DNS Migration Guide — How to Change DNS Providers Safely

Migrating DNS providers is one of those tasks that looks simple on paper but can go wrong in unexpected ways. The process itself is straightforward: export records, import them to the new provider, update nameservers at your registrar. But a mistake at any step can cause downtime that affects every visitor to your website.

I have done many DNS migrations over the years. The key is preparation and patience. You cannot rush DNS propagation. You cannot skip verification steps. If you follow the process carefully, you can switch providers without anyone noticing.

Preparation — Before You Start

Preparation takes longer than the actual migration. Start at least one week before your planned switch date. The most important step is lowering your TTL values. Your DNS records probably have TTLs of 3600 seconds (1 hour) or 86400 seconds (1 day). Lower every record's TTL to 300 seconds (5 minutes) at least 48 hours before the migration.

Lowering the TTL ensures that when you make the nameserver change, resolvers will quickly expire their cached records and query the new nameservers. If you skip this step, users might see stale DNS data for up to 24 hours after the switch.

Document your current DNS configuration. Export all zone files or take screenshots of every record. Pay special attention to less common record types like SRV, CAA, and SSHFP. These are easy to miss during migration. Also document TTL values, DNSSEC settings, and any provider-specific features like proxying or load balancing.

Step-by-Step Migration Process

Step 1: Set Up the New Provider

Create an account with your new DNS provider. Add your domain as a new zone. Do not change the nameservers at your registrar yet. Both the old and new providers should be configured simultaneously during the migration window.

Step 2: Import Records

Manually recreate all your DNS records in the new provider's control panel. Many providers offer import tools that can pull records from your existing provider or from a zone file. Use these tools to save time, but verify every record after import.

Step 3: Verify the New Configuration

Before switching traffic, verify that the new provider is serving the correct records. Query the new nameservers directly using dig or nslookup: dig @ns1.newprovider.com example.com A. Check every record type. If anything is missing or incorrect, fix it before proceeding.

Step 4: Update Nameservers at Your Registrar

Log into your domain registrar's control panel. Find the nameserver settings and replace the old provider's nameservers with the new ones. The exact location varies by registrar but is usually under Domain Management or DNS Settings.

Step 5: Monitor Propagation

After updating the nameservers, propagation begins. Use our propagation checker to monitor progress from global locations. Complete propagation typically takes 15 minutes to 2 hours for most users, but can take up to 48 hours in rare cases.

Step 6: Keep the Old Provider Active

Do not cancel your old provider's service immediately. Keep the zone active for at least one full TTL cycle after the nameserver change. Some resolvers with long caching periods will still query the old nameservers. If you deactivate the old zone too early, those users will get SERVFAIL responses.

Migrating with DNSSEC

DNSSEC adds complexity to DNS migration. If your domain is DNSSEC-signed, you need to manage the DS record at your registrar during the migration. The exact steps depend on your current and new providers.

The safest approach is to disable DNSSEC before the migration and re-enable it after the new provider is active. Disable DNSSEC at least 48 hours before the migration to allow the DS record to propagate. After the migration completes and you have verified everything works, enable DNSSEC on the new provider.

If you cannot tolerate a DNSSEC-free window, you need to coordinate the key exchange between providers. This is complex and error-prone. Most organizations accept the temporary DNSSEC gap during migration. See our DNSSEC guide for more details.

Rollback Plan

Sometimes migrations go wrong. Have a rollback plan ready. If you detect a problem during propagation, revert the nameserver change at your registrar to the old provider. The old provider's zone should still be active and serving the correct records.

Keep your old provider account active for at least 30 days after the migration. This gives you a rollback path if you discover issues weeks later. Some problems — like misconfigured SPF records or missing DKIM keys — only become apparent when email delivery starts failing.

After confirming the migration is successful and stable, document any lessons learned. Update your migration checklist for next time. Run a DNS audit to confirm everything is configured correctly on the new provider.