A delegated zone becomes active when every server OpenWAF asks (the servers of the parent zone, that is the registry, and public resolvers) answers with exactly your nameserver pair. Start by looking at what each one sees:
- Dashboard: the domain's Overview › Delegation status › What the DNS sees, then Check now.
- CLI:
openwaf-cloud ctl zones check example.com. - API:
POST /v1/orgs/{org}/zones/{zone}/delegation/check;observation.sourceslists each server with thensit reported, whether itmatches and anyerror.
You can also follow the delegation from the root yourself; the last NS set printed before your own servers answer is what the registry publishes:
dig +trace NS example.com
dig +short NS example.com @1.1.1.1Not delegated yet
The registry answers with other nameservers.
- The change is not saved at the registrar. Check the domain's nameserver settings again. Some registrars need a confirmation by email or show the change as “in progress” until the registry accepts it.
- The registry has not published it yet. Usually minutes to a few hours; up to 24–48 hours for some TLDs such as
.es. - Wrong names. Copy the two names exactly from DNS › Settings. If your organization uses custom nameservers, those or the
*.ns.openwaf.devpair are both accepted; nothing else. - Extra nameservers. The registry must list exactly your two names. A third name (for example one of the old provider's) makes the set different: remove every other entry at the registrar.
- The registrar is Cloudflare Registrar. It does not allow nameservers outside Cloudflare: transfer the domain, or use an external zone.
Inconclusive
Some servers did not answer, or they disagree. An inconclusive check never changes the zone's status.
- Resolvers still cache the old nameservers. The registry already shows your pair, but public resolvers keep the previous answer until its TTL expires, which can be up to a day or two for some TLDs. The zone activates on the first check after the caches expire; nothing else is needed.
- DNSSEC still enabled. If the registrar still publishes DS records from the old provider, validating resolvers fail to resolve the domain (
SERVFAIL). Remove the DS records (disable DNSSEC) at the registrar. OpenWAF does not sign zones yet. - Temporary errors. Timeouts of one server: check again in a few minutes.
Moved away
An active zone goes to Moved away when the registry no longer lists your pair, for example after a registrar reset or a transfer. Neither the WAF nor OpenWAF's DNS answer for it. Set the pair back at the registrar and select Check now: the zone becomes active again. After 7 days in Moved away the zone is disabled; contact [email protected] to enable it.
The zone disappeared
A delegated zone that is never delegated is deleted automatically 14 days after it was added. Add it again and change the nameservers.
Still stuck?
Write to [email protected] with the domain name and the output of the delegation check.