# Sites not pointing to OpenWAF

> In an external zone, find out why a site does not reach the edge: the statuses ok, missing, wrong and proxied_elsewhere and how to fix each.

In an [external zone](https://developers.openwaf.dev/dns/external-zones/), each site reaches OpenWAF only if your DNS provider points it to the edge.
OpenWAF resolves every proxied name of the zone through public resolvers and reports how it points. The report is
informational: it never changes what OpenWAF serves.

**Dashboard**

The domain's **Overview** lists each site with its status, **What the DNS answers today** and the **Record to create**.
**Check again** refreshes it; **DNS › Records** shows a **Points here** column too.
**CLI**

```sh
openwaf-cloud ctl zones hosts example.com
```
**API**

```sh
curl "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/hosts" \
  -H "Authorization: Bearer $OPENWAF_TOKEN"
```
```json
{"items": [
  {"name": "www.example.com", "status": "ok", "via": "cname", "answers": ["edge.openwaf.dev"]},
  {"name": "shop.example.com", "status": "wrong", "via": "a", "answers": ["198.51.100.7"]}
 ],
 "checked_at": "2026-10-27T10:00:00Z"}
```
`via` is `cname` (the name resolved through a CNAME chain), `a` (addresses only) or empty. Calling it on a delegated
zone returns `409 zone_not_external`.
**MCP**

Ask your assistant whether the sites of example.com point to OpenWAF. It calls `zone_hosts`.


Results are reused for about a minute; public resolvers may also cache the previous answer for the record's TTL.

## Statuses

| Status | Dashboard | Meaning |
|---|---|---|
| `ok` | Points to OpenWAF | The CNAME chain reaches `edge.openwaf.dev`, or every address is an edge address. |
| `missing` | No record | The name does not exist (`NXDOMAIN`) or has no address. |
| `wrong` | Points elsewhere | The name resolves somewhere else: another address, a mix of edge and other addresses, or a CNAME that leads nowhere. |
| `proxied_elsewhere` | Behind another proxy | Every address belongs to Cloudflare's proxy (orange cloud). OpenWAF cannot confirm from outside whether that traffic reaches the edge. |

## Fix `missing`

Create the record at your DNS provider: `CNAME` to `edge.openwaf.dev` for a subdomain; at the apex, `A` and `AAAA` with
the edge addresses shown in **DNS › Settings**, or a CNAME if your provider flattens it. Check the spelling of the name:
the record must be exactly the site's name.

## Fix `wrong`

- The record still points to the origin: replace it with the CNAME (or the edge addresses at the apex).
- Old and new records coexist: at the apex, remove every `A`/`AAAA` record that is not an edge address. A mix is
  reported as `wrong` because some visitors would bypass OpenWAF.
- The CNAME points to another host name that does not lead to `edge.openwaf.dev`: point it directly to
  `edge.openwaf.dev`.

## Fix `proxied_elsewhere`

The name answers with Cloudflare addresses because the record is proxied there (orange cloud). It works only if
Cloudflare forwards that traffic to OpenWAF. Unless you intend that chain, set the record to **DNS only** (grey cloud)
so visitors reach OpenWAF directly. With Cloudflare in front, it must also let `/.well-known/acme-challenge/` through
to OpenWAF for certificates to be issued.

## The site points correctly but does not work

- **The zone is still pending.** The edge only serves active zones: publish the `_openwaf` TXT record and select
  **Check now**. See [Keep your DNS provider](https://developers.openwaf.dev/dns/external-zones/#verify).
- **No certificate yet.** Certificates are issued a few minutes after a site points to OpenWAF. See [SSL/TLS](https://developers.openwaf.dev/ssl/).
- **The origin refuses the connection.** See [SSL/TLS](https://developers.openwaf.dev/ssl/) for origin TLS errors (525/526).