In a delegated zone, OpenWAF's nameservers answer for every name of the domain. You delegate the domain by setting your organization's nameserver pair at the registrar. You need the tech role or higher.
Your nameserver pair
Every organization receives a fixed pair of names under ns.openwaf.dev when it is created, for example:
faros.ns.openwaf.dev
polaris.ns.openwaf.devAll the delegated zones of the organization use the same pair, so every client of an agency gets the same two names. The pair never changes. If your organization has activated custom nameservers, use those instead.
Find your pair in:
- the dashboard: the domain's DNS › Settings, or the last step of Add domain;
- the API:
ns_pairinGET /v1/orgs/{org}and in each zone, ornameserversinGET /v1/orgs/{org}/zones/{zone}/delegation; - the CLI:
openwaf-cloud ctl zones show example.com.
Delegate the domain
- Add the zone with DNS mode
delegated(the default). See Add your first site. OpenWAF copies the records it finds in the domain's current public DNS into the zone, without proxy. - Check the records in DNS › Records before you switch. After the switch only the records in the zone resolve: compare with your current provider, especially
MX,TXT(SPF, DKIM, verification records) and any subdomain. Use Import to load a BIND zone file exported from the old provider. See Manage DNS records. - Disable DNSSEC at the registrar if it is enabled: remove the DS records before changing nameservers, or the domain stops resolving. OpenWAF does not sign zones yet.
- Replace all nameservers at the registrar with exactly your two names. Remove every other entry: the delegation is only accepted when the registry lists exactly your pair.
- Wait for the registry. The change usually takes minutes to a few hours, and up to 24–48 hours for some top-level domains such as
.es.
The dashboard's last step of Add domain (and the domain's Overview while it is pending) has instructions for common registrars: OVHcloud, GoDaddy, Namecheap, IONOS and Dondominio.
Follow the delegation
OpenWAF checks pending zones every few minutes. Each check asks the servers of the parent zone (the registry) and public resolvers which nameservers they see for the domain:
| Result | Meaning |
|---|---|
| Delegated | Every server answered with exactly your pair. The zone becomes active. |
| Not delegated yet | The registry answered with other nameservers (or none). |
| Inconclusive | Some servers did not answer or disagree, usually because the change is still propagating. An inconclusive check never changes the zone's status. |
To check immediately:
Select Check now in Delegation status. The panel shows what each server sees and refreshes every 15 seconds.
openwaf-cloud ctl zones check example.comcurl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/delegation/check" \
-H "Authorization: Bearer $OPENWAF_TOKEN"The answer has the zone status and, in observation, the verdict (delegated, not_delegated or inconclusive) and the nameservers each source reported. GET …/delegation returns the last result without checking.
Ask your assistant to check the delegation of example.com. It calls check_zone, which needs no confirmation.
When the zone is active
- OpenWAF's nameservers answer for the domain. Proxied names answer with the edge; the others with their content.
- Certificates for the proxied names are issued automatically.
- Turn on the proxy for the sites you want to protect: imported records start as DNS only. See Proxied and DNS-only records.
After activation OpenWAF keeps checking the delegation every hour. If the registry stops pointing to your pair, the zone goes to Moved away: neither the WAF nor OpenWAF's DNS answer for it. Set the pair back at the registrar and the next check reactivates it. A zone that stays moved for 7 days is disabled; contact support to enable it again.
Problems? See Delegation not detected.