[{"data":1,"prerenderedAt":184},["ShallowReactive",2],{"publication:en:P068":3},{"meta":4,"copy":18,"relatedArticles":145,"terms":176,"term":177,"resourceParent":178,"glossaryParent":181},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":10,"description":11,"incoming":12,"updated":16,"preparedOn":17},"P068","\u002Fblog\u002Fdns-change-checklist","article","DNS change checklist","DNS change checklist: protect your website and email","DNS change checklist for websites and email","Plan DNS changes with an asset inventory, current records, provider ownership, DNSSEC checks, rollback and end-to-end verification of website and business email.",[13,14,15],"\u002Fservices\u002Fdns-ssl","\u002Fservices\u002Femail-domains","\u002Fservices\u002Fcloudflare","2026-10-02","2026-10-30",{"intro":19,"sections":20,"checklistTitle":92,"checklist":93,"faq":102,"sources":112,"links":118,"cta":140},"A DNS change checklist should protect every service that depends on the domain, not only the homepage. Identify the authoritative provider, preserve current records, map website and email dependencies, prepare the intended change and rollback, and verify real business routes afterward. Cache timing, DNSSEC and provider-specific behavior mean there is no universal propagation promise or single green check that proves the whole change succeeded.",[21,26,62,74,82,87],{"title":22,"paragraphs":23},"Define the change and the people who can authorize it",[24,25],"Write down whether you are editing one record, moving the website target, changing mail routing or replacing authoritative nameservers. These changes have different scope. Identify the registrar, authoritative DNS provider, hosting, CDN, mail platform and any agency with access. A record visible in a provider dashboard is not necessarily the one currently authoritative for the domain.","Name the change owner, business approver, working window, acceptance checks and rollback trigger. Confirm that authorized access and recovery are available before the window starts. If a supplier is leaving, settle ownership and account continuity as a separate task; a successful record edit does not establish that the business controls its domain account.",{"title":27,"paragraphs":28,"table":31},"Preserve the current zone and map dependencies",[29,30],"Export or otherwise record the existing authorized configuration, including names, types, values, priorities, TTLs and relevant proxy settings. Keep that evidence in an appropriate private location. Provider scans and imported zone files can be useful but need comparison with the actual service inventory, including records for less visible systems.","Map the website, hostname variants, APIs, mail routing, sending authentication, verification tokens and any delegated subdomains. For mail, MX records and authentication-related TXT or CNAME records serve different purposes. Replacing website routing should not silently remove billing-platform DKIM or another service verification just because the homepage still works.",{"caption":32,"headers":33,"rows":37},"DNS dependency and acceptance register",[34,35,36],"Dependency","Before the change","After the change",[38,42,46,50,54,58],[39,40,41],"Website and hostname variants","Intended destination, A\u002FAAAA\u002FCNAME and proxy behavior","Correct HTTPS site and important visitor journeys.",[43,44,45],"Mail reception","MX priorities and provider requirements","Controlled external message received by the intended mailbox.",[47,48,49],"Business mail sources","Relevant SPF\u002FDKIM\u002FDMARC identities and supported records","Actual messages from retained sources authenticate as intended.",[51,52,53],"Applications and verification","API\u002Fsubdomain\u002Fverification record owners","The relevant provider and application workflow still work.",[55,56,57],"DNSSEC and delegation","Current authoritative setup and registrar DS state","A valid supported delegation and validation path.",[59,60,61],"Rollback","Original values, access and a decision owner","A defined reversal with cache effects still monitored.",{"title":63,"paragraphs":64,"sources":67},"Plan TTL and DNSSEC with the actual providers",[65,66],"TTL describes caching behavior for a DNS record. Lowering a TTL can support a planned change, but it does not retroactively erase answers already cached under an earlier value. Nameserver and record caching are also different scopes. Use the current providers' supported settings, allow for existing caches and avoid promising that every user will switch at one exact minute.","For a nameserver migration, coordinate the registrar's DS state and the new provider's supported DNSSEC process. An old DS record that does not match the new authoritative setup can cause validation failures. Do not copy an unrelated DS value or casually disable protection as a universal troubleshooting step. Plan the supported sequence and validation before changing delegation.",[68,71],{"label":69,"url":70},"Cloudflare DNS: TTL and caching scope","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fdns\u002Fmanage-dns-records\u002Freference\u002Fttl\u002F",{"label":72,"url":73},"Cloudflare DNS: troubleshooting DNSSEC and delegation","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fdns\u002Fdnssec\u002Ftroubleshooting\u002F",{"title":75,"paragraphs":76,"example":79},"Prepare the destination and apply the explained delta",[77,78],"Before routing traffic, confirm the destination can serve the intended hostname and valid HTTPS configuration. For email, confirm that the provider is ready for the domain and that the business understands reception and sending effects. A DNS record pointing somewhere does not configure the website, certificate or mailbox at that destination.","Review the exact proposed values against the preserved baseline and the provider instructions. Apply only the agreed delta or the documented migration set. Keep a log of who changed what and when. Avoid combining unrelated mail, hosting and security changes in a single undocumented action; a failure is easier to isolate when the dependency and order are explicit.",{"title":80,"text":81},"Illustrative incomplete migration","A business copies website records into a new DNS provider but misses a billing service's DKIM record. The homepage works after delegation changes, yet invoices follow a different authentication path. A complete acceptance plan includes the retained billing sender, not