How we handle your access.

You're giving us the keys to your DNS. Here's exactly what we do with them.

What we can change

We only read from the provider you're leaving. The source zone is never written.
We only write to the destination zone you choose, and only after you confirm the plan by typing the domain name.
Before the first write, we save a snapshot of the destination zone so a rollback can restore it exactly.

Cloudflare: a scoped API token limited to DNS on the zones you pick.
Route 53: an IAM role in your account that trusts ours, with an external ID unique to your workspace. No access keys leave your account.
Azure: a service principal with Reader for the preview, and DNS Zone Contributor on one resource group to apply.
Google Cloud: a service account with roles/dns.reader, or roles/dns.admin to apply.
GoDaddy and Namecheap: API keys. Namecheap requires allow-listing our fixed egress IP.

Encrypted with AES-256-GCM using a per-connection data key, which is itself encrypted by AWS KMS.
Decrypted only inside the worker process that runs your job, never in the web tier, never logged.
Deleted automatically 24 hours after a migration finishes, unless you choose to keep a connection for backups.
Every read and write against your zones is recorded in an audit log you can export.

Export a zone file from your current provider and use the zone translator. It runs entirely in your browser and produces a file you import yourself.

Hosted on AWS. Databases are encrypted at rest; all traffic uses TLS 1.2+ with HSTS.
The public checker only sends DNS and RDAP queries, never connects to private networks, and is rate limited.

Email security@dnsmigrator.com. We reply within two business days and won't take legal action over good-faith research that respects user data.