How do I back up DNS records before moving host?
Export the zone from the old host if it offers it, and take a snapshot here as well: type the domains, press Take snapshot, and download the BIND zone file (a ZIP for several domains) or a CSV. After the move, upload that file under Compare to see every record that is the same, changed, missing or new.
Made for IT admins and MSPs moving clients between registrars and DNS hosts: up to 50 domains at once, asked two at a time. The zone file uses names relative to $ORIGIN, splits long TXT records into 255-byte strings, and leaves the SOA and name servers as comments, because the new host writes its own.
How to move DNS safely
- Before: take a snapshot, download the zone, and lower TTLs a day ahead if you can.
- Move: import the zone at the new host, check it there, then change the name servers at the registrar.
- After: upload the old zone under Compare. Fix anything missing or changed.
Which records are asked
| Where | Types |
|---|---|
| The domain itself | A, AAAA, MX, NS, TXT, CAA, SOA, HTTPS, DS |
| Common hosts: www, mail, webmail, smtp, autodiscover, ftp, vpn, remote, cpanel, shop, blog, api, dev, staging and about 60 more | A (or CNAME), then AAAA, TXT, MX |
| Microsoft 365: enterpriseenrollment, enterpriseregistration, lyncdiscover, sip, msoid, _sipfederationtls._tcp, _sip._tls | CNAME, SRV |
| Mail settings: _dmarc, _mta-sts, mta-sts, _smtp._tls, default._bimi, and 50 DKIM selectors | TXT or CNAME |
| Services: _autodiscover, _caldav(s), _carddav(s), _imap(s), _pop3(s), _submission(s), _xmpp, _ldap, _kerberos | SRV |
| A random name | Finds a wildcard (*), so names it answers for are not mistaken for real ones |
An alias stays an alias: a CNAME is saved as a CNAME, not as the addresses it leads to.
Why no tool can list every DNS record
DNS answers questions about names you already know. There is no public "list all names" question: zone transfers (AXFR) are refused by almost every host, and DNSSEC's NSEC3 hides names on purpose. Any website that promises "all records" is guessing names too. The snapshot is as complete as the names asked, which is why you can add your own and pull extra names from certificate logs, where every public HTTPS certificate is recorded.
Reading the comparison
- Changed: the name answers with other values than the old zone. Check each one.
- Missing: in the old zone, not answered now. Usually a record that was not imported.
- New: answered now, not in the old zone. Often fine (the new host's own records); sometimes a sign the old export was incomplete.
- TTL only: same values, longer TTL than before. A lower TTL is not reported: resolvers count TTLs down while they keep an answer.
- Note: SOA and name servers, which are expected to change, and addresses Cloudflare proxied in the old zone.
Questions
Not from public DNS alone: DNS cannot list a zone's names. The snapshot asks the names people commonly have, every common DKIM selector, names you add and, if you ask, names from certificate logs. Always keep the old host's own export too when it offers one.
BIND zone files with $ORIGIN, $TTL, @, relative and absolute names, parentheses over several lines and comments; Cloudflare's export (its proxied flag is read); Route 53 exports made with cli53 or similar tools; and the CSV this page saves. Several files at once, one per domain.
Resolvers keep answers for the record's TTL, and the parent zone's name server records for up to two days. Compare again later, and switch on Google's resolver to see a second cache.
A * record cannot be asked by name. The page asks one random name under it and compares that answer with the old record, and says so in the row.
No. Zone files are read in your browser. Only DNS questions go to Cloudflare's (and if chosen, Google's) public resolver, and domain names go to crt.sh only when you press its button.