An external zone keeps its DNS at your current provider. OpenWAF only serves the sites you add to the zone; each one reaches the edge through a record you create at your provider. Use it when the nameservers cannot change (for example, domains registered at Cloudflare Registrar) or when the DNS must stay where it is. You need the tech role or higher.
1. Add the zone
Add domain › enter the domain › Keep your current DNS (CNAME/A records) › Add domain.
openwaf-cloud ctl zones add example.com --mode external --reason "Add example.com"curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: application/json" \
-H "X-Change-Reason: Add example.com" \
-d '{"name": "example.com", "dns_mode": "external"}'Ask your assistant to add example.com as an external zone. It calls add_zone with mode: "external".
The zone starts pending, with a random verification token. Nothing is published anywhere yet.
2. Add the sites
Add one proxied record per site: the name and its origin, the server that answers it today.
openwaf-cloud ctl records add example.com type=A name=www content=203.0.113.10 proxied=true --reason "Protect www"
openwaf-cloud ctl records add example.com type=CNAME name=shop content=shops.example.net proxied=true --reason "Protect shop"An external zone only holds proxied A, AAAA and CNAME records. Mail and every other record stay at your DNS provider. In the dashboard, the wizard's Sites step and DNS › Records add them.
3. Verify ownership
Create this TXT record at your DNS provider, with the exact value shown in the dashboard (DNS › Settings › Ownership TXT record), in verification of the zone in the API, or by openwaf-cloud ctl zones show example.com:
_openwaf.example.com. TXT "openwaf-verify=<token>"Some providers append the domain automatically: then enter only _openwaf as the name. The record only proves ownership; it does not change how your site or your email work.
OpenWAF looks for it in public resolvers every few minutes. Check now (openwaf-cloud ctl zones check example.com, POST …/delegation/check, or the check_zone MCP tool) looks immediately. One resolver seeing the value is enough; a value split into several strings counts joined. When it is found, the zone becomes active and the edge serves its sites.
4. Point the sites to OpenWAF
Only once the zone is active, change each site's record at your DNS provider:
| Site | Record to create |
|---|---|
A subdomain (www, shop…) | CNAME to edge.openwaf.dev |
The apex (example.com) | A and AAAA with the edge addresses shown in DNS › Settings (edge_addresses in the API), or a CNAME to edge.openwaf.dev if your provider flattens CNAMEs at the apex |
www.example.com. CNAME edge.openwaf.dev.
shop.example.com. CNAME edge.openwaf.dev.If your provider proxies records (Cloudflare's orange cloud), set these records to DNS only (grey cloud) so visitors reach OpenWAF directly. Behind another proxy, OpenWAF only receives the traffic if that proxy forwards it to the edge.
5. Check the pointing
The domain's Overview shows, for each site, what public DNS answers today and the record to create. The same report comes from openwaf-cloud ctl zones hosts example.com, GET /v1/orgs/{org}/zones/{zone}/hosts or the zone_hosts MCP tool. See Sites not pointing to OpenWAF for each status.
Once a site points to OpenWAF, its HTTPS certificate is issued automatically within a few minutes, validated over HTTP through the edge. If another proxy sits in front, it must let /.well-known/acme-challenge/ through to OpenWAF.
After verification
A verified external zone stays active: if you delete the TXT record or point a site elsewhere, the zone keeps its status and that site simply stops reaching OpenWAF. To stop protecting a site, point it back to the origin at your provider and then delete its record in OpenWAF.
To move the whole DNS of an external zone to OpenWAF later without downtime, contact support: the conversion keeps the zone, its settings, rules and certificates.