# Create DNS zones and manage Website Protection



Source: https://docs.blazingfast.io/howto/api/dns-and-protection-automation



Start with an empty zone, template, JSON or zone file, then inspect records and protection.



DNS determines where a hostname points. Website Protection controls mitigation for a proxied A record. Proxy routing and protection are separate settings.

## Create a zone

You need an active DNS service and `dns.write`. First list your zones and available templates:

```bash
bf dns zone list
bf dns template list
```

Choose one starting point:

| Starting point | CLI option | Result |
| --- | --- | --- |
| Empty | `--empty` | Platform nameservers and required SOA only |
| Saved template | `--template TEMPLATE_NAME` | Records from an exact, unique template name |
| JSON record sets | `--json-file records.json` | Records from a local JSON array |
| DNS zone file | `--zone-file example.zone` | Records parsed from local zone-file text |

For example:

```bash
bf dns zone create example.com --empty --request-key zone-example-001
```

Creating a zone does not register a domain or change registrar nameservers. Copy the zone's authoritative nameservers to your registrar when you intend to use it.

## Preview a file import

An import source is chosen instead of empty mode or a template. A JSON file contains record sets, not a complete API request:

```json
[
  {"name":"@","type":"A","ttl":300,"values":["192.0.2.1"]},
  {"name":"www","type":"CNAME","ttl":300,"values":["example.com."]}
]
```

```bash
bf dns zone create example.com --json-file records.json --dry-run --request-key preview-example-001
bf dns zone create example.com --json-file records.json --request-key import-example-001
```

Review the preview's records and notes before creating. Use a different key for preview and creation; reuse the creation key on retries. Preview does not reserve the zone. Existing zones are not overwritten.

The platform manages apex NS and SOA. File imports do not fetch remote URLs. Zone files support standard IN records, `$ORIGIN`, `$TTL`, quoted TXT and multiline records; `$INCLUDE` and `$GENERATE` are unsupported. Limits are 200 record sets, 50 values per set, TTL 1–86,400 seconds and 100,000 zone-file characters.

## Inspect and change record protection

For a domain in your DNS account, use its zone and record name. `@` means the root record. A separate hosting service ID is not required, including when the origin is external.

```bash
bf dns protection show example.com --record @
bf dns protection set example.com --record @ --enabled off --request-key protection-example-001 --confirm
bf dns protection show example.com --record @
```

The write changes mitigation on an eligible proxied A record. It keeps the proxy switch, origin IP, DNS values and TTL unchanged. Disabling mitigation reduces protection. A missing or unknown protection value does not mean it is disabled.

An AI assistant follows the same read-first workflow and your selected connection policy.

## Country access and TCP Proxy

```bash
bf dns country-policy show example.com --record @
bf tcp-proxy show SERVICE_UUID
bf tcp-proxy stats SERVICE_UUID --range 24h
```

Website country modes are `off`, `allow`, `deny`. TCP Proxy country modes are `disabled`, `allow`, `block`. They are different schemas.

Read the existing configuration before writing. Supplied arrays replace the full array; omitted fields stay unchanged. Check that firewall or country changes retain the access you need.

Use `dns.read` / `dns.write` for DNS and Website Protection, and `tcp_proxy.read` / `tcp_proxy.write` for TCP Proxy.