# Custom nameservers

> Give your customers nameservers under your own domain (ns1/ns2.youragency.com) that answer with OpenWAF's DNS servers.

With custom (white-label) nameservers, your organization's delegated zones publish `ns1.youragency.com` and
`ns2.youragency.com` instead of the `*.ns.openwaf.dev` pair, and your customers set those names at their registrars.
The names resolve to OpenWAF's public DNS servers, so nothing else changes. You need the `admin` role for the whole
organization.

## Set them up

1. **Declare the names.** In **White label › Your own nameservers**, enter the **First nameserver** and the **Second
   nameserver** (two different names, for example `ns1.youragency.com` and `ns2.youragency.com`) and select
   **Save nameservers**.

   From the CLI: `openwaf-cloud ctl whitelabel nameservers ns1.youragency.com ns2.youragency.com --reason "…"`. From
   the API: `PUT /v1/orgs/{org}/whitelabel/nameservers` with `{"ns": ["ns1.youragency.com", "ns2.youragency.com"]}`.

2. **Prove you control the domain.** Create the TXT record shown, in the DNS of `youragency.com`:

   ```text
   _openwaf-ns.youragency.com.  TXT  "openwaf-ns-…"
   ```

   The value is your organization's token, shown in the dashboard and by `openwaf-cloud ctl whitelabel show`.

3. **Point the names to OpenWAF's DNS servers.** Create `A` and `AAAA` records for both names with the addresses shown
   in the dashboard (the API returns them in `required_ips`). If `youragency.com` is itself delegated to these
   nameservers, also create **glue records** with the same addresses at the registrar of `youragency.com`.

4. **Activate.** Select **Check now** (`openwaf-cloud ctl whitelabel verify`, or
   `POST /v1/orgs/{org}/whitelabel/nameservers/verify`). OpenWAF checks the TXT record and that both names resolve to
   the required addresses; then the status becomes **Active**.


## What changes when they are active

- Every delegated zone of the organization publishes your nameservers in its `NS` records.
- The [delegation check](https://developers.openwaf.dev/dns/delegate-a-zone/#follow) accepts your nameservers as well as the organization's
  `*.ns.openwaf.dev` pair, so domains already delegated keep working while customers switch.
- New domains show your nameservers in **Add domain** and in **DNS › Settings**.

Active names belong to your organization: no other organization can claim them. They stay reserved for your
organization for **30 days** after you stop using them (change, removal or deletion of the organization), because your
customers' domains may still be delegated to them. Declaring names without activating them reserves nothing.

## Stop using them

Select **Remove nameservers** (or `openwaf-cloud ctl whitelabel nameservers - --reason "…"`). Your domains publish the
default pair again. Move your customers' domains back to the default pair at their registrars **before** you delete the
records of your nameservers.