Getting started

Putting a domain behind the NNumbers WAF takes a few minutes in the Console and one change at your DNS provider. The path is always the same: register the domain and the origin, prove the domain is yours, issue the certificate, point DNS to the edge and activate protection.

Before you start

Requirement	Why
Access to the domain DNS	Ownership verification and routing are done with DNS records
Public origin reachable over HTTPS	Private or internal addresses are refused at registration
WAF Admin permission	Creating a domain, setting the origin and activating protection require this role
A decision on the policy mode	Detection logs without blocking; prevention blocks

If your domain is the zone apex (for example, empresa.com.br without www), check beforehand whether the DNS provider supports ALIAS or ANAME, or whether you will use A and AAAA records with the addresses shown in the Console.

The seven steps

Step	What happens	Where
1. Domain	You enter the hostname to protect	Console
2. Origin	You enter the address that receives the traffic	Console
3. Ownership	A TXT record proves the domain is yours	Your DNS
4. Certificate	The HTTPS certificate is issued for the hostname	Console and DNS
5. Routing	The hostname starts pointing to the edge	Your DNS
6. Check	The Console confirms the traffic arrives through the edge	Console
7. Activation	Protection takes effect	Console

Each step is detailed in Domains.

Step by step

1. Open the Domains page and click Add domain.
2. Enter the hostname (for example, app.empresa.com.br) and the origin (for example, https://origin.empresa.com.br).
3. Copy the TXT record shown in the Console and create it at your DNS provider. The name is _nnwaf-challenge.<hostname> and the value starts with nnwaf-verify=.
4. Still at the DNS provider, create the CNAME _acme-challenge.<hostname> pointing to the value shown in the Console. It ends with ._acme.gw.nnumbers.com.br and lets the certificate be issued before you switch traffic.
5. Create the routing record: <hostname> as a CNAME to edge.gw.nnumbers.com.br. On an apex domain, use the A and AAAA addresses shown in the Console, or ALIAS/ANAME if the provider supports it.
6. Back in the Console, run the routing check and wait for the result.
7. Click Activate protection.

The order that avoids an outage

Do steps 3 and 4 before step 5. That way the certificate is ready before traffic goes through the edge, and the DNS switch does not break the first request.

Checking the result

With the domain active, the first check is simple: request the site through the protected hostname.

curl -sS -o /dev/null -w '%{http_code}\n' https://app.empresa.com.br/

A 200 (or your application's normal code) confirms the request went through the edge and reached the origin. Then check in the Console:

• Metrics — allowed, blocked and limited requests, per domain.
• Events — what was blocked or detected, with rule, path and request identifier.
• Policy — the mode in use and the paranoia level.

Go-live checklist

Item	Checked
Verification TXT record created and kept	Yes
_acme-challenge CNAME created	Yes
Routing pointing to edge.gw.nnumbers.com.br	Yes
Certificate issued, no browser warning	Yes
Policy mode chosen (detection or prevention)	Yes
Origin restricted to the egress addresses shown in the Console	Yes
Egress address list applied on the origin firewall	Yes
Events reviewed after activation	Yes

Next steps

• Domains — states, verification, certificate and removal.
• Policies — choosing between detection and prevention.
• Events and exceptions — following what was blocked.