Start with the delegation
Install the DNS diagnostic tools for your Debian release. Query the zone delegation, then query each authoritative server directly. A correct answer from one secondary does not establish that the entire delegation is healthy. Compare the SOA serial and inspect failures before changing caches or TTLs.
dig myswift.co.uk NS +short
dig myswift.co.uk SOA
dig +trace myswift.co.uk
# Replace ns.example.net with each actual authoritative server:
dig @ns.example.net myswift.co.uk SOA +norecurseValidate and reload deliberately
Back up the zone file, make the intended record changes and increment its serial using the zone’s existing convention. Validate the configuration and zone before reloading. Substitute your real zone path below. Read the service logs if validation or transfer fails; avoid publishing an invalid zone and hoping a reload fixes it.
sudo named-checkconf
sudo named-checkzone myswift.co.uk /path/to/actual/zonefile
sudo rndc reload myswift.co.uk
sudo journalctl -u named --since "10 minutes ago"Check both address families
A hostname with an AAAA record commits you to reachable IPv6 service. Check routing, firewall rules and listening sockets as well as DNS. These example service names are retained from the v2 notes; confirm they are intended to exist before adding or changing them.
dig @1.1.1.1 imap.myswift.co.uk A +short
dig @1.1.1.1 imap.myswift.co.uk AAAA +short
dig @1.1.1.1 smtp.myswift.co.uk A +short
dig @1.1.1.1 smtp.myswift.co.uk AAAA +shortKeep an operational record
Record the intended before/after answers, zone serial, change time and TTL. Cached negative answers can outlive a correction, so compare authoritative answers with recursive ones. For configuration syntax and reload behaviour, use the ISC BIND 9 Administrator Reference Manual matching your installed version. Mail routing and TLS validation require their own checks beyond A/AAAA answers.