DNS Setup and Verification

To route your traffic through HEIMWALL, point your domain’s A record at the HEIMWALL edge IPv4 addresses and the AAAA record at the IPv6 addresses at your DNS provider. No nameserver change is required.

Find your edge addresses

1. Open Console → WAF → [domain] → Addresses.

2. Each server card on the page shows one IPv4 and one IPv6 address. Use the copy button to grab them.

3. The progress indicator on the page has three stages: Your HEIMWALL servers are ready → Add the DNS records → Routing verified. The last stage is a verification step: HEIMWALL checks your DNS records periodically, and once they start pointing at the edge addresses the status automatically switches to “Routing verified” — at that point setup is complete and protection is active.

Update your DNS records

1. Sign in to your DNS provider’s panel (the registrar you bought the domain from, or whichever service manages your DNS).

2. Find the section named DNS management / DNS records / Zone management or similar.

3. Edit your domain’s existing A record: replace its value — your origin server’s IP — with the HEIMWALL IPv4 address.

4. If there are multiple server cards, add a separate A record for each IPv4. Multiple records provide redundancy — if one server becomes unreachable, traffic keeps flowing through the others.

5. Likewise, point AAAA records at the HEIMWALL IPv6 addresses.

6. Keep the TTL low (for example 300 seconds). The change propagates quickly, and you can roll back fast later if needed.

7. Save and wait for propagation. Depending on the old record’s TTL, this can take anywhere from a few minutes to a few hours.

No nameserver change required

For the WAF, changing only the A/AAAA records is enough; you can stay with your current DNS provider. Nameserver delegation is only needed if you want to use HEIMWALL Managed DNS.

Alternative: HEIMWALL Managed DNS

If you want to move your DNS entirely to HEIMWALL:

1. In the DNS Zone section of the console dashboard (My Resources), click the New button — the Add DNS Zone dialog opens. Enter the same domain name.

2. Check the Route via WAF box. The @ (apex) and www records are bridged to the WAF automatically — no manual records needed.

   • If you already added the domain as a WAF Zone, your existing WAF zone is adopted automatically: your rules, origin and all WAF settings are preserved as they are.
   • If the domain is not in the WAF yet, enter your server’s IP in the Origin field and choose a Server Placement; a WAF zone is created for you.

3. When the zone is created, the HEIMWALL nameservers are shown to you. Set them for your domain at your registrar’s panel (they are also available on the zone detail’s Nameservers card).

4. Nameserver status is tracked with badges: “Routing pending” → “Routing verified”. Once delegation completes, everything is in place.

No A/AAAA records needed with Managed DNS

When HEIMWALL manages your DNS, address routing is handled automatically — the Addresses page states this too; you never enter A/AAAA records by hand. Even if an edge IP changes, routing is updated automatically.

Verification

You can confirm the setup works in two ways:

• In the console: the status badge on the Addresses page reads “Routing pending” and switches automatically to “Routing verified” once the records have propagated. No manual refresh is needed.
• On the command line:

dig +short A example.com
dig +short AAAA example.com

If the output shows the edge IPs from the Addresses page, routing is complete. Your origin server’s IP should no longer appear.

Keep your origin IP private

With HEIMWALL in place, visitors connect to the edge network rather than directly to your server — your origin IP stays out of the traffic. To make that privacy complete, make sure your IP isn’t exposed elsewhere (an old A record, a test subdomain, an MX record, etc.) and configure your origin to accept traffic only from the HEIMWALL edge addresses.

Next step

Your First SSL CertificateOnce DNS is verified your certificate is issued automatically — check its status.