Understand what the lookup can see
Migration compares the records currently visible on the public DNS side with the records in the new zone. When a provider proxies a hostname, public DNS may reveal only the proxy address; the origin server and its intended target stay hidden. Copying that visible address into the new zone can send traffic to a proxy that does not know how to serve your domain.
The migration report separates opaque records from ordinary missing records. A missing record has a target that can be copied; an opaque one needs information from the current provider or domain owner. This is why an import can add some records while still reporting unresolved items and a migration that is not safe to switch.
Resolve opaque entries before switching
Ask the current DNS or hosting provider for the origin target, or export its authoritative zone file and use that as the import source. Review each opaque hostname against the service it supports, such as a website, API, or other endpoint. Do not guess an origin from an IP address returned by a proxy lookup.
After adding the verified target, run the migration check again and review the remaining missing, opaque, and unseen records. Switch nameservers only when the report says the change is safe and the records needed by active services are present. If an origin cannot be confirmed, keep the current nameservers in place and ask the provider for the right value.