CLOUD DNS → STACKIT DNS · RUNBOOK
Cloud DNS to STACKIT DNS: cutover and rollback
A public Cloud DNS zone maps directly to a STACKIT DNS zone, and its record sets become STACKIT record sets with the same names, types, TTLs and values. What the run cannot do is the part that carries the risk: remove the DNSSEC signature chain, switch the delegation at the registrar and handle private zones, which STACKIT DNS does not offer. This runbook orders those steps, names an owner and a check for each, and ends with a rollback.
A public zone and its records, converted
An estate written for this page and assessed by StackToIT on 4 November 2026: a signed public zone with A, CNAME, MX and TXT records, and a private zone for internal names. First the input, then the resource blocks of the STACKIT Terraform the engine wrote, without the review comments above each block. The blocks are not adjacent in their files, so each has its own pane, verbatim.
resource "google_dns_managed_zone" "public" {
name = "shop-example-com"
dns_name = "shop.example.com."
description = "Public zone for the shop"
visibility = "public"
dnssec_config {
state = "on"
}
}resource "google_dns_record_set" "www" {
managed_zone = google_dns_managed_zone.public.name
name = "www.shop.example.com."
type = "A"
ttl = 300
rrdatas = ["203.0.113.10"]
}resource "google_dns_record_set" "spf" {
managed_zone = google_dns_managed_zone.public.name
name = "shop.example.com."
type = "TXT"
ttl = 3600
rrdatas = ["\"v=spf1 include:_spf.example.net -all\""]
}resource "stackit_dns_zone" "public" {
project_id = var.project_id
name = "shop-example-com"
dns_name = "shop.example.com"
}resource "stackit_dns_record_set" "spf" {
project_id = var.project_id
zone_id = stackit_dns_zone.public.zone_id
name = "shop.example.com"
type = "TXT"
ttl = 3600
records = ["\"v=spf1 include:_spf.example.net -all\""]
}
resource "stackit_dns_record_set" "www" {
project_id = var.project_id
zone_id = stackit_dns_zone.public.zone_id
name = "www.shop.example.com"
type = "A"
ttl = 300
records = ["203.0.113.10"]
}Same names, same values
The trailing dots of Cloud DNS are dropped in the STACKIT names, and the TXT value keeps its quotes. TTLs of 300 and 3600 seconds carry over unchanged, which is the figure you lower before the cutover.
The two things the draft does not carry
Two units of the same run, as engineering/architect-report.md records them, in two verbatim excerpts: the signed public zone moves, but unsigned, and the private zone has no STACKIT counterpart. The private zone's candidate target in the same report is self-managed internal DNS, for example CoreDNS or BIND on servers or SKE.
- **Why:** A public zone maps to a STACKIT DNS zone; records are re-created and the registrar's name servers are switched at cut-over.
- **Includes:** `google_dns_record_set.apex_mx`, `google_dns_record_set.api`, `google_dns_record_set.spf`, `google_dns_record_set.www`
- **WARNING** (dns-dnssec): The zone is DNSSEC-signed. STACKIT DNS does not sign zones ("DNSSEC zone signing is currently not available"): the zone moves unsigned. Remove the DS record at the registrar before moving the delegation, or validating resolvers reject the zone.- **Why:** A private zone resolves names inside the VPCs. STACKIT DNS is public authoritative DNS only, so internal names need a DNS server the STACKIT networks use as resolver, or the names become public records.
- **Includes:** `google_dns_record_set.db_internal`
- **Depends on:** `google_compute_network.core`What the run classifies
| Unit | Class and target | Wave |
|---|---|---|
| Public managed zone with 4 record sets | DIRECT, MEDIUM: STACKIT DNS zone and record sets | 1 |
| VPC network the private zone is attached to | RECONFIGURE, MEDIUM: STACKIT networking or a Network Area; the run writes no resource for it in this estate | 1 |
| Private managed zone with 1 record set | REDESIGN, LOW: a DNS server of your own that the STACKIT networks use as resolver, or public records | 2 |
The cutover section of this run's technical-sequencing.md reads "No cutover facts" even though the estate holds a public zone. The order below is therefore general practice, built on the run's units and findings, not on a cutover plan the engine wrote.
