# Delegate a zone to OpenWAF

> Set your organization's nameserver pair at the registrar so OpenWAF answers for the domain, and follow the delegation until the zone is active.

In a **delegated** zone, OpenWAF's nameservers answer for every name of the domain. You delegate the domain by setting
your organization's **nameserver pair** at the registrar. You need the `tech` role or higher.

## Your nameserver pair

Every organization receives a fixed pair of names under `ns.openwaf.dev` when it is created, for example:

```text
faros.ns.openwaf.dev
polaris.ns.openwaf.dev
```

All the delegated zones of the organization use the same pair, so every client of an agency gets the same two names.
The pair never changes. If your organization has activated [custom nameservers](https://developers.openwaf.dev/dns/custom-nameservers/), use those
instead.

Find your pair in:

- the dashboard: the domain's **DNS › Settings**, or the last step of **Add domain**;
- the API: `ns_pair` in `GET /v1/orgs/{org}` and in each zone, or `nameservers` in
  `GET /v1/orgs/{org}/zones/{zone}/delegation`;
- the CLI: `openwaf-cloud ctl zones show example.com`.

## Delegate the domain

1. **Add the zone** with DNS mode `delegated` (the default). See [Add your first site](https://developers.openwaf.dev/fundamentals/add-site/#delegated).
   OpenWAF copies the records it finds in the domain's current public DNS into the zone, without proxy.
2. **Check the records** in **DNS › Records** before you switch. After the switch only the records in the zone
   resolve: compare with your current provider, especially `MX`, `TXT` (SPF, DKIM, verification records) and any
   subdomain. Use **Import** to load a BIND zone file exported from the old provider. See
   [Manage DNS records](https://developers.openwaf.dev/dns/manage-records/#import).
3. **Disable DNSSEC** at the registrar if it is enabled: remove the DS records before changing nameservers, or the
   domain stops resolving. OpenWAF does not sign zones yet.
4. **Replace all nameservers** at the registrar with exactly your two names. Remove every other entry: the delegation
   is only accepted when the registry lists exactly your pair.
5. **Wait for the registry.** The change usually takes minutes to a few hours, and up to 24–48 hours for some
   top-level domains such as `.es`.


The dashboard's last step of **Add domain** (and the domain's **Overview** while it is pending) has instructions for
common registrars: OVHcloud, GoDaddy, Namecheap, IONOS and Dondominio.

> **Caution**
>
> Cloudflare Registrar does not allow nameservers outside Cloudflare. Transfer the domain to another registrar first, or
> add it as an [external zone](https://developers.openwaf.dev/dns/external-zones/).


## Follow the delegation

OpenWAF checks pending zones every few minutes. Each check asks the servers of the parent zone (the registry) and
public resolvers which nameservers they see for the domain:

| Result | Meaning |
|---|---|
| **Delegated** | Every server answered with exactly your pair. The zone becomes **active**. |
| **Not delegated yet** | The registry answered with other nameservers (or none). |
| **Inconclusive** | Some servers did not answer or disagree, usually because the change is still propagating. An inconclusive check never changes the zone's status. |

To check immediately:

**Dashboard**

Select **Check now** in **Delegation status**. The panel shows what each server sees and refreshes every 15 seconds.
**CLI**

```sh
openwaf-cloud ctl zones check example.com
```
**API**

```sh
curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/delegation/check" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```
The answer has the zone `status` and, in `observation`, the `verdict` (`delegated`, `not_delegated` or
`inconclusive`) and the nameservers each source reported. `GET …/delegation` returns the last result without checking.
**MCP**

Ask your assistant to check the delegation of example.com. It calls `check_zone`, which needs no confirmation.


## When the zone is active

- OpenWAF's nameservers answer for the domain. Proxied names answer with the edge; the others with their content.
- Certificates for the proxied names are issued automatically.
- Turn on the proxy for the sites you want to protect: imported records start as **DNS only**. See
  [Proxied and DNS-only records](https://developers.openwaf.dev/fundamentals/proxied-and-dns-only/).

After activation OpenWAF keeps checking the delegation every hour. If the registry stops pointing to your pair, the
zone goes to **Moved away**: neither the WAF nor OpenWAF's DNS answer for it. Set the pair back at the registrar and the
next check reactivates it. A zone that stays moved for 7 days is disabled; contact support to enable it again.

> **Note**
>
> A delegated zone that is never delegated is deleted automatically 14 days after it was added. You can add it again
> later.


Problems? See [Delegation not detected](https://developers.openwaf.dev/dns/delegation-not-detected/).