Every record is validated when it is created or changed, in the dashboard, the API, the CLI and the MCP server alike. A rejected record answers 422 invalid with the field at fault and a message. See Error codes.
Supported types
| Type | Content | Example | Proxiable |
|---|---|---|---|
A | IPv4 address | 203.0.113.10 | Yes |
AAAA | IPv6 address | 2001:db8::10 | Yes |
CNAME | Host name; cannot point to itself | myapp.example.net | Yes |
MX | Mail server host name, or . for a null MX; needs priority | mx1.example.net | No |
TXT | Text without quotes, up to 4,096 bytes of UTF-8 | v=spf1 include:_spf.example.net -all | No |
NS | Name server of a delegated subdomain (not at the apex) | ns1.provider.net | No |
SRV | weight port target; needs priority | 5 5060 sip.example.com | No |
CAA | flags tag "value" | 0 issue "letsencrypt.org" | No |
Any other type is refused: unsupported record type (A, AAAA, CNAME, MX, TXT, NS, SRV, CAA).
Format details:
A/AAAA: the address must match the type (an IPv4-mapped IPv6 address is not accepted asAAAA). It is stored in canonical form.- Host names (
CNAME,MX,NS,SRVtargets) are stored in lower case without the final dot. TXT: write the text without quotes. Long values are split into 255-byte strings automatically when published.SRV:weightandportare 0–65535. The priority goes inpriority, not in the content.CAA:flagsis 0–255 and the tag is case-insensitive; the value is quoted if you leave the quotes out.
Names
@or an empty name is the apex. A relative name (www) is completed with the zone. A name ending in a dot is taken as fully qualified and must be inside the zone.- Labels: letters, digits,
-and_, up to 63 characters each; up to 253 characters in total. Names are stored in lower case. - A leading
*label makes a wildcard (*.example.com). Wildcards and names with_cannot be proxied.
TTL
| Value | |
|---|---|
| Allowed | 60 to 86,400 seconds |
| Default when not set | 3,600 seconds |
| Proxied names | Published with a short TTL managed by OpenWAF (shown as Auto); the TTL you set is kept for when the proxy is off |
Priority
MX and SRV records need a priority between 0 and 65,535. Other types cannot have one (only MX and SRV records have a priority).
Comments and tags
Records can carry a comment (up to 100 characters, no control characters) and up to 10 tags (1–32 characters of a-z, 0-9, :, _ and -, starting with a letter or digit; stored in lower case, duplicates dropped). They are versioned with the zone but never published in DNS.
Coexistence rules
Records at the same name must fit together. These rules are checked on every change and, for a batch, on the final state of each name:
| Rule | Error message |
|---|---|
| No two identical records (same type, content and priority) | an identical … record already exists at … |
One CNAME per name | … already has a CNAME record |
A CNAME never next to A/AAAA | a CNAME cannot coexist with A/AAAA records at … |
Outside the apex, an unproxied CNAME is alone at its name | an unproxied CNAME must be the only record at … |
A name delegated with NS holds no other records | … is delegated with NS records; it cannot hold other records |
All A, AAAA and CNAME records of a name share the proxy status | all A, AAAA and CNAME records at … must have the same proxied value |
At the apex, an unproxied CNAME is published as an alias (OpenWAF resolves the target and answers with its addresses), so MX, TXT and CAA records can live next to it. A proxied CNAME can share its name with MX, TXT and other non-address records, because the name publishes the edge addresses.
Managed by OpenWAF
- The
SOArecord and the apexNSrecords (your nameserver pair) are managed by OpenWAF and cannot be created or edited (the zone apex NS records are the assigned pair and cannot be edited). - In an external zone, only proxied
A,AAAAandCNAMErecords are accepted.