Inventory the whole zone
Export or document the current DNS zone before changing providers. Include A and AAAA records, aliases, MX, TXT authentication records, verification tokens, service discovery and ACME validation entries. Identify delegated subdomains and DNSSEC settings separately.
Confirm the new provider's authoritative zone is complete and that the team has registrar access. If DNSSEC is enabled, coordinate the DS and signing-key transition with both providers and the registrar; an incorrect DS can make a correctly copied zone fail validation.
Plan around cached answers
TTL is the time a resolver may cache a record. Lowering a TTL shortly before a change does not shorten answers already cached with the old TTL. Different resolvers and clients can temporarily observe different answers, so keep old and new endpoints safe and functional during the agreed transition.
Where an application accepts writes, plan data synchronization or a controlled write freeze. DNS rollback alone does not merge data written to the new destination.
Validate after changing delegation
Query the authoritative nameservers and several recursive resolvers for representative website, mail and verification records. Check both IPv4 and IPv6 where used. Test HTTPS, a form or authenticated journey, and controlled inbound and outbound mail.
Monitor errors and traffic on both endpoints until the transition is complete. Retain the old zone and rollback instructions for the agreed period, and record when obsolete records or credentials can safely be removed.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.