Registrar APIs vs DNS Interfaces — Different Jobs in a Tenant Migration

Registrar APIs and DNS interfaces serve distinct purposes during a tenant migration. The registrar API manages the domain account and its delegation, handling tasks like registration, nameservers, and transfer state. On the other hand, the DNS interface focuses on the authoritative zone records, such as A, AAAA, or CNAME entries, and does not have the authority to grant ownership of the parent domain.

In the context of a gaming platform with numerous subdomains per tenant, it is crucial to keep the registrar API for migration ledger and delegation changes, while utilizing a DNS interface for high-frequency tenant records. This separation ensures a clear migration path and minimizes the risk of retries during the cutover process.

To ensure a successful migration, it is essential to lower Time To Live (TTL) values ahead of time and verify the new zone before switching delegation. This approach helps manage propagation delay and prevents players from experiencing disruptions. By publishing the target records in both zones and waiting for at least one TTL window, teams can confirm the consistency of answers across various networks, certificate coverage, and launcher configurations.

Implementing a migration state machine and runbook is crucial for tracking domain movements. Each tenant record should have an owner zone, desired target, last observed answer, and migration phase. The registrar worker should be idempotent and slow, while the DNS worker can be fast but must verify critical aspects like zone serial and read-back values. Monitoring DNSSEC status, email authentication records, and certificate coverage during the migration adds an extra layer of security and reliability.

In practice, maintaining a manifest per zone, including expected TXT and CNAME values, can prevent cutover issues even when web probes appear healthy. Logging registrar request IDs, nameserver sets, zone versions, and resolver observations, along with alerting on any drift between the desired tenant map and authoritative data, helps maintain a clear rollback evidence trail.

While keeping the old zone and resolver observations for rollback purposes incurs storage and operational costs, it provides a clear rollback path and minimizes the risk of leaving stale credentials or records active in a live game environment. By selecting the appropriate interface based on the nature of the operation, teams can ensure a controlled and well-documented migration process.