A CDN migration is a DNS change wearing a project plan. Done in stages it is boring; done as a single switch it is a gamble with your peak traffic. This is the staged sequence, with the checks that must pass before each step.
Stage 0 — parity before traffic
Stand the new CDN up on a test hostname against your production origin. Verify byte-for-byte parity on your top 50 URLs: status codes, response bodies, and headers — especially Cache-Control, Vary, CORS headers, and any security headers you set at the edge. Diff, don’t eyeball: curl -s -D- both hostnames and compare programmatically.
Recreate edge logic explicitly: redirects, rewrites, signed URLs, geo rules, custom error pages. Every provider expresses these differently, and unmigrated edge logic is the most common cutover-day surprise.
Stage 1 — TLS and DNS preparation
Issue certificates on the new provider for every hostname before any traffic moves, and confirm the full chain with an external checker. Drop your DNS TTL on the affected records to 300 seconds at least 48 hours before cutover — long TTLs are why “rollbacks” take a day. If you use CAA records, add the new provider’s CA before certificate issuance, not after it fails.
Stage 2 — warm the cache
A cold CDN turns cutover hour into a self-inflicted origin stress test. Replay your top URLs against the new edge from each major region (your access logs are the crawl list), sized to reach roughly 80% of your steady-state hit ratio. Confirm your origin has headroom for the residual miss traffic — the misses concentrate in the first hour.
Stage 3 — ramp, don't switch
Move traffic in weighted steps: 5% → 25% → 50% → 100%, using weighted DNS or your traffic manager, holding each step for at least one traffic peak. At each hold, compare the new provider against the old on the same dashboard: p95 TTFB by region, error rate, cache-hit ratio, and origin request rate. Advance only when all four are at parity or better.
Stage 4 — rollback triggers, written in advance
Decide the abort thresholds before the ramp, when nobody is stressed: for example, error rate above 0.5% for 10 minutes, p95 TTFB regression above 30% in any top region, or origin load above 70% of capacity. Rollback is a DNS weight change back to the old provider — which is why the old contract must stay live through the migration window; parallel-running costs one overlapping month and buys you the abort button.
Stage 5 — the week after
Keep the old configuration frozen but live for 7–14 days. Watch the long tail: sitemap-driven crawlers, payment callbacks, and old mobile-app versions pin hostnames and IPs in ways browsers do not. Then, and only then, schedule the old contract’s termination per its notice clause — which you calendared when you signed it.