Zones, names and sites

The dashboard, the API, the CLI and the MCP server use the same model. This page defines its parts; the glossary has short definitions of every term.

Organization (acme)
 ├─ Client (optional)            groups zones of one end customer
 └─ Zone: example.com            "Domain" in the dashboard
     ├─ Records                  A, AAAA, CNAME, MX, TXT, NS, SRV, CAA
     ├─ Names                    example.com, www.example.com, shop.example.com…
     │    └─ Sites               names with proxied A/AAAA/CNAME records
     ├─ Edge settings and rules  for the whole zone, overridable per name
     └─ Versions                 one per change

#Zone

A zone is one registrable domain, such as example.com, with everything below it. The dashboard calls it a domain; the API, the CLI and the MCP server call it a zone. Add one zone per domain: www.example.com, api.example.com and shop.example.com are names inside the example.com zone, not zones of their own.

Each zone has:

• A DNS mode: delegated (OpenWAF's nameservers answer for the domain) or external (your DNS provider keeps answering). See Delegated and external zones.
• A status: pending (waiting for the delegation or the verification record), active (served by the edge), moved (the domain no longer points to OpenWAF's nameservers) or disabled.
• A configuration version that increases with every change. See Zone versions.
• Optionally, a client.

API paths name a zone by its id: /v1/orgs/{org}/zones/{zone}. The CLI and the MCP server also accept its name.

A domain can only be added once on the whole platform, and not as a parent or a subdomain of a domain managed by another organization. Public suffixes such as co.uk or github.io cannot be added.

#Name and host

A name is any fully qualified host name inside the zone: the zone itself (the apex, written @), www.example.com, mail.example.com… Records live at names. The API calls names hosts in a few places, for example per-name settings (hosts) and the effective configuration of a name (/hosts/{host}/effective).

#Site

A site is a name with proxied A, AAAA or CNAME records: the edge serves it, issues its certificate and protects it. The dashboard lists them in Names. A zone can have many sites, each with its own origin.

#Origin

The origin of a site is the content of its proxied record: the IP address or host name of the server that the edge forwards allowed requests to. The origin is never published in DNS. The scheme and port the edge uses to reach it come from the zone's settings and can be set per name. See SSL/TLS.

#Per-name settings

Edge settings (WAF mode and sensitivity, origin, cache, HSTS, access gate…) are set for the zone and inherited by every name. Any name can override some of them; the rest still follows the zone. Rules can be limited to a list of names; without a list they apply to every name of the zone.

The effective configuration of a name is what the edge applies to it: the zone's settings with the name's own on top, plus the rules that reach it. See it in Names › Effective configuration, with openwaf-cloud ctl zones effective example.com www.example.com, or with the effective_config MCP tool.

#Version

Every change to a zone (records, settings, rules, client) creates a new numbered version with its author, reason and diff. Versions are the unit of propagation to the edge and of rollback. See Change control.