# Add your first site

> Add a domain to OpenWAF, point it at the edge with nameservers or a CNAME, and put its first site behind the WAF with an automatic certificate.

A site goes through OpenWAF when its name answers with the OpenWAF edge. There are two ways to get there; choose one
per domain:

| | Delegated (recommended) | External |
|---|---|---|
| Dashboard option | **Use OpenWAF nameservers** | **Keep your current DNS (CNAME/A records)** |
| Who answers DNS | OpenWAF, for every name of the domain | Your current DNS provider |
| What you change | The nameservers at the registrar | One TXT record, then one CNAME (or A/AAAA) per site |
| Activation | When the registrar delegates the domain to your pair | When the TXT record is visible |
| Good for | Most domains: everything in one place | Domains registered at Cloudflare Registrar, or when the DNS must stay where it is |

Read [Delegated and external zones](https://developers.openwaf.dev/dns/dns-modes/) for the full comparison. You need the `tech` role or higher.

## Before you start

- Add the **registrable domain** (`example.com`), not a subdomain or a URL. Subdomains such as `www` or `shop` are
  names inside the domain.
- Know the address of your **origin**: the server that answers the site today (an IP address or a host name).
- New sites connect to the origin over HTTPS and verify its certificate (Full strict). If your origin only speaks
  HTTP or has a self-signed certificate, see [SSL/TLS](https://developers.openwaf.dev/ssl/) before you proxy the site.
- The WAF is on for new domains, in blocking mode at medium sensitivity. See [WAF](https://developers.openwaf.dev/waf/) to start in log-only mode.

## Delegated domain

1. **Add the domain.** In the dashboard, open **Add domain**, enter `example.com` and choose
   **Use OpenWAF nameservers (recommended)**. Optionally, pick the [client](https://developers.openwaf.dev/fundamentals/agencies-and-clients/) it
   belongs to. Select **Add domain**.

**Dashboard**

   **Domains › Add domain**, as above. Right after you sign up, the same form opens as
   **Let's protect your first site**.
**CLI**

   ```sh
   openwaf-cloud ctl zones add example.com --reason "Add example.com"
   ```
**API**

   ```sh
   curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones" \
     -H "Authorization: Bearer $OPENWAF_TOKEN" \
     -H "Content-Type: application/json" \
     -H "X-Change-Reason: Add example.com" \
     -d '{"name": "example.com", "dns_mode": "delegated"}'
   ```
   The answer (`201`) includes the zone `id`, its `ns_pair` and how many public records were imported.
**MCP**

   Ask your assistant: *“Add example.com to OpenWAF using OpenWAF nameservers.”* It calls `add_zone` with
   `mode: "delegated"`, shows you the plan, and applies it only after you confirm.


2. **Review the DNS records.** OpenWAF copies the records your domain publishes today (and names found in public
   certificate logs) into the new zone, **without proxy**. Check that everything is there, especially mail (`MX`, `TXT`):
   after the switch, only these records will resolve. Select **Scan again** to look for more, or add records by hand.
   See [Manage DNS records](https://developers.openwaf.dev/dns/manage-records/).

3. **Change the nameservers at your registrar.** Replace all the current nameservers of the domain with exactly the
   two names shown (your organization's pair). Disable DNSSEC at the registrar first if it is enabled. The dashboard has
   step-by-step instructions for common registrars and shows the delegation status live.
   See [Delegate a zone to OpenWAF](https://developers.openwaf.dev/dns/delegate-a-zone/).

4. **Wait for activation.** OpenWAF checks the delegation every few minutes and activates the domain as soon as the
   registry and public resolvers show your pair. It usually takes minutes to a few hours, up to 48 hours for some
   top-level domains. Select **Check now** to check immediately.

5. **Turn on the proxy for your sites.** In **DNS › Records**, switch **Proxy status** to **Proxied** on the `A`,
   `AAAA` or `CNAME` records of each site to protect (for example `example.com` and `www`). Their content becomes the
   origin the edge connects to. See [Proxied and DNS-only records](https://developers.openwaf.dev/fundamentals/proxied-and-dns-only/).

6. **Let the certificates issue.** OpenWAF issues the HTTPS certificates automatically, usually within a couple of
   minutes. The domain's **Overview** shows when every site is protected.


## External domain

1. **Add the domain.** Open **Add domain**, enter `example.com` and choose **Keep your current DNS (CNAME/A records)**.

**Dashboard**

   **Domains › Add domain › Keep your current DNS (CNAME/A records)**.
**CLI**

   ```sh
   openwaf-cloud ctl zones add example.com --mode external --reason "Add example.com"
   ```
**API**

   ```sh
   curl -X POST "https://dash.openwaf.dev/v1/orgs/$ORG/zones" \
     -H "Authorization: Bearer $OPENWAF_TOKEN" \
     -H "Content-Type: application/json" \
     -H "X-Change-Reason: Add example.com" \
     -d '{"name": "example.com", "dns_mode": "external"}'
   ```
**MCP**

   Ask your assistant: *“Add example.com to OpenWAF and keep its current DNS.”* It calls `add_zone` with
   `mode: "external"`.


2. **List the sites to protect.** For each one, enter the name (`www`, or `@` for `example.com` itself) and its origin
   (`203.0.113.10` or `origin.example.net`). Each site becomes a proxied record in the zone.

3. **Verify that the domain is yours.** At your current DNS provider, create the TXT record shown:

   ```text
   _openwaf.example.com.  TXT  "openwaf-verify=<token>"
   ```

   OpenWAF looks for it every few minutes (or when you select **Check now**) and activates the domain when a public
   resolver sees it. See [Keep your DNS provider](https://developers.openwaf.dev/dns/external-zones/).

4. **Point each site to OpenWAF.** Only after the domain is active, change each site's record at your DNS provider:

   ```text
   www.example.com.  CNAME  edge.openwaf.dev.
   ```

   At the root of the domain, where a CNAME is not allowed, create `A` and `AAAA` records with the edge addresses shown
   in **DNS › Settings**, or a CNAME if your provider flattens it.

5. **Check the pointing.** The domain's **Overview** shows whether each site points to OpenWAF. HTTPS certificates are
   issued automatically a few minutes after a site points here.


> **Caution**
>
> In an external domain, pointing a site to OpenWAF **before** the domain is verified breaks it until verification
> completes: the edge only serves active domains.


## After the site is live

- [WAF](https://developers.openwaf.dev/waf/): Tune sensitivity, add exceptions and review blocked requests.
- [Rules](https://developers.openwaf.dev/rules/): IP and country rules, rate limits and redirects.
- [Change control](https://developers.openwaf.dev/change-control/): See the history of every change and roll back in one step.
- [Analytics](https://developers.openwaf.dev/analytics/): Traffic, security events and real-user performance.