A domain is connected to TurtleGuard in one of three ways. DNS with us is a separate service: you do not have to move it. If you do not need our DNS manager, it is enough to send traffic to our edge with an A record or a CNAME and leave the zone at your current registrar.
In all three the path of a request is the same: visitor → DNS → edge (inspection/CDN) → your server. What changes is only how traffic finds the edge. The way is chosen when you order the service and is shown in the domain card.
Side by side
| Way | What you change | Root domain | Several edges | DNS with us | Who it is for |
|---|---|---|---|---|---|
| Delegation | NS records at the registrar | yes | automatic | yes | I want full DNS with you |
| A records | the A record(s) of the domain | yes | by hand (all IPs) | no | I would rather not move DNS |
| CNAME | a CNAME on a subdomain | no — subdomain only | automatic (alias) | no | I am protecting one subdomain |
1. Delegation · what we recommend
At your registrar you replace the name servers with ours, and we become the single source of truth for the zone:
ns1.turtleguard.cloud
ns2.turtleguard.cloud
ns3.turtleguard.cloud
ns4.turtleguard.cloudWhat that gives you:
- Full control of the zone from the panel — records of every type (A/AAAA/CNAME/MX/TXT/SRV/CAA).
- Several edges out of the box: our DNS hands out the addresses of the nearest live nodes and takes the dead ones out by itself.
- A proxy switch on any record, DNSSEC, and propagation under 60 seconds inside our network.
- Works for the root (
example.com) and any subdomains at the same time.
In detail: DNS · name servers.
2. A records
DNS stays with your provider. You only change the A record of the domain to the addresses of our edge servers. The panel gives you the list of every edge address that is online — add them all:
example.com. A 203.0.113.10
example.com. A 203.0.113.20
example.com. A 203.0.113.30- The browser rotates through the addresses on its own — simple load spreading without moving DNS.
- Works for the root domain and for subdomains.
- Trade-offs: you keep the list of nodes up to date by hand (when a node is added or taken out), and there is no proxy switch on individual records.
Keep the TTL short (300 seconds) so that a change of edge address is picked up quickly.
3. CNAME · subdomains only
To protect a subdomain (say shop.example.com) without moving DNS, create a single CNAME record pointing at the target we give you when you order:
shop.example.com. CNAME a1b2c3d4.edge.turtleguard.cloud.- Behind that alias our DNS answers with every edge address that is online — several edges and the removal of dead nodes happen on their own, and you never touch the list.
- ⚠️ A CNAME on the root domain is forbidden by the RFC (
example.comwith no subdomain). For the root, use delegation or A records.
Certificates
In all three, the TLS certificate is issued automatically(Let's Encrypt) as soon as the domain starts resolving to our edge. There is nothing to upload. If you prefer, you can upload your own certificate in the domain card (the custom mode).
Which to choose
- You want our DNS manager, or you are protecting the whole domain → delegation.
- You do not want to move DNS, but protect the whole domain → A records.
- You are protecting a single subdomain → CNAME.
The way can be changed later — write to support. The instructions with the current addresses are always in the domain card in the panel.
Questions about setup — contact@turtleguard.cloud, about DNS — dns@turtleguard.cloud.