Move your DNS.Keep every record.
Connect the provider you're leaving and the one you're moving to. DNSMigrator reads every record, shows how each one translates, and changes nothing until you've reviewed it.
- Free preview
- No account needed
- Read-only
example.com
Route 53 Cloudflare
- TranslatedCNAME@
d1a2b3c4.cloudfront.net.
Stored as an apex CNAME to d1a2b3c4.cloudfront.net. Cloudflare flattens it automatically.
- ExactMX@
1 aspmx.l.google.com. +1
- ExactTXT@
"v=spf1 include:_spf.google.com ~all"
- ExactCAA@
0 issue "amazon.com"
- ExactTXT_dmarc
"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com"
- ExactSRV_sip._tls
100 1 443 sipdir.online.lync.com.
- ReviewAapi
192.0.2.10 +1
Weighted routing isn't available at the destination. All 2 answers are served together as simple round-robin.
| Status | Type | Name | Result | Details |
|---|---|---|---|---|
| Translated | A CNAME | @ |
| |
| Exact | MX | @ |
| |
| Exact | TXT | @ |
| |
| Exact | CAA | @ |
| |
| Exact | TXT | _dmarc |
| |
| Exact | SRV | _sip._tls |
| |
| Review | A | api |
|
Showing 7 of 11 records.
Five steps, each one reversible.
A migration is a plan you can read, not a script you have to trust. Here's the whole flow on an example zone. Click through it.
Source
ConnectedAmazon Route 53
Cross-account IAM role with an external ID · Read only
IAM role with an external ID, created by a one-click CloudFormation stack in your account.
- route53:ListHostedZones
- route53:ListResourceRecordSets
Destination
ConnectedCloudflare DNS
Scoped API token · Edit, one zone
API token limited to DNS on example.com. Revoke it from your dashboard when you're done.
- Zone · DNS · Edit
- Zone · Zone · Read
Example data for example.com, produced by the real translation engine.
The records that break migrations.
Copying records is the easy part. These six problems are why DNS moves go wrong, and the preview checks for each one on your zone.
- Proxied records
- Cloudflare's orange cloud hides your origin. Move it as-is and the origin IP becomes public. Every proxied record is flagged with the address it would expose.
- Apex CNAMEs and aliases
- Route 53 aliases, Cloudflare flattening and Namecheap ALIAS all behave differently. Each one is mapped to the closest thing the destination supports, or stopped with a reason.
- Routing policies
- Weighted, latency and failover sets don't exist at most providers. You'll see exactly how they collapse before you agree to it.
- DNSSEC
- A stale DS record at the registry makes the whole domain fail to resolve. The cutover plan removes it first and re-signs after the switch.
- Cached answers
- Long TTLs keep resolvers on old data for days. The plan lowers them ahead of time and clamps values the destination won't accept.
- Whole-zone overwrites
- Some APIs, like Namecheap's, replace every record on each write. We read, merge and write once, so records outside the plan survive.
Not every provider speaks the same DNS.
The same table drives the translation engine, so what you read here is what the migration does.
| Feature | Cloudflare | Route 53 | Azure DNS | Cloud DNS | GoDaddy | Namecheap | Akamai | Bunny |
|---|---|---|---|---|---|---|---|---|
| Apex CNAME | ||||||||
| Apex alias | ||||||||
| CDN proxy | ||||||||
| Routing policies | ||||||||
| DNSSEC via API | ||||||||
| SRV records | ||||||||
| Minimum TTL | 60s | 0s | 1s | 0s | 600s | 60s | 60s | 60s |
Moving between two of these? See the guide for your pair, or compare all 66 providers.
Pay once per zone, after you've seen the preview.
No subscription for one-off moves. Launch pricing, in US dollars.
Preview
Freealways
See exactly what would happen before you pay anything.
- Connect any supported provider
- Full record-by-record preview
- Compatibility report (PDF + JSON)
- Download the translated zone file
Migrate
$9per zone
Simple zones up to 50 record sets.
- Everything in Preview
- Apply with destination snapshot
- Verification against new nameservers
- One-click rollback for 7 days
Migrate + cutover
Most zones$29per zone
Any size, guided switch, DNSSEC handled.
- Everything in Migrate, any record count
- TTL-lowering and cutover plan
- Safe DNSSEC transition
- Propagation monitoring + email alerts
- Rollback for 30 days
Automated
$49per zone
Nameservers changed at your registrar for you.
- Everything in Migrate + cutover
- Registrar nameserver switch via API
- Automatic revert if checks fail
- Priority email support
Questions people ask before they move.
Do you ever change my current DNS provider?
No. We only read from the provider you're leaving. Changes are written to the destination, and nothing goes live until you switch nameservers at your registrar.
What happens to records the destination can't represent?
They're never dropped silently. Each one is marked Unsupported with the reason and what to do instead, like recreating a Namecheap URL redirect as a Cloudflare redirect rule.
How do you store my API credentials?
Encrypted with AES-256-GCM under AWS KMS keys, decrypted in memory only when a job needs them, and deleted 24 hours after your migration finishes. For the preview, read-only access is enough.
Will my site go down during the switch?
The switch itself doesn't cause downtime: both providers serve the same answers while resolvers catch up. The usual culprits are DNSSEC and proxied records, and the preview flags both before you start.
Can I migrate without giving you any credentials?
Yes. Export a zone file from your current provider, paste it into the zone translator, and download a file ready for the destination. It runs entirely in your browser.
Is there a subscription?
No. You pay once per zone migrated. Continuous backups and multi-domain plans for agencies are on the roadmap and will be optional.
See your zone at the new provider.
Or translate a zone file without sharing any credentials.