A domain can stop resolving after a nameserver change even when the visible DNS records seem correct. DNSSEC adds another part to the configuration. If the registrar and the new DNS provider no longer agree, validating resolvers may reject the answers.
Include the registrar in the investigation
Record the nameservers currently delegated by the registrar and the nameservers expected by the new provider. Check whether a DS record remains from the previous DNSSEC setup. Cloudflare documents stale or mismatched DS records as a possible cause after nameserver changes. Editing only the website’s address record may not correct that relationship.
Follow the providers’ migration sequence
Have the responsible DNS administrator coordinate the registrar and authoritative DNS settings. The correct steps depend on the providers and whether a supported DNSSEC transition is available. Avoid repeatedly toggling security settings without recording the state. Preserve the full zone, including email records, so a repair to website resolution does not create a second outage.
Verify the full result
Check resolution through appropriate tools and more than one resolver after the configuration is corrected. Confirm website access and business email separately. Record the final nameservers and DNSSEC state, including who manages each part. DNS security is useful when maintained correctly; a migration should leave a documented configuration rather than an unexplained permanent workaround.
What to check
- Compare registrar delegation with the new DNS provider.
- Check for a stale or mismatched DS record.
- Preserve the full DNS zone, including email records.
- Verify resolution and document the final DNSSEC state.