional cutover TTL lowering is the explicit exception.

SOA#

Start of Authority record. It identifies zone authority and carries a serial and timing values. Providers generally manage apex SOA, so ordinary migration and managed-zone plans omit it.

TTL#

Time to live, in seconds, telling recursive resolvers how long an answer may be cached. DNSMigrator can clamp TTLs to a destination’s supported range and reports the conversion. Lowering a TTL only helps after the old, longer TTL has elapsed.

Translation#

The provider-aware conversion from a canonical source zone to destination-shaped records. It can preserve, convert, warn, block, or skip each record. Translation does not compare with live destination state; planning does.

TSIG#

A shared-key signature used to authenticate DNS messages such as AXFR or RFC 2136 updates. The AXFR/DDNS connection accepts TSIG when the primary requires it.

Unsupported#

A translation or plan status meaning DNSMigrator cannot safely represent or send the record through that destination API. The row includes a reason and is never silently converted into an unrelated record.

Warning#

A translation status meaning a destination record can be produced but behavior may differ, such as lost proxying or flattened routing. Review it before apply.

Zone#

The authoritative DNS data rooted at one owner name, such as example.com. A delegated subdomain with its own authority is a separate zone.

Zone file#

Text in BIND master-file syntax. DNSMigrator parses common directives and record types, reports line errors, and can serialize normalized canonical records. See BIND zone files.