# DNS

> Authoritative DNS on your own nameserver pair, or keep your DNS provider and point sites with a CNAME. Every record change is versioned.

OpenWAF DNS answers for your domains from authoritative servers in Germany, with a fixed pair of nameservers for your
organization. Proxied names answer with the closest healthy edge node, so their traffic goes through the WAF; DNS-only
records answer exactly as you write them. If a domain has to keep its DNS elsewhere, add it as an external zone and
point each site at OpenWAF with a CNAME.

Every change to a zone's records is a new version with its author, reason and diff, and can be rolled back.

## Get started

- [Delegate a zone to OpenWAF](https://developers.openwaf.dev/dns/delegate-a-zone/): Set your organization's nameserver pair at the registrar.
- [Keep your DNS provider](https://developers.openwaf.dev/dns/external-zones/): Verify the domain with a TXT record and point sites with a CNAME.


## Concepts

- [Delegated and external zones](https://developers.openwaf.dev/dns/dns-modes/): The two DNS modes and the life cycle of a zone.
- [Proxied records](https://developers.openwaf.dev/dns/proxied-records/): How proxied names are answered and what happens to the origin.
- [Zone versions](https://developers.openwaf.dev/dns/zone-versions/): Every change is a version: simulate, apply, roll back.


## How-to

- [Manage DNS records](https://developers.openwaf.dev/dns/manage-records/): Create, edit, delete, import and export records.
- [Batch changes](https://developers.openwaf.dev/dns/batch-changes/): Up to 500 creates, updates and deletes as one all-or-nothing change.
- [Move sites between zones](https://developers.openwaf.dev/dns/move-sites/): Merge a subdomain zone into the zone of its domain.
- [Check email records](https://developers.openwaf.dev/dns/email-records/): MX, SPF lookups, DKIM and DMARC as the world sees them.
- [Custom nameservers](https://developers.openwaf.dev/dns/custom-nameservers/): Nameservers under your own domain.


## Reference

- [Record types and validation](https://developers.openwaf.dev/dns/record-types/): Supported types, content formats, TTL and coexistence rules.
- [Error codes](https://developers.openwaf.dev/dns/error-codes/): The errors the API returns for zones and records.


## Troubleshooting

- [Delegation not detected](https://developers.openwaf.dev/dns/delegation-not-detected/): The zone stays pending after changing nameservers.
- [Sites not pointing to OpenWAF](https://developers.openwaf.dev/dns/external-hosts-not-pointing/): Statuses ok, missing, wrong and proxied_elsewhere.