> ## Documentation Index
> Fetch the complete documentation index at: https://docs.recon44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Route traffic through Recon44 with DNS

> Add a single CNAME record to send every visitor request through Recon44's edge inspection layer — step-by-step instructions for all major DNS providers.

Recon44's WAF, active IP blocking, and real-time threat feed all require live traffic to pass through Recon44's edge network. You enable this by adding one CNAME record to your domain's DNS configuration. No changes to your server, application code, or hosting setup are needed. This guide explains what the record looks like, how to add it in the most common DNS providers, and how to confirm it's working.

<Note>
  Recon44 handles the rest automatically once the record is in place. You do not need to update the record again unless you remove the site from your Recon44 account.
</Note>

## What the CNAME record looks like

After you add a site in the Recon44 dashboard, the **DNS Setup** tab on that site's settings page shows your unique CNAME target. It follows this format:

```
Type:  CNAME
Name:  www          (or @ for the apex domain — see note below)
Value: <your-site-id>.edge.recon44.com
TTL:   300
```

Your exact `Value` is generated per site and shown in the dashboard. Copy it directly from there — do not type it manually.

<Warning>
  Most DNS providers do not support a CNAME on the apex domain (`@` or bare `example.com`). If you need apex domain support, use a provider that offers CNAME flattening or ALIAS records (Cloudflare, Route 53, and DNSimple all support this). See the provider-specific steps below.
</Warning>

## How to add the record

<Steps>
  <Step title="Copy your CNAME value from the dashboard">
    In the Recon44 dashboard, go to your site and open the **Settings** tab, then click **DNS Setup**. You'll see a pre-filled table with the exact record to add. Click the copy icon next to the **Value** field.
  </Step>

  <Step title="Add the record in your DNS provider">
    Open your DNS provider's control panel and add the CNAME record using the values from the previous step. Follow the provider-specific instructions below.

    <Tabs>
      <Tab title="Cloudflare">
        1. Log in to the [Cloudflare dashboard](https://dash.cloudflare.com) and select your domain.
        2. Go to **DNS → Records** and click **Add record**.
        3. Set the fields as follows:
           * **Type**: `CNAME`
           * **Name**: `www` (or your subdomain)
           * **Target**: paste the value from your Recon44 dashboard
           * **Proxy status**: set to **DNS only** (gray cloud) — do not proxy through Cloudflare at this step
           * **TTL**: `Auto`
        4. Click **Save**.

        <Info>
          If you want apex domain (`example.com`) support on Cloudflare, set **Name** to `@`. Cloudflare automatically flattens CNAME records on the apex.
        </Info>

        <Tip>
          Keep Cloudflare's proxy disabled (DNS only) on the Recon44 CNAME. Enabling the Cloudflare proxy in addition to routing through Recon44 creates a double-proxy configuration that can cause unexpected behavior.
        </Tip>
      </Tab>

      <Tab title="Amazon Route 53">
        1. Open the [Route 53 console](https://console.aws.amazon.com/route53/) and click **Hosted zones**.
        2. Select the hosted zone for your domain.
        3. Click **Create record** and configure:
           * **Record name**: `www` (or your subdomain)
           * **Record type**: `CNAME`
           * **Value**: paste the value from your Recon44 dashboard
           * **TTL**: `300`
        4. Click **Create records**.

        <Info>
          For the apex domain, use an **A record with Alias** instead of a CNAME and set the alias target to your Recon44 edge value. Route 53 supports ALIAS records at the zone apex, which behave like CNAME flattening.
        </Info>
      </Tab>

      <Tab title="Namecheap">
        1. Log in to [Namecheap](https://www.namecheap.com) and go to **Domain List**.
        2. Click **Manage** next to your domain, then open the **Advanced DNS** tab.
        3. Under **Host Records**, click **Add New Record** and set:
           * **Type**: `CNAME Record`
           * **Host**: `www` (or your subdomain)
           * **Value**: paste the value from your Recon44 dashboard
           * **TTL**: `300`
        4. Click the green checkmark to save.

        <Warning>
          Namecheap does not support CNAME records on the apex domain. If you need `example.com` (not `www.example.com`) to route through Recon44, contact Namecheap support about URL redirect options, or consider migrating DNS to Cloudflare.
        </Warning>
      </Tab>

      <Tab title="GoDaddy">
        1. Log in to [GoDaddy](https://www.godaddy.com) and go to **My Products**.
        2. Next to your domain, click **DNS** (or go to **Domain Settings → Manage DNS**).
        3. In the **DNS Records** table, click **Add** and configure:
           * **Type**: `CNAME`
           * **Name**: `www` (or your subdomain)
           * **Value**: paste the value from your Recon44 dashboard
           * **TTL**: `1 hour` (or `300` seconds if custom TTL is available)
        4. Click **Save**.

