Express Friday migration: new VPS ready, but nameservers still point to OVH panel — and nobody has registrar access. Site responds over SSH, visitors see old IP forty-eight hours. Server was not the problem. DNS was.
DNS at host: included zone, pre-filled on purchase. Specialist DNS: Cloudflare, Gandi, Infomaniak, Route53 — often API, anycast, DNSSEC, change logs. Question: do you accept coupling hosting exit and DNS exit?
Resilience comparison
| Criterion | Host DNS | Specialist DNS |
|---|---|---|
| Initial setup | Zero friction | NS delegation to configure |
| Host migration | Change under stress | A/AAAA switch only |
| API / automation | Variable, sometimes weak | Terraform, webhooks |
| Performance | Correct | Anycast often superior |
| Panel outage coupling | Correlated risk | Decoupled |
| DNSSEC | Sometimes absent | More frequent |
Keeping DNS and production at same provider is one key to cut site and resolution.
Host DNS: when acceptable
Single site, few changes — blog, brochure, nameservers stable for years. Team without dedicated network admin — fewer consoles. Host with correct DNS API — some European clouds already allow automation.
Mitigation: document registrar access, low TTL — three hundred seconds — before planned migration.
Specialist DNS: when it pays
Multi-services — Google MX, origin A, CDN CNAME, SPF/DKIM/DMARC TXT — living zone. Staging / blue-green — subdomains switched via CI API. Sovereignty — EU or CH actor with clear DPA if DNS is considered personal data — requester IP logs. DNS DDoS protection — rare for SMB but real.
Recommended mature SMB pattern: registrar for domain ownership plus transfer lock; specialist DNS for authoritative zone; host for compute only.
DNSSEC and traps
Enable only if you understand DS record at registrar. Test with dig +dnssec. Hostpoint DNSSEC article illustrates required discipline.
Frequent mistakes: TTL 86400 on migration day; apex CNAME — use ALIAS/ANAME or flatten; forget MX when changing A.
The peak: DNS is silent lock-in
Decide and move forward without blind spots
First inventory all records — A, AAAA, MX, TXT, CNAME — then decide: if frequent migrations or multi-SaaS, move to specialist DNS with API; otherwise host DNS acceptable with registrar documentation and low TTL before move. Enable DNSSEC only if stack is mastered. See directory and IPv4 or dual stack for AAAA consistency.
Frequently asked questions
Why separate DNS and hosting?
Stress-free migration, lower correlation of host panel outage or compromise.
Is free host DNS enough?
Often for simple site. Multi-services → API and change history useful.
Cloudflare vs European specialist?
Cloudflare performant; sovereignty → compare EU/CH actors and DPA.
DNSSEC mandatory?
Not legally for blog. Recommended if chain correctly configured.
Before next migration, verify: who owns the NS — and have we tested an A change without calling support?