# Record types and validation

> The DNS record types OpenWAF supports, the content format of each, TTL limits, names, priorities and the rules for records that share a name.

Every record is validated when it is created or changed, in the dashboard, the API, the CLI and the MCP server alike.
A rejected record answers `422 invalid` with the `field` at fault and a message. See [Error codes](https://developers.openwaf.dev/dns/error-codes/).

## Supported types

| Type | Content | Example | Proxiable |
|---|---|---|---|
| `A` | IPv4 address | `203.0.113.10` | Yes |
| `AAAA` | IPv6 address | `2001:db8::10` | Yes |
| `CNAME` | Host name; cannot point to itself | `myapp.example.net` | Yes |
| `MX` | Mail server host name, or `.` for a null MX; needs `priority` | `mx1.example.net` | No |
| `TXT` | Text without quotes, up to 4,096 bytes of UTF-8 | `v=spf1 include:_spf.example.net -all` | No |
| `NS` | Name server of a delegated subdomain (not at the apex) | `ns1.provider.net` | No |
| `SRV` | `weight port target`; needs `priority` | `5 5060 sip.example.com` | No |
| `CAA` | `flags tag "value"` | `0 issue "letsencrypt.org"` | No |

Any other type is refused: `unsupported record type (A, AAAA, CNAME, MX, TXT, NS, SRV, CAA)`.

Format details:

- `A`/`AAAA`: the address must match the type (an IPv4-mapped IPv6 address is not accepted as `AAAA`). It is stored in
  canonical form.
- Host names (`CNAME`, `MX`, `NS`, `SRV` targets) are stored in lower case without the final dot.
- `TXT`: write the text without quotes. Long values are split into 255-byte strings automatically when published.
- `SRV`: `weight` and `port` are 0–65535. The priority goes in `priority`, not in the content.
- `CAA`: `flags` is 0–255 and the tag is case-insensitive; the value is quoted if you leave the quotes out.

## Names

- `@` or an empty name is the apex. A relative name (`www`) is completed with the zone. A name ending in a dot is taken
  as fully qualified and must be inside the zone.
- Labels: letters, digits, `-` and `_`, up to 63 characters each; up to 253 characters in total. Names are stored in
  lower case.
- A leading `*` label makes a wildcard (`*.example.com`). Wildcards and names with `_` cannot be proxied.

## TTL

| | Value |
|---|---|
| Allowed | 60 to 86,400 seconds |
| Default when not set | 3,600 seconds |
| Proxied names | Published with a short TTL managed by OpenWAF (shown as **Auto**); the TTL you set is kept for when the proxy is off |

## Priority

`MX` and `SRV` records need a `priority` between 0 and 65,535. Other types cannot have one (`only MX and SRV records
have a priority`).

## Comments and tags

Records can carry a `comment` (up to 100 characters, no control characters) and up to 10 `tags` (1–32 characters of
`a-z`, `0-9`, `:`, `_` and `-`, starting with a letter or digit; stored in lower case, duplicates dropped). They are
versioned with the zone but never published in DNS.

## Coexistence rules

Records at the same name must fit together. These rules are checked on every change and, for a
[batch](https://developers.openwaf.dev/dns/batch-changes/), on the final state of each name:

| Rule | Error message |
|---|---|
| No two identical records (same type, content and priority) | `an identical … record already exists at …` |
| One `CNAME` per name | `… already has a CNAME record` |
| A `CNAME` never next to `A`/`AAAA` | `a CNAME cannot coexist with A/AAAA records at …` |
| Outside the apex, an unproxied `CNAME` is alone at its name | `an unproxied CNAME must be the only record at …` |
| A name delegated with `NS` holds no other records | `… is delegated with NS records; it cannot hold other records` |
| All `A`, `AAAA` and `CNAME` records of a name share the proxy status | `all A, AAAA and CNAME records at … must have the same proxied value` |

At the apex, an unproxied `CNAME` is published as an alias (OpenWAF resolves the target and answers with its
addresses), so `MX`, `TXT` and `CAA` records can live next to it. A proxied `CNAME` can share its name with `MX`,
`TXT` and other non-address records, because the name publishes the edge addresses.

## Managed by OpenWAF

- The `SOA` record and the apex `NS` records (your [nameserver pair](https://developers.openwaf.dev/dns/delegate-a-zone/#nameserver-pair)) are
  managed by OpenWAF and cannot be created or edited (`the zone apex NS records are the assigned pair and cannot be
  edited`).
- In an [external zone](https://developers.openwaf.dev/dns/external-zones/), only proxied `A`, `AAAA` and `CNAME` records are accepted.