Three controls, three jobs
Nameservers delegate DNS hosting, DNSSEC adds signed validation, and registrar lock restricts unauthorized transfer. One does not configure the others.
Nameservers
Before changing nameservers, recreate A, AAAA, CNAME, MX, TXT, SRV and CAA records at the new provider. Keep the old zone available during propagation.
DNSSEC
DNSSEC combines signed zone data with a DS record at the registry. If nameservers change while an old DS record remains, validating resolvers may reject the domain. Coordinate signing and DS changes.
Registrar lock
Keep registrar lock enabled during normal operation. Disable it only for an approved transfer and re-enable it after completion.
Safe change order
- Export the existing zone
- Build and verify the new zone
- Review email and verification records
- Coordinate DNSSEC changes
- Change nameservers
- Validate web, API and email resolution
- Confirm registrar lock