The Zone File Nobody Audits: Reclaiming DNS Control Before It Takes You Offline

Redundancy has become a familiar comfort. Two availability zones, a warm standby, a restore that was tested in the spring: on paper, the resilience story is complete. Yet a meaningful share of outages affecting UK businesses have nothing to do with servers at all. They begin in a DNS account that nobody in the organisation can log into.

The domain name system sits above every other layer of the stack. It determines where traffic is directed, which mail exchanger receives a message, and whether a certificate authority will accept that you control the name at all. It is also, in most organisations, the piece of infrastructure with the thinnest documentation and the most informal ownership.

The record that outranks your contract

A hosting agreement sets out service levels, support hours, and exit terms. None of that matters if the authoritative nameservers for your domain are operated by a third party who has stopped answering emails. The DNS zone is a control plane: whoever can edit it can redirect your customers, intercept your mail, and suspend your services without touching a single server you pay for.

This is a question of sovereignty in a very practical sense. Control of a domain is exercised through three separate relationships, and UK businesses routinely collapse all three into one supplier without noticing. The registry holds the delegation. The registrar holds the account and the registrant contact details. The DNS provider holds the zone and its records. Each can be owned by a different party, and each can be lost independently.

Four ways control leaks away

Delegated nameservers. The most common pattern is a hosting provider or agency pointing your domain at their own nameservers. It is convenient and it works, but it means the zone lives in their account. When the relationship ends, the records do not travel with you unless someone exports them.

Registrar reseller accounts. Many domains are registered inside an agency's reseller portfolio rather than in a standalone account held by the business. The registrant contact is often a generic agency address. The business may be named in the record while holding no ability to log in and act on it.

Contact details that belong to people who have left. Registrant and administrative contacts pointing at a departed employee's mailbox are a recurring finding in due diligence. Recovery then depends on the goodwill of a former member of staff whose address may already be deactivated.

Unmanaged DNSSEC. Signing a zone improves security, but it also introduces a failure mode in which a misconfigured or stale delegation causes validating resolvers to reject the domain entirely. If the keys are held by a third party and nobody in the business knows how rollover is handled, an innocent change elsewhere can produce a total outage that looks, from the outside, like a hosting failure.

The recovery that is rarely as fast as assumed

Emergency procedures exist, and they are slower than most people expect. For .com and other generic top-level domains, an inter-registrar transfer can be blocked by the losing registrar, and a sixty-day lock frequently applies following a registration, a transfer, or a change to registrant details. For .uk names, registrar changes are handled through Nominet's own process, but a provider that has placed restrictions on the account can still delay matters while the business assembles the evidence required to intervene.

Registrar lock and registry lock add genuine protection against hijacking. They also add friction to the very scenario in which you need speed. The lesson is not to avoid locks, but to know in advance who holds the credentials to remove them, and how the request is authenticated at two in the morning.

A due-diligence checklist for UK buyers

• Confirm the registrar and the actual account holder. The registrant organisation named in the public record is not the same as the party able to log in.
• Identify every nameserver in the delegation. Establish who operates each one and under what agreement.
• Obtain a full zone export. Ask for it in a standard format, and check that it includes mail, verification, and service records, not only the web entries.
• Verify registrant, administrative, and technical contacts. At least one must be a monitored mailbox inside the business.
• Document DNSSEC status. Record whether the zone is signed, who holds the keys, and what the rollover procedure is.
• Confirm registrar and registry lock status and the named individuals authorised to lift them.
• Check the TTLs on critical records. Long time-to-live values slow every migration and every emergency correction.
• Establish a break-glass route. A documented, tested path to registry-level intervention that does not depend on a single supplier responding.
• Record the contractual position on zone data. Ownership of records should be explicit, with a stated handover period and format.
• Test the exit once. A tabletop exercise is inexpensive; discovering the gap during an incident is not.

What to put in writing at renewal

The strongest position is separation: registration with one provider, DNS hosting with another, and web hosting with a third. That arrangement costs a little administrative effort and removes the single point of failure that a bundled supplier creates.

Where separation is impractical, the contract should state plainly that zone data belongs to the client, that a complete export will be provided on request within a defined period, and that delegated nameservers will be released on notice. Add a named individual on both sides, and review the arrangement annually rather than when something breaks.

The uncomfortable truth is that most UK businesses can describe their failover configuration in detail and cannot name the organisation holding their nameservers. The second question is the one that decides whether the first ever gets a chance to work.