Restore DNS to Gandi.net (registrar)

[Mikaela]

• [x] Disable DNSSEC
• [x] wait for 72 hours as per Gandi.net recommendation on disabling DNSSEC && change nameservers
  • export zone and import it to Gandi changing mikaela.info's CNAME to ALIAS.
• [ ] wait for another 72 hours (I bet they will ask me to do that, however the documentation says 12 to 24 hours so maybe 72 hours is just for DNSSEC) && enable DNSSEC again
  • [x] if it prevents me from doing this due to the ALIAS, change it to A records before trying again and contact feedback at gandi dot net as adviced on #gandi at freenode.
  • see also https://docs.gandi.net/en/domain_names/advanced_users/dnssec.html & https://docs.gandi.net/en/domain_names/faq/dns_records.html#what-dns-record-types-does-gandi-s-livedns-support ("...ALIAS (not yet supported with dnssec-enabled domains)...")
• [x] enable DNSSEC

[Mikaela]

The pain: minimum TTL is 300 at Gandi while Cloudflare set it to 1 (Cloudflared) or 120 (their minimum?) at times and during the import Gandi kept rejecting the zone without explaining what went wrong. Only by importing most important records and later attempting to edit in text mode I learned this and was able to import the rest.

[Mikaela]

Contacting Gandi done.

Hi,

I migrated from Cloudflare to Gandi LiveDNS earlier today and had confusion on importing my zonefile as I was getting generic error messages. I ended up copying only the most important pieces of the zonefile (@, MX, SPF) and later edited the zone in text mode to import the rest of the zone and only then the error message tells me that Cloudflare had set too short TTLs and the minimum for you is 300. Could you perform testing on transferring from external DNS servers to Gandi LiveDNS and make the too short TTL more obvious?

On another topic, do you have any plans on bringing ALIAS support to @? It would be helpful with GitHub pages. I am also interested if it will become supported with DNSSEC at some point? Cloudflare's CNAME flattening was compatible with it.

I want to also thank you for bringing one click DNSSEC, it was a feature at Cloudflare I was very happy about and I might not have transferred my DNS back to you without it.