How to Change Nameservers (Safely, Without Downtime)

Nameserver changes bypass every DNS record at your old provider — the destination becomes authoritative in one moment. Get it wrong and DNS breaks. Get it right and users see nothing.

The Rule

Populate the destination zone FIRST. Never change nameservers before your new DNS provider has every record already published.

Prerequisites

Access to your registrar (where the domain is registered)
Access to both the old and new DNS providers
List of every DNS record currently served — export from the old provider if possible

Step 1 — Inventory the Current Zone

Get a complete list of every record served by the current nameservers:

A / AAAA
MX
TXT (SPF, DMARC, DKIM, site verification)
CNAME
NS (for delegated subdomains)
SOA (usually auto-generated by the new provider)
SRV, CAA, TLSA if present

Query all of these with the DNS query tool or export via the current provider’s UI.

Step 2 — Publish Everything at the New Provider

At the new DNS provider, create the zone and publish every record from the inventory. Match TTLs. Verify each record is served by querying the new provider’s nameservers directly:

dig @ns1.new-provider.com yourdomain.com A
dig @ns1.new-provider.com _dmarc.yourdomain.com TXT

Step 3 — Lower TTLs on Critical Records at the OLD Provider

24-48 hours before the switch, drop TTLs on MX, A, and TXT records at the OLD provider to 300 or 60 seconds. This shortens the propagation window when the change lands.

Step 4 — Change the Nameservers at the Registrar

At the registrar (GoDaddy, Namecheap, Google Domains, Cloudflare Registrar, etc.), navigate to Domains → your domain → Nameservers. Change from the old set to the new set (usually 2 hostnames provided by the new DNS provider):

ns1.cloudflare.com
ns2.cloudflare.com

Save. The registrar submits an EPP update to the registry; the parent NS records update within 1-24 hours (depends on TLD registry).

Step 5 — Monitor Propagation

Use the DNS propagation checker — query multiple global resolvers. Some resolvers still hold the old nameservers cached (bounded by the parent zone’s TTL, usually 24 hours). New resolvers hitting your domain fetch the new NS records and start querying your new provider.

Step 6 — Verify Mail Flow

Watch email delivery closely for 48 hours after cutover:

SPF still passing (record served correctly by new provider)
DKIM still resolving (correct selectors published)
DMARC record intact

Use the email authentication checker for a full audit.

Step 7 — After 48 Hours, Delete the Old Zone

Once every global resolver has picked up the new nameservers (usually 24-48 hours), you can delete the zone at the old provider. Some prefer to leave it a week for safety.

Common Miss

Changing nameservers before populating the destination zone → immediate DNS outage
Missing records at the destination (SPF, DMARC, DKIM, verification tokens) → mail bounces or auth failures
Not lowering TTLs before the switch → prolonged split-brain period
Ignoring subdomain delegations → sub-zones stop resolving

Verify every record at the destination before cutover with the DNS query tool and monitor with the DNS propagation checker.

Read how DNS propagation actually works, check the nameserver glossary entry, and see the SOA glossary entry.