Migrations, Troubleshooting and Security
Moving DNS to a new provider
- Recreate every existing record at the new DNS host (export or copy them: web, mail, verification records).
- Lower TTLs at the old provider a day before.
- Change the nameservers at the registrar.
- Keep the old zone unchanged for a few days while caches expire.
Forgetting MX or TXT records is how website moves break company email.
Moving hosting
Add the domain on the new host, test it using the platform's URL, then switch the DNS records. Keep the old host running until traffic has moved.
Troubleshooting checklist
| Symptom | Check |
|---|---|
| Site not found | nameservers (dig NS), the A/CNAME records, typos |
| Some users see the old site | TTL caching; compare dig @1.1.1.1 with the authoritative nameserver |
| Certificate error | records point at the host, no stray AAAA records, CAA allows the issuer |
| Email stopped after a move | MX, SPF, DKIM records missing on the new DNS host |
| Works on your laptop only | an /etc/hosts override or local DNS cache |
Domain security
- Registrar account with 2FA and a registrar lock.
- Dangling DNS: a CNAME pointing at a deleted service (an old Heroku app, a removed storage bucket) can let someone else claim that service and serve content on your subdomain. Remove records when you delete services.
- DNSSEC (offered by many registrars and DNS hosts) protects against forged DNS answers; enable it if your providers support it end to end.
- Monitor certificate issuance for your domain with Certificate Transparency alerts.
Exercise
Write a migration plan for moving a client's domain from their registrar's DNS to Cloudflare without breaking their website or email: record inventory, TTL change, cutover steps, verification and rollback.
Check yourself
- What records do people most often forget when moving DNS?
- What is a dangling DNS record, and why is it dangerous?
- How do you check whether caches still hold old answers?
Your progress is saved in this browser only.
Submit for review (10 points)