Engineering capabilities
- Zone migration with a record-by-record audit
- Proxy versus DNS-only decisions per record
- DNSSEC enablement and registrar DS records
- TTL strategy for planned cutovers
Security & DNS
Cloudflare DNS
Authoritative DNS on a global anycast network with DNSSEC, proxying and rapid propagation, used where resolution must stay fast and available under attack.
Security & hardening
- DNSSEC signing and registrar lock
- Account MFA and scoped API tokens
- CAA records and audit logging of zone changes
Authoritative DNS on anycast
Zones are migrated record by record, signed with DNSSEC and controlled with TTL discipline so cutovers are predictable.
-
01
Zone migration
- Record audit
- Import and diff
- Nameserver delegation
The imported zone is compared against the source before delegation changes.
-
02
Resolution
- Anycast network
- DNS-only records
- Proxied records
Mail, SIP and other non-HTTP records stay DNS-only; only web traffic is proxied.
-
03
Integrity
- DNSSEC signing
- DS record at registrar
- CAA records
Signing is completed at the registrar, not left half-enabled.
-
04
Control
- Account MFA
- Scoped API tokens
- Change audit log
Zone changes are attributable and API access is limited to what automation needs.
Frequently asked questions
Will proxying break our mail or phones?
It would, which is why mail, SIP and VPN records are kept DNS-only. Only HTTP and HTTPS hostnames are proxied.
How long does a nameserver change take?
Delegation typically completes within a few hours. Record TTLs are lowered beforehand so any correction propagates quickly.
Is DNSSEC always advisable?
Where the registrar supports DS records, yes. It prevents forged answers, and the main risk u2014 a broken chain during migration u2014 is managed by sequencing the change.
Scope the work before you commit budget
Send the environment details and get an engineered proposal with assumptions, risks and a rollback path.