add domain-only flag to dns_migrate
don't migrate invalid ranges
a bit more useful error messages