Property Domain Offboarding — Delete Records Without Whole-Zone Risk
Short answer: retire only the records owned by the departing property, never the whole DNS zone, unless an ownership check proves that the zone itself has no other consumers. Lower the relevant TTL before the cutover, wait for the old TTL window to pass, delete by an exact inventory, and keep restoration data until resolver checks agree. The deciding constraint is propagation delay versus cutover…
When a tenant moves out of a property, their DNS records should be removed individually, not the entire DNS zone. The deletion process should follow a specific order: lower the relevant Time To Live (TTL) before deletion, wait for the old TTL window to pass, verify the exact inventory of records to delete, and maintain rollback data until the resolver confirms the changes.
The key consideration is balancing propagation delay with cutover speed. Deleting a shared zone containing multiple properties can disrupt services for the remaining tenants, so a property-specific approach is necessary. The offboarding process should be scoped by record set tied to a property identifier, not the entire zone. Before any mutation, an exact inventory of records should be reviewed, including name, type, value, TTL, property ID, and lifecycle state.
The admin console should create an immutable plan with a unique operation ID and expected values for every record. The mutation worker should use compare-and-delete semantics, ensuring it stops if the live state differs from the plan. The worker should follow a state machine: active, TTL lowering, ready, deleting, verifying, and then retired.
During the ready transition, evidence of the previous TTL expiring is required. A dedicated zone may be removed only when it's empty apart from explicitly approved zone-level records, has no property or service references, and has separate authorization approval. Shared zones should never be deleted due to a property exit. The decision process includes evidence requirements and default actions.
If the expected value differs from the live value, the operation stops and re-plans. If the zone is shared with multiple owners or services, deletion is denied. For dedicated zones, deletion is allowed only if they're empty of remaining consumers. Verification is necessary when authoritative and recursive observations disagree. The fast cutover with lowered TTL improves responsiveness but increases query frequency.
A slower cutover with higher TTL reduces the frequency of fresh answer requests. Neither setting guarantees a safe zone-wide delete, nor does it ensure what an unobserved resolver currently holds. The provided Go sketch illustrates a worker that applies a reviewed plan, rejects zone deletion for shared ownership, checks the current record against the expected record, and writes an audit event around each mutation.
The boundaries of this system should be explicitly defined to avoid unintended consequences during property offboarding.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
