Offboarding: firewall and DNS handoff

Overview

Cutover week traps: TTL not lowered, API tokens belonging to MSP broken, or self-DMZ hole punched “temporarily” seven years ago.

Firewall

Export full config (encrypted at rest) to client vault; list admin URLs, certificate expiries, IPsec PSK rotation obligations—rotate secrets you know at handoff.

DNS

Document registrar, nameservers, all zones exported; verify DNSSEC state if used; test external propagation from multiple resolvers.

Testing

Inbound port scan optional with approval; VPN auth with client-owned accounts only; log forwarding destination flipped.

Risk

MSP locks out during argument—contract should define read-only overlap period and escrow trigger.

Final state

Client confirms support contract with new vendor active before you disable last access—CYA email.

Archive

Retain handoff bundle per legal hold policy even after client leaves—destroy schedule documented.