Verification
A 200 response is not enough.
A complete cutover test proves authority, content, assets, TLS, edge identity, private-path behavior, mail, and origin denial. Error pages can also return HTTP 200.
Evidence layers
AuthorityEvery delegated nameserver returns the expected SOA and records.
Recursive DNSMultiple public resolvers return consistent answers without SERVFAIL.
Visual websiteDesktop and mobile render expected HTML, CSS, images, fonts, and scripts.
Content parityExpected markers or hashes match, accounting for intentional dynamic values.
TLSCertificate names, chain, expiry, and protocol negotiation are valid.
Edge controlsExpected POP, proxy, WAF, and cache headers appear.
Origin protectionApproved POP fetch succeeds; unapproved direct-origin access fails.
EmailInbound and outbound tests pass authentication and reach the mailbox.
Cutover checklist
- Registrar shows intended nameservers.
- All authorities answer consistently.
- SOA serial is current.
- Apex and www are canonical.
- Expected subdomains resolve.
- No unintended origin IP is public.
- HTTP redirects once to HTTPS.
- Certificate covers each hostname.
- Desktop page is visually complete.
- Mobile page is visually complete.
- CSS, JS, images, and fonts load.
- Login and forms remain private.
- Static assets cache as intended.
- Dynamic paths bypass cache.
- WAF negative test is blocked.
- Direct origin is denied.
- MX/SPF/DKIM/DMARC resolve.
- Send and receive tests pass.
When to rollback
Rollback or drain the affected route when authoritative inconsistency, invalid TLS, widespread broken rendering, login/session failure, mail interruption, DNSSEC SERVFAIL, or exposed direct-origin access is confirmed. Preserve evidence before changing state.