Migrating Thousands of Domains Without Breaking a Live Customer

Moving thousands of customer domains to a new edge layer is really two migrations happening at once. One is technical: proxy flags, SSL modes, DoH providers, an off-origin relay for the bare domain a managed edge won't proxy. The other is entirely human: a long tail of customers who each control their own DNS, on their own schedule, some of whom will never see the deadline email. Both migrations can fail independently, and this hub is built from real incidents in both halves.

The technical failures below share a shape: a setting that looked correct and wasn't verified against the live result. A certificate that issued while the page stayed dark, a DoH provider that failed instantly and completely instead of gracefully, a runbook, written by the same person reading it, that named the wrong account for a domain. The human failures are about batching and blast radius: canary batches before a full cutover, a migration board that tracks which domains are actually done instead of which ones were attempted, and a scan that can size the damage of a bad flip in twelve seconds instead of an afternoon.

If you're moving domains at any real scale, the lesson worth taking is that the deadline is never the hard part. The hard part is that every domain is a slightly different case, and the discipline that survives contact with the long tail is verifying live state before you touch anything irreversible, not trusting the plan that got you there.