A proxied record turns its name into a site of the edge. This page explains what OpenWAF publishes for it; to decide which names to proxy, see Proxied and DNS-only records.
What is published
| Your record | Delegated zone publishes | The edge connects to |
|---|---|---|
www A 203.0.113.10 (proxied) | A/AAAA of the edge | 203.0.113.10 |
www CNAME myapp.example.net (proxied) | A/AAAA of the edge | myapp.example.net |
www A 203.0.113.10 (DNS only) | A 203.0.113.10 | — |
- The record's content is the origin and is never published.
- The edge answer is the address of the closest healthy edge node. Nodes are health-checked continuously; a node that stops answering leaves the answers and visitors move to the next one.
- Proxied names use a short TTL managed by OpenWAF (shown as Auto in the dashboard). Your TTL is stored and applies again if you turn the proxy off.
- A proxied name gets both
AandAAAAanswers when the edge has IPv4 and IPv6 addresses, whatever origin type you use.
In an external zone nothing is published by OpenWAF: your DNS provider points the name to edge.openwaf.dev, and the proxied record in the zone tells the edge which origin to use.
One proxy status per name
All the A, AAAA and CNAME records of a name share one proxy status. When you switch the proxy of one of them, OpenWAF switches the others at that name in the same change. A name can have several proxied A/AAAA records (one site with several origin addresses), or one proxied CNAME.
A proxied CNAME can coexist with MX, TXT and other records at the same name, because the name publishes the edge addresses rather than a CNAME. An unproxied CNAME outside the apex must be alone at its name. See Coexistence rules.
What cannot be proxied
- Types other than
A,AAAAandCNAME. - Wildcards (
*.example.com) and names with_: the edge serves exact host names only. - Mail names. Proxying them breaks email; the email check reports a proxied mail name or a proxied MX target as an error.
Certificates
Each proxied name gets an HTTPS certificate issued and renewed automatically by OpenWAF (Let's Encrypt). Turning the proxy on for a new name starts the issuance; it usually takes a couple of minutes. See SSL/TLS.
Per-name settings
Each proxied name is a site that inherits the zone's edge settings and rules, and can override some of them (origin port, WAF sensitivity, cache…). See Per-name settings.