Write the decision before changing the system
This guide is a planning exercise for an application operator. It does not represent a PrivacyNodes deployment, support action or measured customer result. Write the old and new endpoint, TLS certificate owner, health response and return condition before lowering a DNS TTL. Existing connections and resolver caches can outlive an intended change window.
Rehearse the change with controlled inputs
Publish the new target only after it serves an authenticated synthetic request and a controlled error. Observe both hostnames from more than one resolver and keep the previous endpoint capable of the documented return path.
Use synthetic requests and test identities while checking the change. Do not expose secrets or customer data in a command, log excerpt or support note.
Verify the outcome and record the remaining limit
Record UTC timestamps, observed answers, certificate names and the decision to complete or return. A low TTL is a cache hint, not an instantaneous cutover guarantee.
Capture UTC time, artifact or configuration revision, redacted symptoms and the next owner.
Official reference
This source was reviewed for the technical boundary in this guide; it does not document a PrivacyNodes test or provider capability.