With custom (white-label) nameservers, your organization's delegated zones publish ns1.youragency.com and ns2.youragency.com instead of the *.ns.openwaf.dev pair, and your customers set those names at their registrars. The names resolve to OpenWAF's public DNS servers, so nothing else changes. You need the admin role for the whole organization.
Set them up
Declare the names. In White label › Your own nameservers, enter the First nameserver and the Second nameserver (two different names, for example
ns1.youragency.comandns2.youragency.com) and select Save nameservers.From the CLI:
openwaf-cloud ctl whitelabel nameservers ns1.youragency.com ns2.youragency.com --reason "…". From the API:PUT /v1/orgs/{org}/whitelabel/nameserverswith{"ns": ["ns1.youragency.com", "ns2.youragency.com"]}.Prove you control the domain. Create the TXT record shown, in the DNS of
youragency.com:_openwaf-ns.youragency.com. TXT "openwaf-ns-…"The value is your organization's token, shown in the dashboard and by
openwaf-cloud ctl whitelabel show.Point the names to OpenWAF's DNS servers. Create
AandAAAArecords for both names with the addresses shown in the dashboard (the API returns them inrequired_ips). Ifyouragency.comis itself delegated to these nameservers, also create glue records with the same addresses at the registrar ofyouragency.com.Activate. Select Check now (
openwaf-cloud ctl whitelabel verify, orPOST /v1/orgs/{org}/whitelabel/nameservers/verify). OpenWAF checks the TXT record and that both names resolve to the required addresses; then the status becomes Active.
What changes when they are active
- Every delegated zone of the organization publishes your nameservers in its
NSrecords. - The delegation check accepts your nameservers as well as the organization's
*.ns.openwaf.devpair, so domains already delegated keep working while customers switch. - New domains show your nameservers in Add domain and in DNS › Settings.
Active names belong to your organization: no other organization can claim them. They stay reserved for your organization for 30 days after you stop using them (change, removal or deletion of the organization), because your customers' domains may still be delegated to them. Declaring names without activating them reserves nothing.
Stop using them
Select Remove nameservers (or openwaf-cloud ctl whitelabel nameservers - --reason "…"). Your domains publish the default pair again. Move your customers' domains back to the default pair at their registrars before you delete the records of your nameservers.