Common DNS Migration Mistakes and How to Avoid Them
Most DNS migration incidents are not caused by DNS being mysterious. They are caused by incomplete inventories, stale cache assumptions, missing records or switching off old infrastructure before resolver caches have expired.
Make a complete record inventory
Before changing provider or nameservers, export or document every visible record: web, mail, verification, CAA, service records and subdomains.
dig example.com A +short
dig www.example.com CNAME +short
dig example.com MX +short
dig example.com TXT +short
dig example.com CAA +shortLower TTL before the change
Lowering TTL at the moment of migration is too late for resolvers that already cached the previous answer. Lower it in advance and wait at least the old TTL period.
dig @1.1.1.1 example.com A
dig @8.8.8.8 example.com ADo not forget non-web records
- Copy MX and TXT records before changing nameservers.
- Check AAAA records so IPv6 users do not reach old infrastructure.
- Keep old hosting or mail service active during cache transition.
- Review DNSSEC DS records when moving authoritative DNS.
- Verify CAA records before certificate renewal.
Common migration mistakes
Only testing your own network
Your local resolver can refresh earlier than users in other networks.
Leaving an old AAAA record
IPv6 clients may still connect to the previous server.
Changing nameservers without copying TXT
Email authentication and service verification can break silently.
Ignoring DNSSEC at the parent
An old DS record can cause SERVFAIL after moving DNS provider.