# DNS change propagation outage: pre-release checklist

Source: https://releasefailures.com/incidents/dns-change-propagation-outage/
Content version: 1.0.0
Verified on: 2026-10-21
Licence: CC BY 4.0

Definition: A DNS or load balancer change sends traffic to the wrong target or nowhere.
- [ ] PR-01 Read the infrastructure plan for the production apply and confirm no DNS record or TLS certificate is destroyed before its replacement exists. (test class: Configuration and environment tests)
- [ ] PR-02 Apply each change tested in isolation on staging to production on its own and in sequence, and confirm the production commit matches the reviewed commit. (test class: Configuration and environment tests)
- [ ] PR-03 Diff the target hosts of the cache load balancer in the release candidate against production and confirm each backend pool points to its intended host. (test class: Configuration and environment tests)
- [ ] PR-04 Enable DNSSEC signing on a non-production domain that has a wildcard record before signing the main domain. (test class: Configuration and environment tests)
- [ ] PR-05 Before removing a DS record or disabling DNSSEC signing, look up the DS record TTL at the parent zone and record how long resolvers may keep it. (test class: Configuration and environment tests)
- [ ] PR-06 Run DNS resolution checks for every public hostname, including the app subdomain, through several validating resolvers every minute during and after the DNS change. (test class: Synthetic monitoring)
- [ ] PR-07 Download one package file from the static download host on a schedule and alert on the first name resolution failure. (test class: Synthetic monitoring)
- [ ] PR-08 Apply a cache load balancer config change to one cluster first and compare its connection failure rate with untouched clusters before continuing. (test class: Canary and progressive delivery checks)