# Keep your DNS provider (external zones)

> Protect sites without changing nameservers. Verify the domain with a _openwaf TXT record, then point each site to edge.openwaf.dev with a CNAME.

An **external** zone keeps its DNS at your current provider. OpenWAF only serves the sites you add to the zone; each
one reaches the edge through a record you create at your provider. Use it when the nameservers cannot change (for
example, domains registered at Cloudflare Registrar) or when the DNS must stay where it is. You need the `tech` role or
higher.

## 1. Add the zone

**Dashboard**

**Add domain** › enter the domain › **Keep your current DNS (CNAME/A records)** › **Add domain**.
**CLI**

```sh
openwaf-cloud ctl zones add example.com --mode external --reason "Add example.com"
```
**API**

```sh
curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Change-Reason: Add example.com" \
  -d '{"name": "example.com", "dns_mode": "external"}'
```
**MCP**

Ask your assistant to add example.com as an external zone. It calls `add_zone` with `mode: "external"`.


The zone starts **pending**, with a random verification token. Nothing is published anywhere yet.

## 2. Add the sites

Add one proxied record per site: the name and its origin, the server that answers it today.

```sh
openwaf-cloud ctl records add example.com type=A name=www content=203.0.113.10 proxied=true --reason "Protect www"
openwaf-cloud ctl records add example.com type=CNAME name=shop content=shops.example.net proxied=true --reason "Protect shop"
```

An external zone only holds proxied `A`, `AAAA` and `CNAME` records. Mail and every other record stay at your DNS
provider. In the dashboard, the wizard's **Sites** step and **DNS › Records** add them.

## 3. Verify ownership

Create this TXT record at your DNS provider, with the exact value shown in the dashboard (**DNS › Settings ›
Ownership TXT record**), in `verification` of the zone in the API, or by `openwaf-cloud ctl zones show example.com`:

```text
_openwaf.example.com.  TXT  "openwaf-verify=<token>"
```

Some providers append the domain automatically: then enter only `_openwaf` as the name. The record only proves
ownership; it does not change how your site or your email work.

OpenWAF looks for it in public resolvers every few minutes. **Check now** (`openwaf-cloud ctl zones check example.com`,
`POST …/delegation/check`, or the `check_zone` MCP tool) looks immediately. One resolver seeing the value is enough; a
value split into several strings counts joined. When it is found, the zone becomes **active** and the edge serves its
sites.

> **Note**
>
> Without this proof anyone could add a domain whose DNS still points to OpenWAF from a previous setup and serve its
> names. A zone that is never verified is deleted automatically 14 days after it was added.


## 4. Point the sites to OpenWAF

Only once the zone is **active**, change each site's record at your DNS provider:

| Site | Record to create |
|---|---|
| A subdomain (`www`, `shop`…) | `CNAME` to `edge.openwaf.dev` |
| The apex (`example.com`) | `A` and `AAAA` with the edge addresses shown in **DNS › Settings** (`edge_addresses` in the API), or a `CNAME` to `edge.openwaf.dev` if your provider flattens CNAMEs at the apex |

```text
www.example.com.   CNAME  edge.openwaf.dev.
shop.example.com.  CNAME  edge.openwaf.dev.
```

> **Caution**
>
> A site pointed to OpenWAF before the zone is active stops working until it is: the edge only serves active zones.


If your provider proxies records (Cloudflare's orange cloud), set these records to **DNS only** (grey cloud) so visitors
reach OpenWAF directly. Behind another proxy, OpenWAF only receives the traffic if that proxy forwards it to the edge.

## 5. Check the pointing

The domain's **Overview** shows, for each site, what public DNS answers today and the record to create. The same
report comes from `openwaf-cloud ctl zones hosts example.com`, `GET /v1/orgs/{org}/zones/{zone}/hosts` or the
`zone_hosts` MCP tool. See [Sites not pointing to OpenWAF](https://developers.openwaf.dev/dns/external-hosts-not-pointing/) for each status.

Once a site points to OpenWAF, its HTTPS certificate is issued automatically within a few minutes, validated over HTTP
through the edge. If another proxy sits in front, it must let `/.well-known/acme-challenge/` through to OpenWAF.

## After verification

A verified external zone stays active: if you delete the TXT record or point a site elsewhere, the zone keeps its
status and that site simply stops reaching OpenWAF. To stop protecting a site, point it back to the origin at your
provider and then delete its record in OpenWAF.

To move the whole DNS of an external zone to OpenWAF later without downtime, contact support: the conversion keeps the
zone, its settings, rules and certificates.