# Delegation not detected

> Your zone stays pending or inconclusive after changing nameservers. Find what the registry and resolvers see and fix the usual causes.

A delegated zone becomes active when **every** server OpenWAF asks (the servers of the parent zone, that is the
registry, and public resolvers) answers with **exactly** your nameserver pair. Start by looking at what each one sees:

- Dashboard: the domain's **Overview** › **Delegation status** › **What the DNS sees**, then **Check now**.
- CLI: `openwaf-cloud ctl zones check example.com`.
- API: `POST /v1/orgs/{org}/zones/{zone}/delegation/check`; `observation.sources` lists each server with the `ns` it
  reported, whether it `match`es and any `error`.

You can also follow the delegation from the root yourself; the last `NS` set printed before your own servers answer
is what the registry publishes:

```sh
dig +trace NS example.com
dig +short NS example.com @1.1.1.1
```

## Not delegated yet

The registry answers with other nameservers.

- **The change is not saved at the registrar.** Check the domain's nameserver settings again. Some registrars need a
  confirmation by email or show the change as “in progress” until the registry accepts it.
- **The registry has not published it yet.** Usually minutes to a few hours; up to 24–48 hours for some TLDs such as
  `.es`.
- **Wrong names.** Copy the two names exactly from **DNS › Settings**. If your organization uses
  [custom nameservers](https://developers.openwaf.dev/dns/custom-nameservers/), those or the `*.ns.openwaf.dev` pair are both accepted; nothing else.
- **Extra nameservers.** The registry must list exactly your two names. A third name (for example one of the old
  provider's) makes the set different: remove every other entry at the registrar.
- **The registrar is Cloudflare Registrar.** It does not allow nameservers outside Cloudflare: transfer the domain, or
  use an [external zone](https://developers.openwaf.dev/dns/external-zones/).

## Inconclusive

Some servers did not answer, or they disagree. An inconclusive check never changes the zone's status.

- **Resolvers still cache the old nameservers.** The registry already shows your pair, but public resolvers keep the
  previous answer until its TTL expires, which can be up to a day or two for some TLDs. The zone activates on the first
  check after the caches expire; nothing else is needed.
- **DNSSEC still enabled.** If the registrar still publishes DS records from the old provider, validating resolvers
  fail to resolve the domain (`SERVFAIL`). Remove the DS records (disable DNSSEC) at the registrar. OpenWAF does not
  sign zones yet.
- **Temporary errors.** Timeouts of one server: check again in a few minutes.

## Moved away

An active zone goes to **Moved away** when the registry no longer lists your pair, for example after a registrar
reset or a transfer. Neither the WAF nor OpenWAF's DNS answer for it. Set the pair back at the registrar and select
**Check now**: the zone becomes active again. After 7 days in **Moved away** the zone is disabled; contact
[support@openwaf.dev](mailto:support@openwaf.dev) to enable it.

## The zone disappeared

A delegated zone that is never delegated is deleted automatically 14 days after it was added. Add it again and change
the nameservers.

## Still stuck?

Write to [support@openwaf.dev](mailto:support@openwaf.dev) with the domain name and the output of the delegation check.