Documentation, guides, and answers for everything DNSZone.io — from getting started to advanced DDoS mitigation.
Log in to manage.dnszone.io and click Add domain from the dashboard or domains page. Enter your domain name (e.g. example.com) and click Save.
After adding the domain, you'll be shown the nameservers you need to set at your domain registrar. Point your domain's NS records to the DNSZone.io nameservers to activate DNS management.
Your nameservers are shown in the dashboard after you add a domain. They are unique to your account. Go to Dashboard → Domains → select your domain → Overview to find them.
At your domain registrar, replace your current NS records with the two nameservers provided. After that, all DNS resolution for your domain is handled by DNSZone.io's infrastructure.
DNS changes you make within DNSZone.io (adding or editing records) propagate immediately — usually within seconds, because our DNS servers notifies resolvers of changes directly.
Nameserver changes at your registrar are different. Those depend on your domain's NS TTL and your registrar's processing time — typically 1–24 hours, but can take up to 48 hours in rare cases.
DNSZone.io supports the most common DNS record types:
A — Maps a hostname to an IPv4 addressAAAA — Maps a hostname to an IPv6 addressCNAME — Alias pointing one hostname to anotherMX — Mail exchanger records for email routingTXT — Text records (SPF, DKIM, DMARC, verification)SOA — Start of authority, managed automaticallyGo to your domain's DNS tab and add an MX record. Set the Name to @ (your root domain), the Mail server to your email provider's hostname (e.g. mail.protonmail.ch), and the Priority to the value your provider specifies (typically 10).
If your email provider requires SPF, add a TXT record at @ with the SPF value they provide. DKIM records are typically added as TXT records at a specific subdomain like selector._domainkey.
Standard DNS does not allow a CNAME at the root (apex) domain because it conflicts with SOA and NS records. Use an A record pointing to the target IP instead, or a CNAME on a subdomain like www.
If you need root-domain aliasing to a hostname (e.g. for a CDN), contact us — some setups can be handled with ALIAS/ANAME records depending on configuration.
Each A and AAAA record has an orange cloud icon. Clicking it toggles the proxy for that specific record:
Your real IP is always stored securely and used to forward traffic on the backend — it is never exposed to visitors when proxy is enabled.
Note: control panels, mail servers and other services that run on non-standard ports should keep the proxy off, as the edge only forwards traffic on port 80 and 443.
When the reverse proxy is enabled for a domain, all HTTP/HTTPS traffic is routed through DNSZone.io's servers before reaching your origin. This hides your server's real IP address from the public internet.
Benefits include: origin IP protection, DDoS absorption at the edge, WAF rule enforcement, caching, and real-time traffic analytics — all without changing your application.
Go to Dashboard → Domains → your domain → Settings. Toggle "Reverse proxy" on and enter your origin server's IP address and port. Click Save. DNSZone.io will immediately start routing traffic for that domain through our edge.
Yes. DNSZone.io terminates HTTPS at the edge and forwards traffic to your origin via HTTP or HTTPS depending on your configuration. SSL certificates for your domain are managed automatically.
Visitors always see a valid HTTPS connection regardless of how your origin is configured.
Yes. DNSZone.io's edge servers listen on both IPv4 and IPv6 for proxied domains. Visitors connecting via IPv6 are handled natively — your domain is accessible over both protocols without any extra configuration.
You can add AAAA records to your DNS to ensure IPv6 resolution points to DNSZone.io's edge IP.
The WAF (Web Application Firewall) sits in front of your domain and inspects every incoming request before it reaches your server. It enforces rules to block malicious traffic, attackers, and bots.
DNSZone.io's WAF has two modes: automatic sensor-based blocking (always on during attacks) and the Human Challenge (on-demand, blocks bot traffic). See the WAF page for a full breakdown.
Go to your domain's Firewall tab. Click Add rule and choose the rule type:
192.168.1.0/24)Rules take effect immediately after saving. No restart or redeploy required.
Block Crawler Bots automatically drops connections to paths commonly targeted by scanners and vulnerability crawlers — things like .env, wp-login.php, xmlrpc.php, .git/, and PHP shell extensions. The block happens at the nginx level using a return 444 (connection closed, no response), so these requests never reach your application.
Enable it per domain: Dashboard → Domain → Settings → Block Crawler Bots toggle. Blocked paths include:
.env, .aws/, .htaccess, phpinfo.phpwp-login.php, xmlrpc.php, wp-admin/, wp-config.php.php, .phtml, .phar, .asp, .jsp.git/.php requests including your own application.The Human Challenge is a JavaScript-based browser verification that runs before the visitor reaches your site. Real browsers pass it automatically in under a second. Bots that can't execute JavaScript — or that fail the proof-of-work — are blocked.
Enable it when you're under a DDoS attack with distributed IPs (too many to block individually), when you're seeing high bot traffic, or proactively on sensitive domains.
Enable it from: Dashboard → Domain → WAF → Human Challenge toggle.
Rate Limiting lets you cap how many requests a single IP address can make within a set time window. When the limit is exceeded, the request is either blocked with a 429 response or challenged with a JS human verification page — depending on the action you choose.
It is useful for protecting login pages, API endpoints, and search forms from brute-force attempts and scraping bots without blocking legitimate users entirely.
Go to your domain's Firewall tab and scroll to the Rate Limiting section. Click Add rule and fill in:
/api/ to target only that prefixRules take effect immediately after saving.
