Create DNS zones and manage Website Protection

DNS determines where a hostname points. Website Protection controls mitigation for a proxied A record. Proxy routing and protection are separate settings.

Create a zone

You need an active DNS service and dns.write. First list your zones and available templates:

bf dns zone list
bf dns template list

Choose one starting point:

For example:

bf dns zone create example.com --empty --request-key zone-example-001

Creating a zone does not register a domain or change registrar nameservers. Copy the zone's authoritative nameservers to your registrar when you intend to use it.

Preview a file import

An import source is chosen instead of empty mode or a template. A JSON file contains record sets, not a complete API request:

[
  {"name":"@","type":"A","ttl":300,"values":["192.0.2.1"]},
  {"name":"www","type":"CNAME","ttl":300,"values":["example.com."]}
]

bf dns zone create example.com --json-file records.json --dry-run --request-key preview-example-001
bf dns zone create example.com --json-file records.json --request-key import-example-001

Review the preview's records and notes before creating. Use a different key for preview and creation; reuse the creation key on retries. Preview does not reserve the zone. Existing zones are not overwritten.

The platform manages apex NS and SOA. File imports do not fetch remote URLs. Zone files support standard IN records, $ORIGIN, $TTL, quoted TXT and multiline records; $INCLUDE and $GENERATE are unsupported. Limits are 200 record sets, 50 values per set, TTL 1–86,400 seconds and 100,000 zone-file characters.

Inspect and change record protection

For a domain in your DNS account, use its zone and record name. @ means the root record. A separate hosting service ID is not required, including when the origin is external.

bf dns protection show example.com --record @
bf dns protection set example.com --record @ --enabled off --request-key protection-example-001 --confirm
bf dns protection show example.com --record @

The write changes mitigation on an eligible proxied A record. It keeps the proxy switch, origin IP, DNS values and TTL unchanged. Disabling mitigation reduces protection. A missing or unknown protection value does not mean it is disabled.

An AI assistant follows the same read-first workflow and your selected connection policy.

Country access and TCP Proxy

bf dns country-policy show example.com --record @
bf tcp-proxy show SERVICE_UUID
bf tcp-proxy stats SERVICE_UUID --range 24h

Website country modes are off, allow, deny. TCP Proxy country modes are disabled, allow, block. They are different schemas.

Read the existing configuration before writing. Supplied arrays replace the full array; omitted fields stay unchanged. Check that firewall or country changes retain the access you need.

Use dns.read / dns.write for DNS and Website Protection, and tcp_proxy.read / tcp_proxy.write for TCP Proxy.