Use an account with read access to the relevant zones. Check whether the provider offers an authenticated export or list-records API. Store the inventory with access controls because it can reveal internal naming, service relationships and verification tokens.

1. List every zone and its authoritative provider, registration owner and delegated children. Identify the correct account before exporting records.
2. Use the provider's supported export or read-only API when available. Follow pagination to completion and compare the returned count with the dashboard; a first page is not a complete backup.
3. If export is unavailable, record each owner name, type, value set, TTL and additional fields such as MX priority or SRV weight/port. Preserve exact punctuation and long TXT values.
4. Record features that a plain zone file may omit: proxying, flattening, routing policies, health checks, templates, DNSSEC state, parent DS and registrar glue.
5. Review the inventory after a controlled change and retain dated versions. Before a migration, validate it against the source and check which features the destination can actually represent.

When a DNS provider offers no export button, keep a reviewed CSV inventory in protected storage. Use fully qualified names and preserve priority, TTL and the exact value. This small illustration covers only a website and mail route, not a complete production zone.

name,type,ttl,priority,value
example.com.,A,300,,192.0.2.10
www.example.com.,CNAME,300,,example.com.
example.com.,MX,3600,10,mail.example.com.
mail.example.com.,A,3600,,192.0.2.25

Read the result: Each row maps to one record. Record both ends of an alias and every member of a multi-value record set. Add separate fields where the record type needs them, such as SRV weight and port. CSV quoting is required when a value contains a comma or quotation mark.

Inventory hidden verification, mail-authentication and delegated-subdomain records from the authenticated panel. Public lookups do not reliably enumerate an entire zone. Validate the imported result record by record before switching to the replacement DNS service.

Compare representative website, mail, wildcard, delegated-child and verification records against authoritative answers. Check API page counts and confirm the intended provider-specific behaviour is documented.

Public DNS queries cannot reliably enumerate all names in a zone. An ANY query is not an export, and an unauthorised zone transfer should not be enabled to make backup easier. Use authorised provider access or request an export from support.

• Prepare a reversible DNS change with an exact before-and-after record list
• Move a signed domain to another DNS provider without a stale DS record
• Build a domain portfolio inventory with accountable owners and recovery contacts
• Review unexplained DNS changes and recover control of the authorised account

• Cloudflare: importing and exporting DNS
• RFC 8482
• RFC 5936

• ISC BIND: dig and delv reference