# Delegated and external zones

> The two DNS modes of a zone, what each one stores and publishes, and the statuses a zone goes through from pending to active.

Every zone has a **DNS mode**, chosen when it is added: `delegated` or `external`.

| | `delegated` | `external` |
|---|---|---|
| Who answers DNS for the domain | OpenWAF's nameservers | Your DNS provider |
| Records in the zone | The whole DNS of the domain: any [supported type](https://developers.openwaf.dev/dns/record-types/), proxied or DNS only | Only the sites: proxied `A`, `AAAA` and `CNAME` records |
| How a site reaches the edge | Its proxied record answers with the edge | Your provider points it to `edge.openwaf.dev` (or the edge addresses at the apex) |
| Proof of control | The registry delegates the domain to your nameserver pair | A TXT record `_openwaf.<zone>` with the zone's token |
| Certificates | Issued automatically, validated through OpenWAF's DNS | Issued automatically, validated over HTTP through the edge |
| [Email check](https://developers.openwaf.dev/dns/email-records/) | Compares the zone with what the world sees, and can apply fixes | Shows what to create at your provider |
| Set up | [Delegate a zone](https://developers.openwaf.dev/dns/delegate-a-zone/) | [Keep your DNS provider](https://developers.openwaf.dev/dns/external-zones/) |

Choose **delegated** when you can change the nameservers: everything lives in one place, every record is versioned and
the edge answers are health-checked. Choose **external** when the nameservers cannot change or the DNS has to stay
with its current provider.

## Zone status

| Status | Dashboard | Meaning |
|---|---|---|
| `pending` | Pending | Waiting for the delegation (delegated) or the verification TXT record (external). The edge does not serve it yet. Deleted automatically after 14 days. |
| `active` | Active | Served by the edge. A delegated zone's records are published by OpenWAF's nameservers. |
| `moved` | Moved away | A delegated zone whose registry no longer lists your pair. Neither the WAF nor OpenWAF's DNS answer for it. Setting the pair back reactivates it. |
| `disabled` | Disabled | Not served and, for a delegated zone, not published. A zone moved away for 7 days becomes disabled; contact support to enable it again. |

```text
pending ──delegated──▶ active ──not delegated──▶ moved ──delegated──▶ active
                                                  │
                                                  └─ 7 days not delegated ──▶ disabled
```

A check that cannot conclude (servers not answering, or disagreeing while a change propagates) never changes the
status. A verified external zone stays active even if its TXT record is later removed.

## Why the proof of control

OpenWAF only serves domains whose owner has proved control: the delegation for delegated zones, the TXT record for
external ones. Otherwise someone could add a domain that still points to OpenWAF from a previous setup and serve its
names. For the same reason a domain can only be added once on the platform, and a domain that is a parent or a
subdomain of one managed by another organization is refused (`409 zone_overlaps`).

## Changing the mode

The mode is chosen when the zone is added. To move an external zone to OpenWAF's DNS without downtime, contact
[support@openwaf.dev](mailto:support@openwaf.dev): the conversion keeps the zone, its versions, settings, rules and
certificates, and the sites keep working through both DNS providers until the registry switches.