just a website screenshot.",{"title":83,"paragraphs":84},"Verify DNS observations and end-to-end behavior separately",[85,86],"Check the intended authoritative data and suitable resolver observations, recording where and when each answer was seen. Resolver differences during a change need context; one old answer is not proof that the destination is misconfigured. Where validation fails, investigate the actual delegation and DNSSEC state rather than repeatedly rewriting unrelated records.","Then perform the agreed business checks: the correct HTTPS site, important forms or integrations, controlled mail reception and retained sending sources. Review trusted authentication identities for the mail route where relevant. Do not call a change complete merely because a public DNS checker found records; record what the application and providers actually did.",{"title":88,"paragraphs":89},"Use a rollback decision and close the ownership record",[90,91],"If an agreed critical check fails, decide whether to reverse the relevant delta, restrict an affected service or continue diagnosis under the approved plan. Restoring the old value does not instantly recall every cached new answer, so keep monitoring both intended paths and coordinate with service owners. Record the recovery result instead of promising instantaneous reversal.","CyberFixCrew is an Israeli cybersecurity company serving businesses worldwide with websites, business email and digital-infrastructure work. Our Israeli technical knowledge connects domain changes to the services that depend on them. We can help scope the inventory, change and acceptance process; send the domain and intended change without registrar passwords, private keys or account tokens.","DNS change preparation and closure",[94,95,96,97,98,99,100,101],"Specific record edit or delegation change defined","Authoritative provider, registrar and service owners identified","Current zone and relevant provider settings preserved","Website, mail, application and verification dependencies mapped","TTL\u002Fcache and supported DNSSEC sequence considered","Destination and HTTPS\u002Fmail setup ready","Exact delta, rollback trigger and owner agreed","DNS observations and end-to-end business acceptance recorded",[103,106,109],{"question":104,"answer":105},"Does lowering TTL make a DNS change instant?","No, it does not remove answers already cached using an earlier TTL, and different record or delegation caches can matter. Plan using the actual provider settings and record the observed resolver and business behavior instead of promising a universal switch time.",{"question":107,"answer":108},"Will changing nameservers move only the website?","Nameserver delegation changes which provider answers authoritatively for the zone. Website, mail and other dependent records must be accounted for in the destination setup. A working homepage does not establish that mail reception, authentication or application verification remained correct.",{"question":110,"answer":111},"Is restoring the old record an instant rollback?","No, some resolvers or clients may still hold the changed answer. A rollback needs the original values, authorized access, an owner and continued verification of the affected services. Keep the cache limitation visible when deciding whether reversal restored the business workflow.",[113,114,115],{"label":69,"url":70},{"label":72,"url":73},{"label":116,"url":117},"Cloudflare DNS: changing authoritative nameservers","https:\u002F\u002Fdevelopers.cloudflare.com\u002Fdns\u002Fnameservers\u002Fupdate-nameservers\u002F",[119,121,123,125,128,131,134,137],{"path":13,"label":120},"Plan DNS and TLS configuration work",{"path":14,"label":122},"Review mail and domain dependencies",{"path":15,"label":124},"Coordinate Cloudflare configuration",{"path":126,"label":127},"\u002Fblog\u002Fwebsite-ssl-warning","Verify HTTPS after routing changes",{"path":129,"label":130},"\u002Fblog\u002Fwordpress-form-email","Test the website enquiry route",{"path":132,"label":133},"\u002Fblog\u002Femail-spam-diagnosis","Check the observed business mail route",{"path":135,"label":136},"\u002Fservices\u002Fdmarc-spf-dkim","Scope authentication for retained senders",{"path":138,"label":139},"\u002Fglossary\u002Fdnssec","Understand DNSSEC delegation and validation",{"title":141,"description":142,"button":143,"type":144},"Plan the domain change around the business services","Describe the domain, current and intended providers and the reason for the change. We can clarify dependencies and acceptance before implementation.","Discuss a DNS change","setup",[146,155,161,169],{"id":147,"path":148,"title":149,"description":150,"category":151,"artwork":152,"order":153,"publishedOn":154},"P075","\u002Fblog\u002Fcloudflare-origin-exposure","Protect your origin server behind Cloudflare: scope and verify the boundary","Review authorized origin paths, TLS, network restrictions and origin authentication. Verify the normal website and agreed direct-path controls after changes.","infrastructure","security",78,"2026-09-22",{"id":156,"path":126,"title":157,"description":158,"category":151,"artwork":152,"order":159,"publishedOn":160},"P067","Website SSL certificate error: diagnose the failing connection","Separate certificate, hostname, trust-chain and CDN-origin issues from browser-only problems. Verify the affected HTTPS paths without bypassing visitor protection.",94,"2026-10-12",{"id":162,"path":163,"title":164,"description":165,"category":151,"artwork":166,"order":167,"publishedOn":168},"P115","\u002Fblog\u002Fdomain-expiry-risk","Prevent business domain expiration with clear ownership and renewal checks","Map the registrar, renewal date, payment owner and recovery route. Verify renewal evidence and service dependencies without assuming a universal grace period.","domain-renewal",70,"2026-09-12",{"id":170,"path":171,"title":172,"description":173,"category":151,"artwork":152,"order":174,"publishedOn":175},"P081","\u002Fblog\u002Fsecurity-headers-explained","HTTP security headers for business websites: choose, test and maintain","Choose security headers by browser behavior and website dependencies. Plan CSP, HSTS, framing and content-type changes with safe rollout and business checks.",62,"2026-08-31",[],null,{"path":179,"label":180},"\u002Fresources","Website security resources and templates",{"path":182,"label":183},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058816]