Domains
A domain in the NNumbers WAF is the pair formed by the hostname clients reach and the origin that answers for it. Registering the domain is what puts that hostname behind WAF inspection.
Domains in the WAF
| Field | What it is | Example |
|---|---|---|
| Hostname | The protected public name | app.empresa.com.br |
| Origin | Where traffic is delivered after inspection | https://origin.empresa.com.br |
A hostname belongs to a single organization. If another organization has already registered the same hostname, your registration is refused — and the way to take it over is the transfer, which requires proving ownership again.
Domain states
| State | Meaning |
|---|---|
DRAFT | Registered, ownership not verified yet |
PENDING_VERIFICATION | Waiting for the TXT record to be found in DNS |
VERIFIED | Ownership proven |
PENDING_CERTIFICATE | Waiting for the HTTPS certificate |
READY_FOR_DNS | Certificate ready, routing still not pointing to the edge |
ACTIVATING | Routing checked, protection being applied |
ACTIVE | Protected and receiving traffic through the edge |
DEGRADED | Verification or origin problem; the domain may leave the edge |
ERROR | A step failed and needs your action |
DISABLED | Protection turned off by you; the registration remains |
REMOVING | Removal in progress |
Adding a domain
- On the Domains page, click Add domain.
- Enter the hostname: only the name, with no path and no scheme.
- Enter the origin: a public hostname or a public IP address.
The origin must follow these rules:
| Rule | Detail |
|---|---|
| Public address | Private, internal or loopback addresses are refused |
| Port | 80, 443 or the range from 1024 to 65535 |
| HTTPS | The origin certificate is always verified; verification cannot be disabled |
| Protected hostname | The origin cannot be a hostname you already protect in the WAF |
| Host header | You may set the Host the origin expects, when it differs from the address |
The WAF protects whoever arrives through the public hostname. If the origin remains reachable directly at its own address, an attacker can talk to it without passing inspection. Restrict the origin to accept traffic only from the egress addresses shown in the Console.
Ownership verification
Proof that the domain is yours is a TXT record in DNS:
| Item | Value |
|---|---|
| Record name | _nnwaf-challenge.<hostname> |
| Value | nnwaf-verify=<token> |
| Token lifetime | 7 days |
| Record lifetime | As long as the domain exists |
The token appears in the Console when the domain is created. Once the record exists, the Console checks DNS and the domain becomes VERIFIED.
The record is not disposable: the Console re-reads the TXT every day. If it is missing for 7 days, the domain becomes DEGRADED and leaves the edge — traffic stops being protected until the record is back.
The verification TXT is not only for the first day. It is the continuous proof that the hostname remains under your control.
HTTPS certificate
The certificate is issued automatically, by Let's Encrypt, on the NNumbers edge. You neither buy nor renew a certificate.
To have the certificate before switching traffic, create the record that authorizes issuance:
| Item | Value |
|---|---|
| Record name | _acme-challenge.<hostname> |
| Type | CNAME |
| Value | The value shown in the Console, which ends with ._acme.gw.nnumbers.com.br |
With that CNAME in place, the certificate is issued at step 4 and the domain is ready to receive traffic — the DNS switch happens with no certificate error window. Without the CNAME, the certificate is issued after step 5, when routing already points to the edge.
DNS routing
Routing is what brings client traffic to the edge:
| Case | Record |
|---|---|
Regular hostname (app.empresa.com.br) | CNAME to edge.gw.nnumbers.com.br |
Root or apex domain (empresa.com.br) | A and AAAA with the addresses shown in the Console, or ALIAS/ANAME if the provider supports it |
Do not use a CNAME on an apex domain when the provider does not accept it: A and AAAA records, or ALIAS/ANAME, solve it. An apex domain without those options cannot be protected by CNAME.
After creating the record, run the routing check in the Console. It confirms the hostname resolves to the edge and that the request arrives with the expected Host.
Activating protection
With routing checked, click Activate protection. The domain goes to ACTIVATING and then to ACTIVE.
To stop protection without losing the registration, use Disable. The domain becomes DISABLED and no longer passes inspection; DNS keeps pointing to the edge.
Removing a domain
Removing deactivates protection and takes the routing off the edge. DNS on your side is not changed: the hostname keeps pointing to edge.gw.nnumbers.com.br and starts answering with an error until you change the record. Adjust DNS before, or immediately after, removing.
Transferring a domain between organizations
Because a hostname belongs to a single organization, changing owners is a transfer: the new organization registers the hostname and proves ownership again, with the TXT record. Until the proof happens, the domain stays with the previous organization.
Next steps
- Policies — setting mode and paranoia level.
- Troubleshooting — when DNS does not propagate or the certificate does not issue.
- Security — restricting the origin to NNumbers addresses.
Was this page helpful?
Report a problem on this pageDo not send passwords, keys, tokens, or customer data.