l*stname.

Last name standing.

Number portability for your domain name. Lostname proves you can leave your DNS provider before you have to, and shows what would break if you left today.

Read the code on GitHub See what it checks 

$ lostname lint --zone lostname.be.zone --origin lostname.be
L-07  note    lostname.be. CAA: CAA issue "letsencrypt.org" has no accounturi: any account at that CA may issue (RFC 8657)
lint pass: lostname.be., 17 record(s), 0 blocker(s), 0 risk(s), 1 note(s)
This site's own domain, checked by Lostname on 6 November 2026. The note stands: GitHub requests the certificate, so the account can't be pinned.

Moving DNS breaks things quietly

You can keep your phone number when you switch operators. Domains have no such guarantee. A move between DNS providers can:

Most owners find out during the move. Lostname finds out before it.

What lint catches

A test zone with the usual traps. Every finding names the record, the reason and the RFC; a blocker fails the run.

$ lostname lint --zone broken.example.test.zone --origin example.test
L-08  blocker www.example.test. CNAME: CNAME next to other data (TXT) (RFC 1034 3.6.2, RFC 2181 10.1)
L-09  blocker sub.example.test. NS: delegation to ns.sub.example.test. needs glue, and the zone has no A or AAAA for it (RFC 9471 3.1)
L-14  risk    example.test. CAA: critical CAA tag "tbs" is not a registered tag: a CA must refuse to issue (RFC 8659 4.1)
L-15  risk    example.test. NS: the apex has fewer than two NS records (RFC 1034 4.1)
L-18  risk    example.test. MX: MX points at mail.example.test., which is a CNAME (RFC 2181 10.3)
lint fail: example.test., 12 record(s), 2 blocker(s), 5 risk(s), 1 note(s)

Shortened: three of the eight findings are left out. Run it yourself on internal/lint/testdata.

From a lint to a yearly drill

  1. v0.1

    Know what won't move

    lint --to <provider> lists what will not survive a move to that provider. parity checks that two providers answer every query the same, authoritatively.

    In progress: lint, fetch and parity work today, DNSSEC parity is next.

  2. v0.2

    Plan the move and see it first

    plan --from A --to B gives the safe order of steps, DNSSEC included, with waits computed from your real TTLs: your exit time. simulate shows what any resolver would see at every step, and what goes wrong if a step fails.

  3. v0.3

    Rehearse it every year

    drill runs the exit exercise; report leaves the evidence to show for it.

How it behaves

No verdict without authority
A check that didn't get an authoritative answer from every server it compares says "no verdict", never "all clear".
Read-only, and the owner acts
Lostname never opens your credentials file and never operates DNS for anyone.
Builds on what exists
DNSControl does export, import and push. Lostname calls the official, pinned binary and adds what it lacks.
Evidence as a by-product
Every finding says what was seen, where, when and by which version. Every run leaves a bundle with a checksum manifest.

Try it

Pre-release, published early: not for production yet. With Go installed, from a clone of the repository:

$ go run ./cmd/lostname lint --zone example.zone --origin example.com

Once released: go install lostname.be/lostname/cmd/lostname@latest