How to migrate DNS with DNSSEC enabled

What can break

The DS record at the registry is a fingerprint of the zone's signing key. Validating resolvers only trust answers signed by a key that matches it. Each managed provider signs with its own keys, so after you switch nameservers the old DS no longer matches, and validating resolvers return SERVFAIL for every name in the domain.

The safe order

1. Remove the DS record at your registrar. Leave the zone signed at the old provider for now.
2. Wait for the old DS record to expire from caches. For .com the DS TTL is one day; check your TLD. Add a few hours of margin.
3. Confirm the domain now resolves as unsigned with the DNSSEC checker.
4. Switch nameservers to the new provider.
5. Wait for the old delegation to expire from caches (48 hours for .com).
6. Turn on DNSSEC at the new provider and copy its DS record.
7. Publish the new DS record at the registrar and confirm the domain validates again.

Can you avoid the unsigned window?

Yes, with a multi-signer setup (RFC 8901), where both providers publish each other's keys during the move. It needs both providers to let you import foreign DNSKEY records, and only a few managed providers support that. For most migrations, the unsigned window is simpler and safer.

Mistakes to avoid

• Removing the DS record and switching nameservers in the same minute. Caches still hold the old DS.
• Publishing the new DS before the new provider actually serves the zone.
• Forgetting a second DS record for an old key; remove every DS record for the old provider.

Get a plan for your domain

The DNSSEC migration checker reads your current DS and DNSKEY records and registrar, and lays out these steps for the provider you're moving to.