In an external zone, each site reaches OpenWAF only if your DNS provider points it to the edge. OpenWAF resolves every proxied name of the zone through public resolvers and reports how it points. The report is informational: it never changes what OpenWAF serves.
The domain's Overview lists each site with its status, What the DNS answers today and the Record to create. Check again refreshes it; DNS › Records shows a Points here column too.
openwaf-cloud ctl zones hosts example.comcurl "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/hosts" \
-H "Authorization: Bearer $OPENWAF_TOKEN"{"items": [
{"name": "www.example.com", "status": "ok", "via": "cname", "answers": ["edge.openwaf.dev"]},
{"name": "shop.example.com", "status": "wrong", "via": "a", "answers": ["198.51.100.7"]}
],
"checked_at": "2026-10-27T10:00:00Z"}via is cname (the name resolved through a CNAME chain), a (addresses only) or empty. Calling it on a delegated zone returns 409 zone_not_external.
Ask your assistant whether the sites of example.com point to OpenWAF. It calls zone_hosts.
Results are reused for about a minute; public resolvers may also cache the previous answer for the record's TTL.
Statuses
| Status | Dashboard | Meaning |
|---|---|---|
ok | Points to OpenWAF | The CNAME chain reaches edge.openwaf.dev, or every address is an edge address. |
missing | No record | The name does not exist (NXDOMAIN) or has no address. |
wrong | Points elsewhere | The name resolves somewhere else: another address, a mix of edge and other addresses, or a CNAME that leads nowhere. |
proxied_elsewhere | Behind another proxy | Every address belongs to Cloudflare's proxy (orange cloud). OpenWAF cannot confirm from outside whether that traffic reaches the edge. |
Fix missing
Create the record at your DNS provider: CNAME to edge.openwaf.dev for a subdomain; at the apex, A and AAAA with the edge addresses shown in DNS › Settings, or a CNAME if your provider flattens it. Check the spelling of the name: the record must be exactly the site's name.
Fix wrong
- The record still points to the origin: replace it with the CNAME (or the edge addresses at the apex).
- Old and new records coexist: at the apex, remove every
A/AAAArecord that is not an edge address. A mix is reported aswrongbecause some visitors would bypass OpenWAF. - The CNAME points to another host name that does not lead to
edge.openwaf.dev: point it directly toedge.openwaf.dev.
Fix proxied_elsewhere
The name answers with Cloudflare addresses because the record is proxied there (orange cloud). It works only if Cloudflare forwards that traffic to OpenWAF. Unless you intend that chain, set the record to DNS only (grey cloud) so visitors reach OpenWAF directly. With Cloudflare in front, it must also let /.well-known/acme-challenge/ through to OpenWAF for certificates to be issued.
The site points correctly but does not work
- The zone is still pending. The edge only serves active zones: publish the
_openwafTXT record and select Check now. See Keep your DNS provider. - No certificate yet. Certificates are issued a few minutes after a site points to OpenWAF. See SSL/TLS.
- The origin refuses the connection. See SSL/TLS for origin TLS errors (525/526).