The runbook, step by step
Each step names the person who owns it and the check that tells you it is done. Steps 1 to 3 change nothing visible to users.
1. Inventory every record. Owner: DNS owner
The run reads only Terraform, so records created in the console or by another tool are invisible. Export the live zone, for example with gcloud dns record-sets export, and compare it with the Terraform. Check: every live record set appears in the draft or in a written list of exclusions.
2. Lower the TTLs. Owner: DNS owner
Reduce the TTL of the records that will move, at least one old TTL before the cutover, so resolvers pick up the change quickly. STACKIT notes that a change can take from a few minutes to several hours, in some cases up to 48 hours, depending on TTL and caching. Check: the live TTLs show the lower value from two different resolvers.
3. Create the zone and records on STACKIT. Owner: Platform engineer
Review terraform/dns.tf and apply it to the project. The zone is public and authoritative from the moment it exists, but nothing delegates to it yet. Check: a query sent straight to a STACKIT name server returns every record. The FAQ names ns1.stackit.cloud and ns2.stackit.zone; use the name servers STACKIT lists for your zone.
4. Decide the DNSSEC step. Owner: Security owner
STACKIT DNS lists DNSKEY and DS record types but states that zone signing is not currently available, so the zone moves unsigned. The run says to remove the DS record at the registrar before moving the delegation, or validating resolvers reject the zone. Google's documentation adds that you wait for the DS records to expire from caches. Check: no DS record is returned for the domain.
5. Switch the delegation. Owner: Registrar contact
Replace the NS records at the registrar with the STACKIT name servers. STACKIT's FAQ is explicit that a zone resolves only once the level above delegates to it. Check: the parent zone returns the new name servers; sample your key hostnames from several networks.
6. Handle internal names. Owner: Network architect
STACKIT DNS is public authoritative DNS only, and its FAQ says the zone ACL field is inactive. Internal names need a resolver of your own, or they become public records. The run says how the STACKIT networks reach that resolver: through the ipv4_nameservers setting of each stackit_network, and which network replaces which VPC is your decision. Do not publish an internal address by accident. Check: servers resolve their internal names from the new network.
7. Watch, then retire. Owner: DNS owner
General practice: keep the old zone answering until the old TTL has passed twice, compare query logs and monitoring, and delete the Cloud DNS zone only after the rollback window closes.
Rollback
Rollback is a delegation change, which is why the old zone stays intact until the end.
| Trigger | Action and owner | Check |
|---|---|---|
| A record answers wrongly on STACKIT | Correct the record on STACKIT first; if time matters, point the NS records back. Owner: DNS owner | The record returns the intended value from the STACKIT name servers |
| Mail or an application fails after the switch | Restore the Cloud DNS name servers at the registrar. The old zone still holds every record. Owner: Registrar contact | The parent zone returns the Cloud DNS name servers |
| The domain was signed and must be again | Publish a DS record again after the delegation returns. General practice: leave DNSSEC enabled on the Cloud DNS zone until the rollback window is over, and confirm the DS values in Google's documentation at that moment. Owner: Security owner | Validating resolvers resolve the zone |
| Internal resolution fails | Keep the Cloud DNS private zone until the internal DNS server serves its names. Owner: Network architect | Internal hostnames resolve from the new network |
Questions DNS owners ask
Does STACKIT DNS sign zones with DNSSEC?
As of November 2026, STACKIT documents DNSSEC zone signing as currently not available. The engine moves the zone unsigned and tells you to remove the DS record at the registrar first.
Can Cloud DNS private zones move to STACKIT DNS?
No. STACKIT DNS is public authoritative DNS. The run classes a private zone as REDESIGN: internal names need a DNS server that the STACKIT networks use as resolver, or they become public records.
Do record TTLs change when the zone moves?
Not in the draft. TTLs carry over as written. Lowering them before the cutover and raising them afterwards is a decision you take.
Who switches the delegation?
You do, at the registrar. The run performs no cutover and gives no time estimate; the delegation step is yours.
Sources
Your next move: STACKIT.
Tell us about your estate. We show you what StackToIT delivers for it: target architecture, Terraform artifacts and a structured migration plan.