dns-cutoverlisted

# dns-cutover Part of **shipsafe** — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine. Two modes: ```bash # 1) What records do I need? python3 scripts/dns_cutover.py plan <domain> <platform> # 2) Are my records right? (paste zone export or `dig +noall +answer` output into a file) python3 scripts/dns_cutover.py check <domain> <platform> <records_file> [--json] ``` Platforms: `vercel`, `netlify`, `cloudflare-pages`, `github-pages`. `check` validates apex and www records, and additionally catches the three classic cutover mistakes: - **apex CNAME** — illegal on standard DNS, silently breaks MX/email at most registrars - **stale extra A records** — round-robin traffic to the dead old host (looks like 'site randomly down') - **conflicting A + CNAME** on the same name Process to walk the user through: lower TTL to 300s the day BEFORE → run `plan` → set records → export/dig the records into a file → run `check` → only then flip. After cutover, verify HTTPS on BOTH apex and www — cert issuance is the step that fails silently. Some values are project-specific (e.g. `<yoursite>.netlify.app`); the script marks these and the user's dashboard value wins. Exit codes: 0 ok, 1 problems found. All paths below are relative to this skill's directory (dns-cutover/).