Moving authoritative DNS for a signed domain requires a DNSSEC transition as well as a nameserver change. If the parent retains a DS for keys that the new provider does not serve, validating resolvers can reject the entire domain even when its ordinary records are correct.
IN THIS ARTICLE
Prepare for the change
Inventory the complete zone and confirm whether the old and new providers support a coordinated signed migration, key transfer or multi-signer workflow. Record existing DS values, delegation TTLs and relevant key timings. Keep the old service available throughout the transition.
01 Move a signed domain to another DNS provider without a stale DS record
- Create the complete destination zone and query every new authoritative server directly. Check website, mail, verification, CAA and delegated-child records before changing the registrar.
- Choose a documented migration method. Maintaining an unbroken signed chain needs coordination supported by both providers; do not assume copying DNSKEY text transfers the corresponding signing capability.
- If using a planned unsigned interval, remove the old parent DS while the old signed nameservers remain operational. Start the old-DS cache wait only after removal is actually published at the parent. Allow the previously published DS to age out according to its TTL before switching delegation.
- Change the nameservers to the ready destination. Keep the old zone consistent and available while old delegation caches remain in use.
- Wait out the old delegation and DNSKEY cache timings in the provider's migration plan, not merely registrar acceptance of the nameserver change. Then verify destination signing, publish the new provider's exact DS through the registrar and validate the chain before retiring the old DNS service.
Verify the authoritative DNS result
Check parent NS and DS answers, destination DNSKEY/RRSIG data and successful resolution through trusted validating resolvers. Test several hostnames and record types, not only the homepage.
If the change does not work
If validating resolvers fail, inspect which DS and nameservers they currently see. Do not repeatedly alternate providers or delete signing keys. Restore a known-consistent state with the DNS operator and preserve the transition evidence.
A common question
Can I leave the old DS in place because the domain name has not changed?
Only when the destination actually supports the corresponding trust-chain arrangement. DS data identifies signing-key material, not simply the domain spelling. A different provider commonly uses different keys, so its migration instructions must account for parent trust.