# Proxied records

> How OpenWAF answers proxied names with the edge, keeps the origin private and applies the proxy flag to every A, AAAA and CNAME of a name.

A **proxied** record turns its name into a site of the edge. This page explains what OpenWAF publishes for it; to
decide which names to proxy, see [Proxied and DNS-only records](https://developers.openwaf.dev/fundamentals/proxied-and-dns-only/).

## What is published

| Your record | Delegated zone publishes | The edge connects to |
|---|---|---|
| `www  A  203.0.113.10` (proxied) | `A`/`AAAA` of the edge | `203.0.113.10` |
| `www  CNAME  myapp.example.net` (proxied) | `A`/`AAAA` of the edge | `myapp.example.net` |
| `www  A  203.0.113.10` (DNS only) | `A 203.0.113.10` | — |

- The record's content is the **origin** and is never published.
- The edge answer is the address of the closest healthy edge node. Nodes are health-checked continuously; a node that
  stops answering leaves the answers and visitors move to the next one.
- Proxied names use a short TTL managed by OpenWAF (shown as **Auto** in the dashboard). Your TTL is stored and
  applies again if you turn the proxy off.
- A proxied name gets both `A` and `AAAA` answers when the edge has IPv4 and IPv6 addresses, whatever origin type you
  use.

In an [external zone](https://developers.openwaf.dev/dns/external-zones/) nothing is published by OpenWAF: your DNS provider points the name to
`edge.openwaf.dev`, and the proxied record in the zone tells the edge which origin to use.

## One proxy status per name

All the `A`, `AAAA` and `CNAME` records of a name share one proxy status. When you switch the proxy of one of them,
OpenWAF switches the others at that name in the same change. A name can have several proxied `A`/`AAAA` records (one
site with several origin addresses), or one proxied `CNAME`.

A proxied `CNAME` can coexist with `MX`, `TXT` and other records at the same name, because the name publishes the edge
addresses rather than a CNAME. An unproxied `CNAME` outside the apex must be alone at its name. See
[Coexistence rules](https://developers.openwaf.dev/dns/record-types/#coexistence).

## What cannot be proxied

- Types other than `A`, `AAAA` and `CNAME`.
- Wildcards (`*.example.com`) and names with `_`: the edge serves exact host names only.
- Mail names. Proxying them breaks email; the [email check](https://developers.openwaf.dev/dns/email-records/) reports a proxied mail name or a
  proxied MX target as an error.

## Certificates

Each proxied name gets an HTTPS certificate issued and renewed automatically by OpenWAF (Let's Encrypt). Turning the
proxy on for a new name starts the issuance; it usually takes a couple of minutes. See [SSL/TLS](https://developers.openwaf.dev/ssl/).

## Per-name settings

Each proxied name is a site that inherits the zone's edge settings and rules, and can override some of them (origin
port, WAF sensitivity, cache…). See [Per-name settings](https://developers.openwaf.dev/fundamentals/zones-names-and-sites/#per-name-settings).