Docs / Getting started
Connecting a domain
One DNS record, five minutes, the server stays where it is.
Protection is one DNS change away. Your server stays with your host; we sit between visitors and the server and forward only checked requests.
Three ways to connect
Pick one based on where the domain's DNS lives today and whether you need the apex (example.com) or a subdomain only.
| Method | What you change | When |
|---|---|---|
| NS | Name servers at the registrar to ns1.turtleguard.cloud, ns2.turtleguard.cloud, ns3.turtleguard.cloud, ns4.turtleguard.cloud | Whole domain, wildcard certificate, DNS panel with us |
| CNAME | Subdomain record to shop-lavka-ru.cdn.turtleguard.cloud | DNS stays at the registrar, one subdomain |
| A | Replace the A records with our IPs | Registrar cannot do CNAME at the apex |
Via NS
Open the domain, Settings → Connection. Put the four name servers at your registrar instead of the current ones.
dig NS example.com +short
ns1.turtleguard.cloud
ns2.turtleguard.cloud
ns3.turtleguard.cloud
ns4.turtleguard.cloudMove the records before changing NS
We create only @ and www in the zone. Add mail (MX), TXT and subdomains in DNS yourself or upload a zone file with Import — otherwise they stop answering after the NS change. See Our name servers.
How long it takes
Usually 5–30 minutes. Old NS may stay cached for up to 48 hours, but most visitors move within the first hour.
Via CNAME
shop 300 IN CNAME shop-lavka-ru.cdn.turtleguard.cloudNo CNAME at the apex
The apex cannot hold a CNAME next to SOA and NS. Use NS or A for it.
Close the origin to direct traffic
nft add set inet filter turtleguard { type ipv4_addr\; flags interval\; }
nft add element inet filter turtleguard { <node addresses> }
nft add rule inet filter input tcp dport { 80, 443 } ip saddr != @turtleguard dropOur node addresses for the site are in the panel: domain → Settings → Connection.
Next
Pick a protection mode and watch the request log for a day.