Own Your DNS, Not Just Your Domain Name
Owning your domain is not the same as owning your DNS. How to keep control of your DNS zones so no vendor can hold your traffic routing hostage.
You bought the domain, so you think you own it. You own the name. You may not own the DNS, and DNS is what actually points people at your servers. If your DNS lives inside a platform that also hosts your app, that platform controls where your traffic goes. When you want to leave, or when they have an outage, you find out how much control you gave away. Owning your DNS means your zone records live somewhere neutral, portable, and independent of any one host. It is a small thing that saves you on the worst day.
What does owning your DNS actually mean?
Three separate things get confused as one. Your registrar sells you the domain name. Your DNS provider answers the queries that turn that name into an IP address. Your host runs the server behind that IP. Platforms love to bundle all three so leaving means untangling all three at once.
Owning your DNS means the second one is under your control and easy to move. Concretely:
- Your DNS zone is exportable. You can pull every record as a file and load it somewhere else.
- Your nameservers are set at the registrar level, so you can repoint them to any provider without touching the app.
- Your records are documented, not scattered across a UI you only half remember.
When those are true, switching hosts is a DNS change, not a migration. When they are not, your routing is hostage to whoever holds the zone.
Why bundled DNS is a lock-in trap
Platforms that host your app and your DNS together are not doing it for your convenience. They are doing it because it makes you sticky. This is the same pattern I warn about when you spot vendor lock-in before you sign: the more of your stack a vendor holds, the more it costs to leave.
The trap works quietly. You add records through their dashboard over months. Some point at their services with proprietary aliases that only work inside their system. When you finally decide to move, you cannot just export a clean zone, because half of it references things that do not exist anywhere else. Now leaving is a rebuild, not a repoint.
There is an availability angle too. If the same vendor runs your DNS and your app, one incident on their side can take out both your servers and the ability to route around them. Separating DNS from hosting means a host outage is survivable: you repoint DNS at a backup and traffic follows.
How to keep your DNS portable
Keep it boring and independent. A few rules.
Run DNS through a provider whose only job is DNS, or through a neutral service that is not also your host. Put a fast, resilient anycast layer in front, which is one more reason to put Cloudflare in front of your own server: it separates routing from origin cleanly.
Keep your zone as a file in version control. Every record, with comments explaining what it points at and why. When a record is a plain A or CNAME to an IP you control, migration is trivial. When it is a magic alias to a platform service, write down what that alias resolves to so you can replace it.
Set a sane TTL. Long TTLs make cutover slow because the old answer is cached everywhere. Before a planned move, drop the TTL a day ahead so changes propagate fast when you flip. This is exactly the discipline that makes it possible to migrate off managed cloud without downtime.
Keep the registrar separate from the DNS provider separate from the host. Three vendors, three exits. Losing any one does not trap you in the other two.
When bundled DNS is fine
Do not turn this into a crusade. If you run one small site and never plan to move it, using your host's DNS is fine. The lock-in only bites when you have real traffic and real reason to switch, and by then you want the flexibility already in place.
The point is proportional. If your business runs on that domain, treat DNS as its own owned layer, not a checkbox inside your host's dashboard. It is the cheapest insurance in the whole own-your-stack playbook: a few minutes of setup so that on the day you need to move, your traffic follows you instead of staying behind. Point your nameservers at infrastructure you control, keep the origin on a box you own at HostSSH, and no vendor gets to decide where your visitors land.