I am launching a new website
Check the domain resolves on both the bare name and www, the certificate covers both, and email is not left open to spoofing.
AltF DomainOps
Website migration DNS checklist
Most migration outages are DNS mistakes: a forgotten MX or TXT record, a long TTL, or a DNSSEC DS record left at the registrar. This checklist orders the steps so the old and new hosts overlap and nothing breaks, with DomainOps checks at each stage.
- Free, no sign-up
- Real DNS, RDAP and TLS data
- Raw records shown
- No affiliate links
A week before
- Export or screenshot every record at the current DNS host. Run the DNS lookup "all records" view as a second copy.
- Note every TXT record (verification tokens), MX, SPF includes and DKIM selectors.
- Lower TTLs on records that will change to 300 seconds, and wait for the old TTL to expire.
Moving the website only
- Set up the site on the new host and test it with a hosts-file entry.
- Change the A/AAAA (or CNAME) records at your DNS host.
- Watch Resolver compare until Google and Cloudflare both return the new address.
- Keep the old host running for at least the old TTL, then a day more.
Moving DNS to a new provider
- Recreate every record at the new provider first, and compare them record by record.
- If DNSSEC is on, remove the DS record at the registrar and wait 24-48 hours before switching.
- Change the nameservers at the registrar. The parent zone's NS TTL is often two days.
- Check the NS lookup and the Registration tab both show the new nameservers, then re-enable DNSSEC.
After the move
- Run the health report: address, MX, SPF, DMARC and DNSSEC should all pass.
- Check the certificate on both the bare domain and www.
- Raise TTLs back to 3600 or more once everything is stable.
Check each step with the tools below.
Website migration DNS checklist: questions and answers
How long does DNS propagation take?
As long as the TTL of the record that changed, everywhere that cached it. With a 300-second TTL, most users see the change within minutes. Nameserver changes depend on the TLD's NS TTL, commonly 24-48 hours.
Will email stop during a migration?
Only if MX or SPF changes. If you move the website only, leave MX, SPF, DKIM and DMARC untouched and email is unaffected.
Start from what you are doing
My email goes to spam
Read your SPF, DMARC and DKIM records, make sure SPF stays under 10 lookups, and confirm MX points at the right provider.
I am moving to a new host
Lower TTLs first, copy every record, switch nameservers, then compare resolvers until the new answers appear everywhere.
My site shows a certificate error
See whether the certificate expired, does not cover this hostname, or is missing an intermediate in the chain.
I do not want to lose my domain
Find the real expiry date, check transfer lock is on, and keep the domain on a watchlist with a countdown.
A service asked me to add a TXT record
Confirm the verification record is live, see which services already verified the domain, and spot leftovers to remove.
Focused checks and guides
Checks
Full domain health checkAll nine tools, the record glossary and how each check works.DNS lookupFree DNS lookup for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, DS, DNSKEY and HTTPS records, with TTLs, DNSSEC status and what each record means.MX lookupFree MX record lookup: see a domain's mail servers in priority order, which email provider runs them, and whether SPF and DMARC are set.NS lookupFree nameserver lookup: see which nameservers answer for a domain, who the DNS host is, the SOA serial, and whether the zone is DNSSEC-signed.TXT record lookupFree TXT record lookup that labels each record: SPF, Google and Microsoft verification, Meta, Apple, Stripe and 25 more services, plus DMARC and DKIM.SSL certificate checkFree live SSL checker: connect to any site and see its certificate issuer, expiry date and days left, covered hostnames, chain trust and TLS version.Domain expiry checkCheck when a domain expires from the registry's own RDAP data: expiry date, days left, registrar, transfer lock and status codes in plain English.Reverse DNS lookupFree reverse DNS lookup for IPv4 and IPv6: find the PTR hostname of an IP address and the network owner from the regional internet registry.DNSSEC checkCheck whether a domain uses DNSSEC: DS record at the registry, DNSKEY in the zone and whether public resolvers validate the answers.CAA record checkLook up a domain's CAA records to see which certificate authorities may issue certificates, including wildcard and reporting rules, with fixes.
Guides
Domain launch checklistA 20-point checklist to launch a new domain: DNS records, www, HTTPS, email authentication, DNSSEC, CAA, registrar lock, with a free check for each step.Email domain setup guideSet up email for your domain the right way: MX records, one SPF record under 10 lookups, DKIM keys, a DMARC rollout plan, MTA-STS and BIMI.
25 more free domain and DNS tools
Single-purpose AltFTool tools for one job each, grouped by what you are trying to do.
Lookups
One question, one answer.
Write records
Generate correct records before you paste them into your DNS host.
Certificates and HTTPS
Go deeper than the live certificate check.
AltFTool does not store the domains or addresses you check. DNS lookups in the DNS, compare, email and IP tools run from your browser; registration, report and certificate checks pass through AltFTool's server and keep nothing.