Switching DNS providers, hosts, or registrars silently discards every DNS record you don't recreate. That is how companies lose email for two days. DNS Preflight inventories your records, tells you exactly what will break, and gives you a cutover checklist. Free, no signup.
Runs in your browser. Lookups go straight from your browser to Cloudflare's and Google's public DNS resolvers. Your domain and records are never sent to our servers; we only collect anonymous usage counts.
The bare domain, without https:// or www.
Comma-separated. We already probe ~90 common names (www, mail, api, DKIM selectors, SRV records, and so on). Add anything unusual here.
Detection is based on well-known record patterns. Treat it as a map of what depends on your DNS, not a complete audit.
Every record below must exist at the new provider before you change nameservers. Records are ranked by what happens if you miss them.
DNS cannot be enumerated from the outside. This scan probes the apex plus ~90 common hostnames, DKIM selectors, and service records, and anything you added above. A record with an unusual name will not show up here. If your current provider offers a zone export, do that too and paste it into the scan box; the combination catches what either misses alone.
Copied
Copied
The free scan tells you what you have and what to do. The kit gives you the artifacts a professional migration needs:
Checkout by Stripe. You receive an unlock code on the confirmation page and by email. No account, no subscription. If it doesn't work for your migration, write to [email protected] and we refund it.
Do, if you can; many panels (and many one-click hosting DNS tabs) have no export at all. But an export is a pile of records, not a plan. It won't tell you that your MX points at Google Workspace and email dies without it, that a missing CAA record can block certificate renewal, or that you should lower TTLs two days before the flip. And it can't check the new provider's answers after you migrate.
The scan runs entirely in your browser. DNS queries go directly from your browser to Cloudflare's (cloudflare-dns.com) and Google's (dns.google) public DNS-over-HTTPS resolvers, the same infrastructure your device may already use. Your domain name and records are not transmitted to Ninth Harbor. We use PostHog for anonymous usage counts (a scan happened, a file was downloaded); the events contain no domain names.
No, and no outside tool can; DNS doesn't allow zone enumeration. We probe the apex plus about 90 common hostnames, 20+ well-known DKIM selectors, common SRV service records, and everything you add manually or via a pasted zone file. For typical business domains this catches everything that matters. The coverage note in your results says the same thing.
Zone file download, the dig verification script, the post-cutover re-scan diff, and the printable runbook. The scan, the record inventory, the service detection, and the full checklist stay free. The unlock code works in the browser you redeem it in and covers any number of domains you manage.
No. The tool only reads public DNS. It cannot modify anything.