Managing DNS and pointing your domain to your site

DNS is the address book of the internet, and like most address books it is ignored until something goes missing. Pointing a domain at a new site is usually a five-minute change. The trouble comes from the parts nobody remembers: the email records that lived in the same zone, the verification record a vendor added three years ago, the TTL that means half your visitors keep going to the old server for a day. This article covers what to know before you touch DNS.

Registrar, DNS host, and records

Three separate things are involved, and they are often with three different companies:

• The registrar is where the domain is registered and renewed.
• The DNS host holds the zone: the list of records for the domain. The registrar's nameserver setting says which DNS host is authoritative.
• The records in the zone say where each name points.

Changing a record is small and quick. Changing the nameservers moves the whole zone to a different DNS host, and every record must be recreated there first.

Record types you will meet

The bare-domain problem

Modern hosting sits behind a CDN or load balancer whose addresses change, so you point at a hostname, not an IP address. That works for www.example.gov with a CNAME. But the bare domain, example.gov, cannot have a CNAME under DNS rules. The options are an alias-style record (Route 53 alias records, or ALIAS/ANAME at DNS hosts that support them), or a redirect service that sends the bare domain to www. Whichever you choose, test both names.

TTL and cutovers

Every record has a time-to-live (TTL): how long resolvers around the world may cache the answer. With a TTL of 86,400 seconds (one day), a change can take up to a day to reach everyone. Before any planned move:

1. Lower the TTL on the records you will change to around 300 seconds, at least one full old-TTL period ahead of time.
2. Make the change in a quiet window.
3. Confirm from outside your network that the new answer is being returned.
4. Keep the old site running until traffic has moved, then raise the TTL again.

Do not break email

The most painful DNS mistakes have nothing to do with the website. When a zone moves to a new DNS host, or someone "cleans up" old records, it is easy to lose the MX, SPF, DKIM, or DMARC records. Email then bounces or lands in spam, often without anyone connecting it to the website change. Before any zone move, export every record, recreate all of them on the new host, and compare the two lists line by line before switching nameservers.

Checking records yourself

dig +short www.example.gov
dig +short example.gov
dig +short MX example.gov
dig +short TXT example.gov
dig +short NS example.gov

To see what the rest of the world sees rather than your campus resolver, add @8.8.8.8 or @1.1.1.1 to the command. Online tools that query from many countries at once are useful for watching a change spread during a cutover.

Keeping DNS healthy

• Know who can log in to the registrar and DNS host, and use multi-factor authentication on both.
• Turn on auto-renew for the domain, with a shared mailbox as the contact.
• Leave certificate validation records in place. Deleting them breaks automatic renewal later.
• Document why unusual records exist, so nobody deletes one that matters.

How eWay manages DNS

eWay manages DNS architecture and domain records as part of hosting, including alias records for bare domains, certificate validation records, and the TTL planning for any cutover. Changes go through change control, cutovers are rehearsed with lowered TTLs and a tested rollback, and DNS resolution is monitored continuously. When a zone moves, eWay exports and verifies every record, email included, before switching.

What to include in a support ticket

• The severity you would assign, P1 to P4 (see severity levels and response times)
• The domain names involved and what you want them to point to
• Who controls the registrar and current DNS host
• For a problem: the dig output and when it started

eWay customers can open a ticket in the support portal or email support@ewaycorp.com at any time. See how to request support for all the options. Related reading: SSL and HTTPS setup and renewal and SSL certificates and domain management for Cascade sites. More on our WordPress and Drupal pages.