{"article":{"id":"2664aef954388da03a97b6eb9b0eecb0","categorySlug":"ddos-layer7","slug":"layer7-dns-records","title":"Manage DNS records","excerpt":"Add, edit and delete your domain's DNS records, decide which ones run through SprintCDN protection, and pick sensible TTLs.","body":"When a domain is protected by SprintCDN, we also answer its DNS — the public directory entries that tell the internet where to find your website, your mail server and other services. You manage all of those entries from the **DNS** tab of your domain, and every change goes live from our edge network within moments.\n\n# Open the DNS tab\n\n1. In the portal sidebar, click **Layer 7 Protection**.\n2. Find your domain in the list and click **Manage**.\n3. In the tab bar, click **DNS**.\n\n![The DNS tab: the DNS Records table with A, CNAME, MX and TXT records, proxy toggles and the Add Record button](/assets/kb/layer7/dns-tab.png)\n\nThe **DNS Records** table shows every record with its Type, Name, Value, Priority, TTL and Proxy setting. If your domain is still pending activation, a **Nameservers** card also appears with the two nameservers to set at your registrar (each with a copy button) — see [Add and activate a domain](/kb/onboard-a-domain) for that step. The card disappears once the domain is active.\n\n# Record types you can add\n\n- A — points a name to an IPv4 address (for example your web server).\n- AAAA — the same, for an IPv6 address.\n- CNAME — an alias: points one name at another name instead of an address.\n- MX — where email for the domain is delivered. MX records have a Priority field (default 10; lower numbers are tried first).\n- TXT — free-form text, used for things like domain verification and email rules such as SPF.\n- SPF — a legacy record type for SPF email policy; most setups use a TXT record instead.\n- SRV — tells specific applications (such as VoIP or chat services) which host and port to use.\n- CAA — restricts which certificate authorities may issue certificates for your domain.\n\nNS records are managed by the platform for you, so they do not appear in the type list.\n\n# Add, edit or delete a record\n\n1. Click **Add Record**. A new row appears with sensible defaults: type A, name @, TTL 300, proxy on.\n2. Fill in the fields. In the Name column, @ means the domain itself (example.com); anything else is a subdomain — entering www creates www.example.com.\n3. Click outside the field when you are done. Changes save automatically as soon as a field loses focus, and you will see \"DNS record changes saved.\" A save button next to **Add Record** lets you save on demand as well.\n4. To remove a record, click the red trash icon in its row — the deletion is saved immediately.\n\n# Proxied or DNS only\n\nA and AAAA records have a pill toggle in the Proxy column. Orange means proxied: visitors are routed through SprintCDN's edge, so that name gets DDoS protection and CDN caching, and your server's real address stays out of public DNS. Gray means off: the record answers with exactly the address you entered and traffic goes straight to your server. All other record types show a static \"DNS only\" label and cannot be proxied — that includes CNAME records. The toggle saves immediately when clicked.\n\nRemember that on proxied names your server sees connections arriving from our network — the real visitor address is delivered in a request header; see [See real visitor IPs at your origin](/kb/restore-visitor-ip).\n\n\u003e Proxying is for web (HTTP/HTTPS) traffic. Keep names that serve anything else — such as the host your MX record points to — set to DNS only, or that service will stop working.\n\n# Choosing a TTL\n\nTTL (time to live) is how long, in seconds, other DNS servers may cache an answer before asking again. The dropdown offers values from 60 (1 minute) to 86400 (1 day); the default is 300 (5 minutes). A short TTL makes future changes take effect faster; a long TTL means slightly fewer lookups. Keep the TTL low while you are still adjusting a record, and note that after any change, visitors may see the old value until the previous TTL runs out.\n\n# A typical website setup\n\n- An A record, name @, pointing at your web server's IPv4 address, with the proxy toggle on — this serves example.com with protection.\n- A CNAME record, name www, value example.com — so www.example.com follows the root domain.\n- Your mail records unchanged: an MX record for the domain plus a TXT record with your SPF policy, both DNS only.\n\nIf a record will not save, or a change is still not resolving long after its TTL has passed, open a ticket from **Tickets** in the portal and include the record's type, name and value.","status":"published","position":3,"createdAt":"2026-07-15T11:11:28Z","updatedAt":"2026-07-15T11:11:28Z"},"related":[{"id":"3c957f1eb4f18ad99ec8321181388611","categorySlug":"ddos-layer7","slug":"how-layer7-works","title":"How Layer 7 (WAF + CDN) protection works","excerpt":"What happens to your website's traffic once it flows through SprintCDN — edge filtering, caching, the response headers that prove it, and a tour of the domain tabs.","position":1,"status":"published"},{"id":"1344486297d80aa77c3ca73565f66380","categorySlug":"ddos-layer7","slug":"onboard-a-domain","title":"Add and activate a domain","excerpt":"Add your website with the four-step wizard, point your nameservers to SprintCDN, watch the domain turn ACTIVE, and learn how paid plans and domain deletion work.","position":2,"status":"published"},{"id":"9d6e6d87f6b30944c557ac283c299464","categorySlug":"ddos-layer7","slug":"layer7-ssl-https","title":"SSL/TLS: certificates and HTTPS settings","excerpt":"Check your domain's automatically issued certificate, choose an encryption mode, force HTTPS, enable HSTS, set a minimum TLS version or upload your own certificate.","position":4,"status":"published"},{"id":"7dddee9e812cee27974eeef5b8348637","categorySlug":"ddos-layer7","slug":"restore-visitor-ip","title":"See real visitor IPs at your origin","excerpt":"Read the real visitor address from the SC-Connecting-IP header, restore it in nginx if you like, and firewall your origin so only our edge network can reach it.","position":5,"status":"published"},{"id":"20257581bfbfebcc316b9fc1fdb6a3ce","categorySlug":"ddos-layer7","slug":"layer7-cache","title":"Control caching","excerpt":"Tune what SprintCDN caches for your domain, purge stale content, bypass the cache while developing, and verify cache hits with the sc-cache-status header.","position":6,"status":"published"}]}