DNS Digger · zone export

otw.solutions

Finds every DNS record of a domain that can be found and turns it into a zone file you can import at the new DNS provider.

Zone

Found by probing

Records: 4 SOA 1 · NS 2 · A 1
Names probed: 298
Names from CT logs: 1
Nameservers: ns1.desec.io 45.54.76.1
ns2.desec.org 157.53.224.1

Took 0.3 s · 310 DNS queries to the authoritative nameservers. Results are cached for 5 minutes.

Moving checklist

Lower TTLs: At least a day ahead (or as long as the old TTL), set the TTLs at the old provider to 300 seconds.
Import the zone: Import the zone file at the new provider and compare it with the old provider’s control panel, especially MX, SPF/DKIM/DMARC and verification TXT records (Microsoft 365, Google).
DNSSEC: If the zone is signed: remove the DS record at the registrar and wait for its TTL before switching nameservers.
Switch nameservers: Enter the new provider’s nameservers at the registrar.
Verify: Use DNS propagation to check that the new NS have arrived everywhere, then test website and mail.
Clean up: Cancel the old provider only after 48 hours and raise the TTLs again.

Check NS propagation →

⚠ The zone is signed with DNSSEC. Remove the DS record at the registrar and wait for its TTL before switching nameservers, otherwise the domain becomes unreachable for validating resolvers. Re-enable DNSSEC at the new provider afterwards.

No zone transfer allowed, which is normal. The records were found by probing 298 names: common host names, DKIM selectors, SRV and _ records, host names from certificates (Certificate Transparency logs) and targets that found records point to. Names that appear nowhere cannot be found this way, so compare the list with the old provider's control panel before switching.

Zone file (BIND)

Imports into Cloudflare, Hetzner, INWX, PowerDNS, Route 53, Azure DNS and most other providers. SOA and apex NS are commented out, because the new provider sets its own.

; Zone export for otw.solutions (tools.otw.solutions/dig)
; Generated 2026-10-16T17:06:34Z
; Found by probing common names and Certificate Transparency logs. Names that are not in
; any of those cannot be found without a zone transfer. Compare with the old provider before switching.
; SOA and apex NS belong to the old provider; the new provider creates its own. Kept as comments.
; DNSSEC records were left out, because the new provider signs the zone itself.

$ORIGIN otw.solutions.
$TTL 3600

; @    300 IN SOA    get.desec.io. get.desec.io. 2026104583 86400 3600 2419200 3600
; @   3600 IN NS     ns1.desec.io.
; @   3600 IN NS     ns2.desec.org.
@   3600 IN A      89.58.3.112

name,type,ttl,value
otw.solutions,SOA,300,get.desec.io. get.desec.io. 2026104583 86400 3600 2419200 3600
otw.solutions,NS,3600,ns1.desec.io.
otw.solutions,NS,3600,ns2.desec.org.
otw.solutions,A,3600,89.58.3.112

All records

Name	Type	TTL	Value	Source
@	SOA	300	get.desec.io. get.desec.io. 2026104583 86400 3600 2419200 3600	apex
@	NS	3600	ns1.desec.io.	apex
@	NS	3600	ns2.desec.org.	apex
@	A	3600	89.58.3.112	apex

Same in the terminal

$ curl tools.otw.solutions/dig/otw.solutions > otw.solutions.zone

Prints the zone file directly. JSON with ?format=json.