Short answer: store the provider's DNS zone ID with the application's zone inventory, but treat it as a replaceable external reference, never as the primary key for the domain or its records. Resolve every record operation through a stable application-owned zone key, verify that the returned zone still represents the expected domain, and reconcile desired MX records against published DNS before declaring a logistics mail cutover complete. That separation is the difference between remembering ...