Save the previous state
Export DNS records and record TTLs, proxy status and certificate locations. Understand A, AAAA, CNAME, MX and TXT roles. Do not remove existing mail records merely because you are launching a website.
Verify resolution and service separately
Query authoritative and recursive DNS, then check the destination port, certificate hostname and validity period. Confirm working IPv6 service before publishing an AAAA record.
Define the proxy boundary
Specify the upstream, timeouts, request size and WebSocket behavior. Trust client-address headers only from known proxies. Exclude authentication, carts and private user responses from shared caching.
Validate and retain a rollback path
Test public pages, login, uploads and mail-related records, and monitor certificate renewal. TTL does not guarantee immediate refresh by every client. Keep the previous records and certificate configuration so you can reverse one layer at a time.