Workflow: migrating origins with zero downtime

TL;DR: Cut over DNS Update the A/AAAA records to the new origin IP. # Workflow: origin migration, zero downtime ## 1. Lower TTLs (T-24h minimum) Drop the TTL on the records you will move to 300 seconds.

Workflow: origin migration, zero downtime

1. Lower TTLs (T-24h minimum)

Drop the TTL on the records you will move to 300 seconds. Then wait out the OLD TTL: resolvers cache under the old value until it expires. This wait is the step teams skip, and skipping it is what makes migrations "not work".

2. Build and warm the new origin

Deploy the app to the new origin. Warm it: caches, connection pools, JIT. Hit it directly (bypass Cloudflare) and confirm it serves correctly, including TLS with a valid cert for Full (strict).

3. Pre-stage Cloudflare config

If the new origin needs different Origin Rules, header transforms, or cache settings, create them now against the current origin where safe, or stage them to flip with the DNS.

4. Cut over DNS

Update the A/AAAA records to the new origin IP. Keep the old origin running and answering.

5. Verify from multiple vantage points

dig against 1.1.1.1, 8.8.8.8, and a resolver on another continent. curl the site and check CF-Cache-Status and the origin behavior. Watch error rates and the 52x diagnostics: a fresh 522 right after cutover means the new origin's firewall is blocking Cloudflare IPs.

6. Decommission the old origin

Only after propagation is confirmed everywhere and traffic has been stable: then raise TTLs back up, then shut down the old origin. Keep it restorable for a week.

Checklist

• TTL down, wait, change, verify, TTL up, decommission. In that order.
• The old origin stays alive until the new one is proven, not until the DNS edit is done.

When to use

You hit exactly this: Workflow: migrating origins with zero downtime in Workflow.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Workflow (versions mentioned here: 1.1.1, 8.8.8).

Composite workflow grounded in verified docs: DNS TTL propagation behavior, Error 522 firewall causes (new origin blocking Cloudflare IPs), Origin Rules for per-request origin overrides, CF-Cache-Status verification. Refs: https://developers.cloudflare.com/dns/manage-dns-records/how-to/create-dns-records/ , https://developers.cloudflare.com/support/troubleshooting/http-status-codes/cloudflare-5xx-errors/error-522/ , https://developers.cloudflare.com/rules/origin-rules/