DNS migration checklist
Thirteen checks around a nameserver or record change, in the order the clock forces. The first group runs days ahead, because a record you did not write down is a record you will not notice is gone, and because the TTL you set today decides how long a mistake tomorrow lasts. The middle group runs at the cutover itself. The last group is the one teams skip: mail authentication lives in TXT records that a zone rebuild quietly drops, and the failure surfaces as delivery complaints a week later rather than as an error at the moment of the change. Run every lookup against a named resolver and against the zone's own nameservers, because those two answers are different questions.
13 checksabout 76 min end to end
Days before, while a mistake is still cheap
- How to check dns records
No single query returns every record, so the inventory has to be taken one type at a time before anything is rebuilt. - How to check dns ttl
The TTL in force at the moment of the change is how long a wrong answer stays cached, so it has to be lowered before the change, not during it. - How to check ns record
The parent zone and the child zone each publish an NS set, and a cutover is finished only when both agree. - How to check txt record of a domain
TXT holds vendor verification strings alongside mail authentication, and it is the record set most often rebuilt from memory.
The records that carry traffic
- How to check a record of domain
Confirm every name that answers today has an address in the new zone, including the ones nobody remembers publishing. - How to check cname record
An address query for an aliased name reports the target and hides the alias, so a CNAME has to be queried as a CNAME or it disappears from the inventory. - How to check mx records
Mail routing is the part of a cutover with no visible error page, and a missing MX looks like silence rather than a failure.
At the cutover
- How to check dns propagation
Several resolvers disagreeing is the normal state during a change, and this separates a change still spreading from a difference that never converges. - How to check dns cache
Your own machine is the least reliable witness to a cutover, because naming a resolver bypasses the local cache and Chrome does not use it at all. - How to check ptr record
Reverse records live with whoever owns the address block, so they do not move with the zone and are the usual orphan after a hosting change.
The mail half, which fails silently
- How to check SPF record
A rebuilt zone with one include missing still parses and still publishes a policy, and the policy now fails the sender it dropped. - How to check DKIM record
A selector is discoverable only from a message the domain sent, so a DKIM record left behind is invisible until a signature fails. - How to check DMARC record
DMARC decides what a receiver does with the two results above, which makes it the check that turns a quiet record problem into lost mail.
Take it with you
The file is the same list as Markdown checkboxes, ready to paste into a release ticket or a pull request description.
Ticks are kept in this browser only. They are not sent anywhere and other people do not see them.