You copied the DNS records, checked the website, and changed the name servers. Except, now customers say the site will not load. Yet, your server is healthy, and the new DNS provider is answering queries.
Before you restart anything, check the DS record.
With DNSSEC enabled, moving DNS providers can leave a broken link in the system that proves your DNS answers are authentic. Copying every record correctly will not fix that link.
Your domain has a trust link above it
DNSSEC uses digital signatures to help DNS resolvers (the services that look up domain names) verify answers. Your DNS provider signs the domain’s data and publishes public keys in DNSKEY records.
A Delegation Signer, or DS, record sits in the parent zone. For example.com, the parent is .com. Think of the DS as a fingerprint identifying a trusted key for your domain. You usually manage it through your registrar.
Suppose the new provider uses a different key. You change the name servers, but the parent’s only DS record still identifies the old key. A validating resolver cannot establish trust in the new keys. It rejects the answer and normally returns an error called SERVFAIL.
As a result, the website can become unreachable even though its server is running.
Agree on the sequence first
Agree on the sequence first
In Managing Mission Critical Domains and DNS, Mark E. Jeftovic explains:
“You will need to regenerate your DS when you rollover your KSK, because the associated hash of your KSK in the DS will change.”
The KSK is your key-signing key. Moving to a provider that uses a different one means the parent’s DS record must be accounted for in the move. So, changing the name servers alone doesn’t update that trust link.
A migration that keeps DNSSEC protection active needs coordination between providers and the registrar. A supported process can overlap keys and DS records during the move. That means both providers must support the chosen method. Adding a second DS record alone isn’t enough…
Where that coordination is unavailable, your provider may recommend a temporary unsigned transition:
- Remove the parent’s DS record.
- Keep the old zone signed until cached DS records expire, then change the name servers.
- Once cached old name server records have expired and the new signed zone is ready, publish the new DS and test validation.
This leaves a period without DNSSEC protection and may be unsuitable for services that depend on it. Follow your providers’ agreed procedure. Never stop signing while a published or cached DS still requires it.
Before anyone makes the change
- Check the live records. Identify the current DS, its matching key, and who can update it.
- Check the waiting periods. DNS records have cache lifetimes called TTLs. Lowering your website record’s TTL does not shorten the parent DS lifetime.
- Test validation. Use multiple validating resolvers. Getting an IP address back is not enough.
- Keep a rollback plan. Retain the old DNS service until the move is verified. Reversing the move must account for keys, DS records, and cached answers.
Put DNSSEC in the migration plan
DomainSure’s services include managed DNS with Set-and-Forget-DNSSEC through easyDNS, plus DNS change notifications. Signing automation helps with routine operations; a provider change still needs planning.
Contact DomainSure’s sales team before your move. Bring your provider details and DNSSEC settings. Ask who will update the DS record, when they will do it, and how they will confirm the move worked.
Apply for a Domainsure Invite
Get a Free Domain Health Check
Due to high demand: allow up to 24 hours for report delivery.
