# Proxied and DNS-only records

> Proxied names answer with the OpenWAF edge and go through the WAF; DNS-only records answer exactly as you write them.

Every `A`, `AAAA` and `CNAME` record has a **proxy status**. It decides whether traffic to that name goes through the
OpenWAF edge.

| | Proxied | DNS only |
|---|---|---|
| What resolvers get | The addresses of the OpenWAF edge | The record's content, as written |
| Where visitors connect | An edge node, which forwards allowed requests to your origin | Directly to the record's content |
| WAF, rules, cache, TLS at the edge | Yes | No |
| Record content | The **origin** the edge connects to; it is not published | Published |
| TTL | Managed by OpenWAF (shown as **Auto**) | The TTL you set |
| Record types | `A`, `AAAA`, `CNAME` | Any [supported type](https://developers.openwaf.dev/dns/record-types/) |

## What goes through the edge

Only **HTTP and HTTPS** traffic to a proxied name is served by the edge. A proxied name is a **site**: the edge
terminates TLS with a certificate issued automatically for that name, applies the site's rules and forwards allowed
requests to the origin.

Keep these names **DNS only**:

- Mail: `MX` targets and names such as `mail`, `smtp`, `imap`, `pop`, `autodiscover` and `autoconfig`. The
  [email check](https://developers.openwaf.dev/dns/email-records/) reports a proxied mail name as an error.
- Any service that is not HTTP(S): SSH, databases, VPNs, game or VoIP servers.
- Verification and service records: `TXT`, `SRV`, `CAA`, `NS`.

## Rules for proxied records

- All the `A`, `AAAA` and `CNAME` records of one name share the same proxy status. Turning the proxy on or off for one
  of them switches the others at that name too.
- Wildcard names (`*.example.com`) and names with an underscore (`_service.example.com`) cannot be proxied: the edge
  serves exact host names only.
- The TTL you set is kept. Proxied names are published with a short TTL managed by OpenWAF; if you turn the proxy off,
  your TTL applies again.
- A proxied `CNAME` points the edge at a host name origin (for example `myapp.example.net`); a proxied `A`/`AAAA`
  points it at an IP address.

## Turn the proxy on or off

**Dashboard**

In **DNS › Records**, select the **Proxy status** switch of a record. To change many records at once, select them and
use **Proxy on** or **Proxy off**: the change is applied as one version.
**CLI**

```sh
openwaf-cloud ctl records set example.com www/A proxied=true --reason "Protect www"
```
**API**

```sh
curl -X PATCH "https://dash.openwaf.dev/v1/orgs/$ORG/zones/$ZONE/records/$RECORD" \
  -H "Authorization: Bearer $OPENWAF_TOKEN" \
  -H "Content-Type: application/json" \
  -H "X-Change-Reason: Protect www" \
  -d '{"proxied": true}'
```
**MCP**

Ask your assistant: *“Proxy www.example.com through OpenWAF.”* It finds the record with `list_records` and calls
`update_record` with `proxied: true`, after you confirm the plan.


> **Note**
>
> In an [external zone](https://developers.openwaf.dev/dns/external-zones/) every record is proxied: the zone only holds the sites that go through
> OpenWAF. The rest of the domain's DNS stays at your provider.


## Related

- [Proxied records](https://developers.openwaf.dev/dns/proxied-records/): how proxied names are answered and how the edge reaches the origin.
- [How OpenWAF works](https://developers.openwaf.dev/fundamentals/how-openwaf-works/): the full path of a request.