Every A, AAAA and CNAME record has a proxy status. It decides whether traffic to that name goes through the OpenWAF edge.
| Proxied | DNS only | |
|---|---|---|
| What resolvers get | The addresses of the OpenWAF edge | The record's content, as written |
| Where visitors connect | An edge node, which forwards allowed requests to your origin | Directly to the record's content |
| WAF, rules, cache, TLS at the edge | Yes | No |
| Record content | The origin the edge connects to; it is not published | Published |
| TTL | Managed by OpenWAF (shown as Auto) | The TTL you set |
| Record types | A, AAAA, CNAME | Any supported type |
What goes through the edge
Only HTTP and HTTPS traffic to a proxied name is served by the edge. A proxied name is a site: the edge terminates TLS with a certificate issued automatically for that name, applies the site's rules and forwards allowed requests to the origin.
Keep these names DNS only:
- Mail:
MXtargets and names such asmail,smtp,imap,pop,autodiscoverandautoconfig. The email check reports a proxied mail name as an error. - Any service that is not HTTP(S): SSH, databases, VPNs, game or VoIP servers.
- Verification and service records:
TXT,SRV,CAA,NS.
Rules for proxied records
- All the
A,AAAAandCNAMErecords of one name share the same proxy status. Turning the proxy on or off for one of them switches the others at that name too. - Wildcard names (
*.example.com) and names with an underscore (_service.example.com) cannot be proxied: the edge serves exact host names only. - The TTL you set is kept. Proxied names are published with a short TTL managed by OpenWAF; if you turn the proxy off, your TTL applies again.
- A proxied
CNAMEpoints the edge at a host name origin (for examplemyapp.example.net); a proxiedA/AAAApoints it at an IP address.
Turn the proxy on or off
In DNS › Records, select the Proxy status switch of a record. To change many records at once, select them and use Proxy on or Proxy off: the change is applied as one version.
openwaf-cloud ctl records set example.com www/A proxied=true --reason "Protect www"curl -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/records/$RECORD" \
-H "Authorization: Bearer $OPENWAF_TOKEN" \
-H "Content-Type: application/json" \
-H "X-Change-Reason: Protect www" \
-d '{"proxied": true}'Ask your assistant: “Proxy www.example.com through OpenWAF.” It finds the record with list_records and calls update_record with proxied: true, after you confirm the plan.
Related
- Proxied records: how proxied names are answered and how the edge reaches the origin.
- How OpenWAF works: the full path of a request.