Every zone has a DNS mode, chosen when it is added: delegated or external.
delegated | external | |
|---|---|---|
| Who answers DNS for the domain | OpenWAF's nameservers | Your DNS provider |
| Records in the zone | The whole DNS of the domain: any supported type, proxied or DNS only | Only the sites: proxied A, AAAA and CNAME records |
| How a site reaches the edge | Its proxied record answers with the edge | Your provider points it to edge.openwaf.dev (or the edge addresses at the apex) |
| Proof of control | The registry delegates the domain to your nameserver pair | A TXT record _openwaf.<zone> with the zone's token |
| Certificates | Issued automatically, validated through OpenWAF's DNS | Issued automatically, validated over HTTP through the edge |
| Email check | Compares the zone with what the world sees, and can apply fixes | Shows what to create at your provider |
| Set up | Delegate a zone | Keep your DNS provider |
Choose delegated when you can change the nameservers: everything lives in one place, every record is versioned and the edge answers are health-checked. Choose external when the nameservers cannot change or the DNS has to stay with its current provider.
Zone status
| Status | Dashboard | Meaning |
|---|---|---|
pending | Pending | Waiting for the delegation (delegated) or the verification TXT record (external). The edge does not serve it yet. Deleted automatically after 14 days. |
active | Active | Served by the edge. A delegated zone's records are published by OpenWAF's nameservers. |
moved | Moved away | A delegated zone whose registry no longer lists your pair. Neither the WAF nor OpenWAF's DNS answer for it. Setting the pair back reactivates it. |
disabled | Disabled | Not served and, for a delegated zone, not published. A zone moved away for 7 days becomes disabled; contact support to enable it again. |
pending ──delegated──▶ active ──not delegated──▶ moved ──delegated──▶ active
│
└─ 7 days not delegated ──▶ disabledA check that cannot conclude (servers not answering, or disagreeing while a change propagates) never changes the status. A verified external zone stays active even if its TXT record is later removed.
Why the proof of control
OpenWAF only serves domains whose owner has proved control: the delegation for delegated zones, the TXT record for external ones. Otherwise someone could add a domain that still points to OpenWAF from a previous setup and serve its names. For the same reason a domain can only be added once on the platform, and a domain that is a parent or a subdomain of one managed by another organization is refused (409 zone_overlaps).
Changing the mode
The mode is chosen when the zone is added. To move an external zone to OpenWAF's DNS without downtime, contact [email protected]: the conversion keeps the zone, its versions, settings, rules and certificates, and the sites keep working through both DNS providers until the registry switches.