        <Warning>
          GoDaddy does not support CNAME records on the apex domain. Route `www.example.com` through Recon44 and set up a redirect from the bare domain to `www` in GoDaddy's forwarding settings, or transfer DNS to a provider with CNAME flattening.
        </Warning>
      </Tab>
    </Tabs>
  </Step>

  <Step title="Wait for DNS propagation">
    DNS changes propagate across global resolvers within a few minutes when using a low TTL (300 seconds). Full propagation to all resolvers worldwide can take up to 24 hours in rare cases, but most users see changes take effect within 5–15 minutes.

    You can check propagation status using a public DNS lookup tool:

    ```bash theme={null}
    dig www.example.com CNAME +short
    ```

    Replace `www.example.com` with your actual hostname. The output should return your Recon44 edge value, for example:

    ```
    abc123xyz.edge.recon44.com.
    ```

    <Info>
      If the old value still appears, your local DNS resolver may have cached the previous record. This is normal — the new value will be visible once the TTL expires on any resolver that cached the old one.
    </Info>
  </Step>

  <Step title="Verify the connection in Recon44">
    Return to the Recon44 dashboard and open your site's **DNS Setup** tab. Recon44 automatically checks for the CNAME record and updates the status indicator.

    When the record is detected correctly, the status changes from **Pending** to **Active**. You'll also see live traffic start appearing in the **Threat Feed** within seconds of the first request.

    <Tip>
      Send a test request to your site from a browser or with `curl` to trigger the first entry in the threat feed and confirm end-to-end routing is working.
    </Tip>

    ```bash theme={null}
    curl -I https://www.example.com
    ```

    Check the response headers. You should see Recon44's inspection headers alongside your normal server headers. If the site loads normally, routing is working correctly.
  </Step>
</Steps>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The dashboard still shows 'Pending' after 15 minutes">
    Verify the CNAME record is present using `dig` or an online DNS lookup tool. If the record appears correctly in DNS but the dashboard still shows Pending, click **Recheck** on the DNS Setup tab to trigger a manual verification. If the issue persists, confirm the **Value** in your DNS record exactly matches what the dashboard shows — extra spaces or a missing period at the end can cause failures.
  </Accordion>

  <Accordion title="My site is unreachable after adding the record">
    This usually means the CNAME value was entered incorrectly, or the record replaced an existing A record rather than pointing `www` to a new target. Check that:

    * The record type is `CNAME`, not `A` or `AAAA`
    * The **Value** matches exactly what the Recon44 dashboard shows
    * No conflicting A record exists for the same hostname

    If you need to roll back quickly, delete the CNAME record and restore the previous A record pointing to your origin server IP.
  </Accordion>

  <Accordion title="I need to protect the apex domain (bare example.com)">
    Use a DNS provider that supports CNAME flattening or ALIAS records: Cloudflare, Amazon Route 53, DNSimple, or NS1. On those providers, you can set the apex record to point to your Recon44 edge value, and the provider resolves it to an IP address transparently.
  </Accordion>

  <Accordion title="The WAF is active but I'm still seeing unblocked threats in the feed">
    Check that your plan includes active blocking (Pro or higher) and that blocking mode is enabled in **Settings → WAF Mode**. On the Free plan, Recon44 operates in monitor-only mode and logs threats without blocking them.
  </Accordion>
</AccordionGroup>

## What's next

<CardGroup cols={2}>
  <Card title="How the WAF works" icon="shield-halved" href="/concepts/waf">
    Learn how Recon44 inspects requests and matches against OWASP attack patterns.
  </Card>

  <Card title="Block and whitelist IPs" icon="hand-pointer" href="/guides/blocking-attacks">
    Manually block attackers or protect trusted IPs from WAF inspection.
  </Card>

  <Card title="Set up alerts" icon="bell" href="/guides/alerts">
    Get notified by email, Telegram, or SMS when an attack is detected.
  </Card>

  <Card title="Audit logs" icon="file-shield" href="/guides/audit-logs">
    Export tamper-proof, hash-chained logs for compliance reporting.
  </Card>
</CardGroup>