Block — The visitor receives a 429 Too Many Requests page and cannot proceed until the rate limit window resets.
Challenge — The visitor is shown the JS human verification page. Once they pass it, their session is remembered and they bypass the rate limit for subsequent requests. Bots that cannot execute JavaScript are stopped; real users continue without disruption.
Burst allows a short spike of requests above the configured rate before enforcement begins. For example, if your limit is 10 req/min with a burst of 5, a visitor can send up to 15 requests in a short window before hitting a 429. Requests beyond the burst are blocked immediately without queuing.
Set burst to a small value (5–20) to absorb normal browser behaviour such as loading multiple assets at once, while still stopping sustained floods.
Rate-limited requests appear in the Events log with an amber Rate Limited badge next to the 429 status. Use the Rate Limited (429) filter in the Events view to isolate them from other blocked traffic.
Find it under: Dashboard → Domain → Events.
DNSZone.io's sensor mitigation activates automatically — you don't need to do anything for it to start working. Check your dashboard to see attack details, live traffic, and blocked IPs.
If traffic is still getting through, enable the Human Challenge from the WAF tab. This stops almost all bot-driven floods immediately. You can also add manual firewall rules to block specific IPs, CIDRs, or countries you're seeing in the attack logs.
For immediate help, join our Discord.
During an active attack, our monitor tracks IPs generating blocked requests every second. If an IP sustains blocked traffic for 30 consecutive seconds, it is issued a 5-minute network-level ban, enforced before your website even sees the traffic.
These temporary bans expire automatically. The system is designed to avoid false positives: only IPs actively sending firewall-blocked requests trigger the streak counter, not normal visitors.
Go to Dashboard → Attack Logs. Each entry shows the affected domain, attack type, start time, duration, peak requests per second, total blocked requests, and final status (Mitigated / Ongoing).
The streak-based ban system only targets IPs that are actively sending firewall-blocked requests for 30+ consecutive seconds. Legitimate visitors who aren't being blocked by any firewall rule will never trigger the streak counter, so they cannot be caught by the automatic ban system.
If you accidentally banned a legitimate IP via a manual firewall rule, you can remove that rule from the Firewall tab — it takes effect immediately.
For each domain you get:
The dashboard also shows aggregate stats across all your domains.
Bandwidth is the total bytes served from DNSZone.io's edge to visitors — this is outbound traffic from our servers. It includes all responses served through the reverse proxy for that domain over the selected time period.
Go to Account → Notifications. Under Discord Notifications, toggle the switch for each domain you want to receive alerts for. When enabled, attack start and end messages are posted to the public DNSZone.io mitigation logs channel on Discord.
Yes — with a Custom Webhook. Available on Starter and Enterprise domains. Go to Account → Notifications → Custom Webhooks, click Add webhook, select the domain, and paste a Discord webhook URL.
To get a webhook URL in Discord: open your server → channel settings → Integrations → Webhooks → New Webhook → Copy Webhook URL.
Once saved, attack start and end alerts are sent directly to your channel. The message format is identical to the public DNSZone.io mitigation log channel — same embed, same fields.
Yes. Go to Account → Notifications and toggle Email notifications on. Attack alerts will be sent to your account email address when an attack starts and when it ends.
Threat Intelligence tracks IPs that repeatedly trigger attack events across your domains. It gives you a centralised view of the most persistent sources of malicious traffic hitting your infrastructure — not just a single domain, but across all of them.
Find it under Threat Intelligence in the sidebar.
Every blocked request is recorded with its source IP. Threat Intelligence aggregates these across all your domains and ranks IPs by how many times they've been blocked. IPs appearing frequently across multiple attack events or domains are surfaced as repeat offenders.
On the Threat Intelligence page, each listed IP has a Block button. Clicking it adds a permanent firewall block for that IP across all your domains — it creates a deny rule in each domain's firewall instantly.
You can remove individual blocks from the Firewall tab of the relevant domain at any time.
When caching is enabled for a domain, DNSZone.io stores responses from your origin server at the edge. Subsequent requests for the same resource are served directly from our cache, reducing load on your server and improving response times for visitors.
You can choose between file-based caching (persistent across restarts) and memory caching (faster, lost on restart). Configure caching from the domain's Cache tab.
Go to your domain's Cache tab and click Purge cache. This clears all cached responses for that domain. The next request for each resource will fetch a fresh copy from your origin.
By default, caching is best suited for static assets (images, CSS, JS, fonts). For dynamic pages that are personalized per user or change frequently, enable the "Don't cache dynamic content" option in the cache settings to avoid serving stale responses to users.
You can also configure query string handling — whether URLs with different query parameters are treated as separate cache entries.
Cache bypass rules let you exclude specific URL paths from caching, even when global caching is enabled for the domain. Requests matching a bypass rule are always fetched fresh from your origin server.
Add bypass rules from the domain's Cache tab. Common use cases include API endpoints (/api/), admin panels (/admin/), and checkout or login pages that must never serve cached responses.
DNSZone.io offers a free tier that includes DNS management, reverse proxy, and WAF for your domains. You can get started without a credit card. Check the dashboard for current plan limits and available upgrades.
Go to Dashboard → Profile → Security and enter your current password, then your new password. Click Save to update it.
Account deletion can be requested by contacting us via Discord. Before deletion, make sure to remove your domains' nameservers from your registrar to avoid DNS disruption.
Join our Discord community and the DNSZone.io team will assist you directly.
Join Discord