# Zones, names and sites

> What a zone, a name, a host, a site and an origin are in OpenWAF, and how per-name settings inherit from the zone.

The dashboard, the API, the CLI and the MCP server use the same model. This page defines its parts; the
[glossary](https://developers.openwaf.dev/fundamentals/glossary/) has short definitions of every term.

```text
Organization (acme)
 ├─ Client (optional)            groups zones of one end customer
 └─ Zone: example.com            "Domain" in the dashboard
     ├─ Records                  A, AAAA, CNAME, MX, TXT, NS, SRV, CAA
     ├─ Names                    example.com, www.example.com, shop.example.com…
     │    └─ Sites               names with proxied A/AAAA/CNAME records
     ├─ Edge settings and rules  for the whole zone, overridable per name
     └─ Versions                 one per change
```

## Zone

A **zone** is one registrable domain, such as `example.com`, with everything below it. The dashboard calls it a
**domain**; the API, the CLI and the MCP server call it a zone. Add one zone per domain: `www.example.com`,
`api.example.com` and `shop.example.com` are names inside the `example.com` zone, not zones of their own.

Each zone has:

- A **DNS mode**: `delegated` (OpenWAF's nameservers answer for the domain) or `external` (your DNS provider keeps
  answering). See [Delegated and external zones](https://developers.openwaf.dev/dns/dns-modes/).
- A **status**: `pending` (waiting for the delegation or the verification record), `active` (served by the edge),
  `moved` (the domain no longer points to OpenWAF's nameservers) or `disabled`.
- A **configuration version** that increases with every change. See [Zone versions](https://developers.openwaf.dev/dns/zone-versions/).
- Optionally, a [client](https://developers.openwaf.dev/fundamentals/agencies-and-clients/).

API paths name a zone by its id: `/v1/orgs/{org}/zones/{zone}`. The CLI and the MCP server also accept its name.

A domain can only be added once on the whole platform, and not as a parent or a subdomain of a domain managed by
another organization. Public suffixes such as `co.uk` or `github.io` cannot be added.

## Name and host

A **name** is any fully qualified host name inside the zone: the zone itself (the **apex**, written `@`), `www.example.com`,
`mail.example.com`… Records live at names. The API calls names **hosts** in a few places, for example per-name settings
(`hosts`) and the effective configuration of a name (`/hosts/{host}/effective`).

## Site

A **site** is a name with proxied `A`, `AAAA` or `CNAME` records: the edge serves it, issues its certificate and
protects it. The dashboard lists them in **Names**. A zone can have many sites, each with its own origin.

## Origin

The **origin** of a site is the content of its proxied record: the IP address or host name of the server that the edge
forwards allowed requests to. The origin is never published in DNS. The scheme and port the edge uses to reach it come
from the zone's settings and can be set per name. See [SSL/TLS](https://developers.openwaf.dev/ssl/).

## Per-name settings

Edge settings (WAF mode and sensitivity, origin, cache, HSTS, access gate…) are set for the zone and inherited by every
name. Any name can override some of them; the rest still follows the zone. Rules can be limited to a list of names;
without a list they apply to every name of the zone.

The **effective configuration** of a name is what the edge applies to it: the zone's settings with the name's own on
top, plus the rules that reach it. See it in **Names › Effective configuration**, with
`openwaf-cloud ctl zones effective example.com www.example.com`, or with the `effective_config` MCP tool.

## Version

Every change to a zone (records, settings, rules, client) creates a new numbered **version** with its author, reason
and diff. Versions are the unit of propagation to the edge and of rollback. See [Change control](https://developers.openwaf.dev/change-control/).