Point your DNS at us
The no-code install: change two nameservers and enforcement runs in front of your site.
Every other install puts our code in your request path: a middleware, a worker, a pasted Snippet, a proxy config. This one puts your domain in ours. You change two nameservers at your registrar; we hold the zone, run the edge in front of your site, and pass allowed traffic on to the origin you already have.
No package, no deploy, no API key. It is also the biggest step of the four, because while it is in place we answer DNS for that domain: website, email, everything. Read the two trade-offs before you start.
How it compares to an SDK install
| Nameservers | An SDK install | |
|---|---|---|
| What you change | two nameservers at your registrar | code or config you deploy |
| What you run | nothing | a middleware, worker, Snippet, or proxy |
| API key | none; the domain identifies you | one per environment |
| Who answers DNS for it | us | you, unchanged |
| What enforcement covers | traffic that reaches our edge | traffic that reaches the code you installed |
| Time to first request | a nameserver change, then propagation | a deploy |
Everything downstream is identical: the same proof
ladder, the same observe-first default,
the same 403 on a blocked request, the same decision call, failing open by
default.
Connect a domain
- In the dashboard, open Install → Point your DNS at us, enter the domain, and press Connect domain.
- We create the zone and scan your current DNS, importing every record the scan finds. The page tells you how many it imported. No count means the scan failed: treat the zone as empty, stop here, and write to hello@d3.com rather than moving your nameservers onto it.
- Review the imported records before you touch your registrar. A scan reads what is published and can miss a record nothing queries; whatever it missed stops resolving the moment your nameservers move. The zone's Review imported DNS records button is the list.
- Set the two nameservers we show at your registrar. Propagation usually takes minutes and can take hours. The Install page re-checks each time you open it and shows Live once the change has landed.
- Hit your site and watch the request land.
If a domain shows Not enforcing, its zone exists but our edge is not in front of it yet, so nothing is being logged. That one is ours, not yours: press Put us in front, and write to hello@d3.com if it doesn't take.
A domain lives in exactly one Cloudflare account, so if yours is already in your own Cloudflare account we can't take the zone over. Install an SDK there instead.
After the switch
We are your DNS provider for that domain. Manage DNS records on the zone is where records live, MX and TXT included, and a change takes effect as soon as it saves. Your origin stays exactly where it is.
Leaving is your move alone: point the nameservers back at your old provider at your registrar. You don't need to ask us, and nothing about your origin has to change.
Two things to weigh first
DNS has no fail-open. Every other install is built so that our failure can't take your site down: the decision call has a hard budget, and by default a call that misses it passes the request. That still holds here for decisions. It cannot hold for DNS. While we are authoritative for your domain, our mistake is your domain's mistake, and that includes mail. This is why the install is deliberate, opt-in, and reversible without us.
Enforcement covers the traffic that reaches us. If your origin keeps a public address, anything that knows it connects straight there and never passes our edge. That is true of every reverse proxy, not something particular to us. The usual locks (an origin that demands the edge's client certificate, or a firewall pinned to the edge's IP ranges) need an edge you control, so on a platform that gives you neither, read delegated enforcement as covering your public hostname rather than your origin.
The DNS trade-off is this install's alone. Origin exposure belongs to any install that proxies in front of an origin, ours or a worker of your own; a middleware that runs inside the origin itself (Vercel, nginx) can't be walked around this way. If either rules this install out for you, the SDKs get you the same classification with code instead.