<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>If the IP addresses of the DNS servers (dns[123].olddomain and
dns[123].newdomain) are staying the same - then you only need to
send an update to change your domain from being hosted at
olddomain to newdomain. Ideally, the newdomain would be created
first (pointing to the same IP addresses as in olddomain) in the
Registry, then after a day or two, have the olddomain in the
Registry deleted - but it shouldn't really matter.</p>
<p>People who are looking for DNSSEC records will still go to the
correct places - because the IP addresses at those places are not
changing.<br>
</p>
<div class="moz-cite-prefix">On 2023/02/13 17:58, Danilo Godec via
bind-users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:6e1b0388-e190-6b36-4d79-5fed07c37b32@agenda.si">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div class="moz-signature">
<div>Hello,</div>
<div><br>
</div>
<div><br>
</div>
<div>in the near future I will have to change NS records for one
of my domains, as DNS servers currently use an old domain (not
mine), that will be phased out. DNS servers will actually
remain the same, only the domain name will change.<br>
</div>
<div><br>
</div>
<div>So, basically:<br>
<br>
<ul>
<li>mydomain currently uses dns1.olddomain, dns2.olddomain,
dns3.olddomain, ...</li>
<li>dns*.olddomain are the same servers as dns*.newdomain</li>
<li>mydomain has to change DNS server to dns1.newdomain,
dns2.newdomain, dns3.newdomain, ...<br>
</li>
</ul>
</div>
<div><br>
</div>
<div><br>
<div>Since DNSSEC is enabled on mydomain, I've been reading
some instructions about doing this with DNSSEC and they say:</div>
<div><br>
</div>
<div>1. Disable DNSSEC at Registrar<br>
2. Wait 24 hours<br>
3. Disable DNSSEC at Name Server (remove DS-records)<br>
4. Switch name servers<br>
5. Wait 24 hours<br>
6. Re-enable DNSSEC<br>
</div>
</div>
</div>
</blockquote>
<p>I personally prefer,</p>
<p>Create the Domain on the new nameservers, sign it, send the new
DS record to the Registry. This probably means loading the DS
record via the old (existing) Registrar. Wait 24 hours
(propagation time) then update (swap) the Nameservers at the
Registry to the new Nameservers.<br>
Wait a day or two then remove the domain from the old servers.<br>
As long as one of the DS records matches the DNSKEY on either the
old or new Nameservers - DNSSEC should validate.</p>
<p>The problem is - not many Registrars allow a foreign DS record to
be loaded in their system for uploading to the Registry. I do
allow the client to do this. Don't think it has ever happened
though.<br>
</p>
<p><br>
</p>
<blockquote type="cite"
cite="mid:6e1b0388-e190-6b36-4d79-5fed07c37b32@agenda.si">
<div class="moz-signature">
<div>
<div> </div>
<div><br>
</div>
<div><br>
</div>
<div>Is this really necessary in this case, changing only DNS
server names? I would like to avoid changing DS records at
the registrar level as they don't provide a 'self-service'
interface for managing them, so I have to go though their
support and that's usually tedious.</div>
<div><br>
</div>
<div>If that is necessary, why?<br>
</div>
<div><br>
</div>
<div><br>
</div>
<div> Thanks, Danilo</div>
<div><br>
</div>
<div>PS: If it matters, this is (still) a manually DNSSEC'd
domain.<br>
</div>
</div>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
</blockquote>
<div class="moz-signature">-- <br>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<title></title>
<p>Mark James ELKINS - Posix Systems - (South) Africa<br>
<a class="moz-txt-link-abbreviated" href="mailto:mje@posix.co.za">mje@posix.co.za</a> Tel: <a href="tel:+27826010496">+27.826010496</a><br>
For fast, reliable, low cost Internet in ZA: <a
href="https://ftth.posix.co.za">https://ftth.posix.co.za</a><br>
<br>
<img moz-do-not-send="false"
src="cid:part3.F979D275.586F110B@posix.co.za" alt="Posix
Systems" width="250" height="165"><img moz-do-not-send="false"
src="cid:part4.E8C91C82.F6F724EA@posix.co.za" alt="VCARD for
MJ Elkins" title="VCARD, Scan me please!" width="164"
height="164"><br>
</p>
</div>
</body>
</html>