DNS cutover checklist

A week before

• Export the full zone from the current provider's API or as a zone file.
• List anything provider-specific: proxied records, apex aliases, routing policies, redirects.
• Find every DKIM selector and verification TXT record; they can't be discovered publicly.
• Check whether DNSSEC is on with the DNSSEC checker.
• Confirm who controls the registrar account and that it isn't locked against nameserver changes.

One or two days before

• Create the zone at the new provider and load every record.
• Compare answers from the new nameservers with the old ones, record by record.
• Lower TTLs on records you may need to change quickly to 300 seconds.
• If DNSSEC is on, remove the DS record at the registrar now and wait at least the DS TTL.
• Freeze record changes, or agree to make them at both providers.

At the switch

• Confirm the domain now validates as unsigned, if you removed DNSSEC.
• Change the nameservers at the registrar.
• Check the registry's delegation with a lookup against a public resolver.
• Test the website over HTTPS, email in both directions, and any API hostnames.

The week after

• Watch the propagation checker until all resolvers agree.
• Keep the old zone unchanged for at least seven days.
• Enable DNSSEC at the new provider and publish its DS record.
• Raise TTLs back to normal values.
• Cancel the old provider only after the week is over.