# Workflow: origin migration, zero downtime

## 1. Lower TTLs (T-24h minimum)

Drop the TTL on the records you will move to 300 seconds. Then wait out the OLD TTL: resolvers cache under the old value until it expires. This wait is the step teams skip, and skipping it is what makes migrations "not work".

## 2. Build and warm the new origin

Deploy the app to the new origin. Warm it: caches, connection pools, JIT. Hit it directly (bypass Cloudflare) and confirm it serves correctly, including TLS with a valid cert for Full (strict).

## 3. Pre-stage Cloudflare config

If the new origin needs different Origin Rules, header transforms, or cache settings, create them now against the current origin where safe, or stage them to flip with the DNS.

## 4. Cut over DNS

Update the A/AAAA records to the new origin IP. Keep the old origin running and answering.

## 5. Verify from multiple vantage points

`dig` against 1.1.1.1, 8.8.8.8, and a resolver on another continent. `curl` the site and check `CF-Cache-Status` and the origin behavior. Watch error rates and the 52x diagnostics: a fresh 522 right after cutover means the new origin's firewall is blocking Cloudflare IPs.

## 6. Decommission the old origin

Only after propagation is confirmed everywhere and traffic has been stable: then raise TTLs back up, then shut down the old origin. Keep it restorable for a week.

## Checklist

- TTL down, wait, change, verify, TTL up, decommission. In that order.
- The old origin stays alive until the new one is proven, not until the DNS edit is done.