Copy page

DNS and services

Change nameservers and manage DNSSEC

Use this guide to move a domain between DNS providers, change its nameservers, or manage DNSSEC keys.

Choose your task

• Move from Domain Chief to custom nameservers
• Move back to Domain Chief nameservers
• Prepare records before switching to Domain Chief
• Add or replace DNSSEC keys
• Create a nameserver template
• Fix a nameserver or DNSSEC problem

Before changing nameservers

1. Make a complete copy of the current DNS zone. If Domain Chief hosts it, use Manage DNS records and select Export.
2. Create the same records at the new provider, including website, mail, verification, and service records.
3. Ask the new provider for the exact nameserver hostnames.
4. Check whether the domain currently uses DNSSEC and whether the new provider supports it.
5. If DNSSEC is enabled and the provider or keys will change, disable it and wait at least 24 hours before changing nameservers.
6. If possible, lower the TTLs before the move and wait for the previous TTL to expire.

Do not remove the old zone immediately. Keep it available until the new nameservers are authoritative and the domain works from several networks.

Move from Domain Chief to custom nameservers

1. Set up and verify the zone at the new DNS provider.
2. In the domain's DNS section, select Manage nameservers.
3. Select Use custom nameservers. Domain Chief disables hosted-DNS management and removes its managed DNSSEC keys, but leaves the Domain Chief nameservers and existing hosted zone in place. Custom nameservers saved as the team default are not applied.
4. Wait for the pending change to complete. If DNSSEC was enabled, wait at least another 24 hours before changing the nameservers.
5. Select the pencil button beside the current nameservers.
6. Replace them with the hostnames supplied by the new provider. You can use From template when the team already has a matching nameserver template.
7. Select Save.
8. Wait until the nameserver change has completed and the new provider is answering correctly.
9. If the new provider uses DNSSEC, open Manage DNSSEC, add its key type, algorithm, and public key, then select Save keys. Allow up to 24 hours for DNSSEC to become active.

domainchief-lqyorkeb.example and its nameservers are reserved demonstration names.

What happens next

Nameserver and DNSSEC changes are processed in order. A pending notice means Domain Chief has accepted the change but the registry has not completed it yet. Avoid submitting conflicting changes while one is pending.

Move back to Domain Chief nameservers

If the website or email already runs on the domain, prepare the records first. The domain keeps its current nameservers while you set up and check the Domain Chief zone, so nothing breaks while the records are incomplete. Switch directly only when the domain has no records you need to keep, such as a domain that isn't in use yet.

Prepare records before switching

1. Export the complete zone from the current DNS provider.
2. In the domain's DNS section, select Manage nameservers.
3. Select Prepare records first. A Preparing Hosted DNS notice appears at the top of the domain page.
4. Select Edit records in the notice and import or recreate the records. See Import and migrate DNS records for the import options.
5. Check the records against the Domain Chief nameservers listed in the notice. They answer for the prepared records even though the rest of the internet still uses the old provider. For example, dig @ns.domainchief.eu example.com MX shows the prepared MX records.
6. If DNSSEC is enabled, open Manage DNSSEC, remove every key, and select Save keys. Wait for the change to complete, then wait at least 24 hours before you continue.
7. Select Use these records in the notice to switch the nameservers.
8. Check the website, incoming and outgoing email, and any verification records.

You have 30 days to switch. After that, Domain Chief removes the prepared zone and the domain stays on its current nameservers. The records you prepared are kept, so you can start again from where you left off. To stop earlier, select Cancel in the notice.

Web redirects and mail forwarding become available after the switch, because they only work once the domain uses Domain Chief nameservers. DNS history and scheduled changes also start after the switch.

Switch directly

1. Export the complete zone from the current DNS provider.
2. If DNSSEC is enabled, open Manage DNSSEC, remove every key, and select Save keys. Wait for the change to complete, then wait at least 24 hours before changing nameservers.
3. In the domain's DNS section, select Manage nameservers.
4. Select Use Domain Chief nameservers.
5. Open Manage DNS records and recreate or import the required records as soon as the hosted zone is available.
6. Check the website, incoming and outgoing email, and any verification records.

What happens next

The nameserver change goes to the registry in the same way as any other nameserver change. Public resolvers may keep using the old provider's answers until the previous nameserver TTL expires, so leave the old zone in place for a few days.

Domain Chief manages DNSSEC when its nameservers are in use. You do not need to enter keys yourself, but enabling DNSSEC can take up to 24 hours.

For record formats and zone tools, see Manage DNS records.

Add or replace DNSSEC keys

Only manage keys in Domain Chief when the domain uses custom nameservers.

1. Ask the DNS provider for its DNSSEC key details. The values must include the key type, algorithm, and public key shown in Domain Chief.
2. Open the domain and select Manage DNSSEC.
3. Select Add key and enter the supplied values.
4. Add every active key required by the provider.
5. Select Save keys.

What happens next

Removing every key disables DNSSEC at the registry. During a planned key rotation, follow the DNS provider's instructions about when to add the new key and remove the old one. Do not guess the order.

Enabling or disabling DNSSEC can take up to 24 hours. If the provider gives you only a DS digest instead of the fields shown in Domain Chief, ask it for the DNSKEY values or contact support.

If the domain uses Cloudflare nameservers, see Connect Cloudflare for DNSSEC to retrieve its key instead of entering it manually.

Nameserver reference

Where DNS settings are managed

Use custom nameservers when another provider hosts the DNS zone. Changing nameservers does not copy records from one provider to the other.

Use nameserver templates

Templates save sets of nameservers that your team uses regularly.

1. Open Settings.
2. In Nameserver Templates, select New template.
3. Give the template a clear provider or purpose name.
4. Enter at least two nameserver hostnames and select Save.

You can then select From template while editing a domain's nameservers or choosing nameservers during a registration or transfer. Editing a template does not change existing domains.

The separate Nameservers setting controls the team's default for new registrations and transfers. It also does not rewrite existing domains.

When glue records are required

Glue records are IP addresses registered for nameservers that are children of the same domain. For example, ns1.example.com needs glue when it is used as a nameserver for example.com.

When Domain Chief detects this situation, the nameserver editor asks for IPv4 or IPv6 addresses. Enter the authoritative server addresses supplied by the DNS operator. Ordinary provider nameservers such as ns1.provider.example do not need glue from your domain.

Troubleshooting

Why did the website or email stop working?

Check that the new provider has every record from the old zone and that the saved nameserver hostnames are correct. Use the Chief Tools DNS checker to check the nameservers and public DNS answers. The lookup button beside the domain heading opens it with the domain already filled in. Restore the previous nameservers if the new zone is incomplete and the registry still allows another update.

Why does the domain fail only for DNSSEC-validating users?

The registry key and the provider's active key probably do not match. Check the domain with the Chief Tools DNS checker, then compare the key type, algorithm, and public key with the provider's current values. If you are unsure, contact the DNS provider or Domain Chief support before removing keys.

Why did the registry reject a nameserver?

Check for spelling mistakes and duplicate hostnames. If the nameserver belongs to the domain itself, add the required glue IP addresses. Some registries also impose minimum or maximum nameserver counts.

Why is Prepare records first missing?

The option appears only for active domains that use custom nameservers, while no other preparation is running. A domain that is still being registered or transferred can choose Domain Chief nameservers as part of that process instead.

Why is a change still pending?

Wait for the pending operation to finish before trying a different configuration. Registry processing and DNS caching are separate: the app may show a completed update while recursive resolvers still use cached answers.