Change a domain's DNS servers

Changing DNS servers moves authority for your zone. From the switch on, the new servers answer for the domain, including mail. If the new zone is incomplete, the website and the mailboxes go down together. Preparation is most of the work.

Capture the existing zone

Do not change anything before you have the full record list. Query each type separately, because ANY is often filtered:

for t in A AAAA MX TXT NS CAA; do echo "== $t"; dig +short $t your-domain.com; done

Add subdomains and service records (_dmarc, _domainkey, _sip._tcp, and so on). Note the TTLs and, if the panel allows it, export the zone file: it is the most reliable reference.

Prepare the new zone

Recreate the records exactly at the new DNS provider, with a TTL of 300 during the transition. Verify by querying the new servers directly, without changing the registrar:

dig @ns1.new-provider.com A your-domain.com +short
dig @ns1.new-provider.com MX your-domain.com +short

Until those answers are correct, do not switch. A missing MX record stops incoming mail; a missing SPF TXT sends messages to spam; a missing or too strict CAA blocks the certificate.

Switch at the registrar

In the registrar interface, replace the DNS servers with the new provider's (at least two). Save, then check:

dig NS your-domain.com +short
dig NS your-domain.com @1.1.1.1 +short

Delegation propagation depends on the NS TTL at the extension and can take minutes to hours. During that period, old and new servers may answer alternately.

If the domain uses DNSSEC, remove the DS record at the registrar before the switch, then publish the new chain afterwards. A DS pointing to a missing key causes SERVFAIL for every validating resolver.

Verify website and email

• The site answers over HTTPS and the certificate matches the domain.
• A message sent to a mailbox on the domain arrives.
• A message sent from the domain is not rejected (SPF, DKIM, DMARC).
• Subdomains and exposed services answer.
• Web server logs show no requests to the old hosting.

Test with two different resolvers and from a mobile network, which often uses a separate cache.

Keep a rollback

Keep the old zone and old hosting for at least a week. Rollback means restoring the old DNS servers at the registrar: it works as long as the old zone still exists.

Avoid switching on a Friday evening or during a campaign. Warn the people who use the domain's email addresses: they notice a missing MX first.