OpenWAF DNS answers for your domains from authoritative servers in Germany, with a fixed pair of nameservers for your organization. Proxied names answer with the closest healthy edge node, so their traffic goes through the WAF; DNS-only records answer exactly as you write them. If a domain has to keep its DNS elsewhere, add it as an external zone and point each site at OpenWAF with a CNAME.
Every change to a zone's records is a new version with its author, reason and diff, and can be rolled back.
Get started
Delegate a zone to OpenWAFSet your organization's nameserver pair at the registrar.Keep your DNS providerVerify the domain with a TXT record and point sites with a CNAME.
Concepts
Delegated and external zonesThe two DNS modes and the life cycle of a zone.Proxied recordsHow proxied names are answered and what happens to the origin.Zone versionsEvery change is a version: simulate, apply, roll back.
How-to
Manage DNS recordsCreate, edit, delete, import and export records.Batch changesUp to 500 creates, updates and deletes as one all-or-nothing change.Move sites between zonesMerge a subdomain zone into the zone of its domain.Check email recordsMX, SPF lookups, DKIM and DMARC as the world sees them.Custom nameserversNameservers under your own domain.
Reference
Record types and validationSupported types, content formats, TTL and coexistence rules.Error codesThe errors the API returns for zones and records.