Our name servers

Connecting through NS hands us the whole DNS of the domain: you keep the records in our panel, and the site and subdomains go through the protection with one switch.

#Our name servers

ns1.turtleguard.cloud
ns2.turtleguard.cloud
ns3.turtleguard.cloud
ns4.turtleguard.cloud

Put all four at your registrar instead of the current name servers. Only the domain itself (example.com) connects through NS, not a subdomain: for a subdomain use CNAME or A — see Connecting a domain.

Bought the domain from us? Change its NS right in the panel: Domains → Your domains → the NS button next to the domain.

#What happens on the switch

1. Add the domain in the panel and choose connecting through our NS.
2. We create @ and www records in the zone that lead to your server through the protection.
3. Add the other records — mail (MX), TXT for verifications, subdomains — yourself or upload a zone file with Import. Do it before changing NS, or mail and subdomains stop answering.
4. Change NS at the registrar.

#How the connection is checked

We ask the public resolvers 1.1.1.1, 8.8.8.8 and 9.9.9.9 which NS the domain has. It counts as connected when all our servers are listed. Extra foreign NS do not fail the check, but remove them: otherwise some visitors get answers from the old provider.

• Until NS are switched the domain shows “Waiting for DNS”. We check on our own every 5 minutes for 30 days after adding.
• No wish to wait — press Check now in domain → Settings → Connection.
• Once the check passes, the domain becomes active, the certificate is issued and you get a “domain connected” notice.

dig NS example.com +short
ns1.turtleguard.cloud
ns2.turtleguard.cloud
ns3.turtleguard.cloud
ns4.turtleguard.cloud

#DNSSEC

The zone can be signed: domain → DNS → Sign the zone. Once on, the panel shows a DS record — add it at your registrar. For domains bought from us the DS is published on its own.

If you leave us, first turn DNSSEC off and remove the DS at the registrar, then change NS: otherwise the domain stops opening at resolvers that validate signatures.

#Service records

We manage the SOA and NS records at the zone apex; there is nothing to change there. Zone transfer (AXFR) is closed. NS are cached for an hour, negative answers for 5 minutes.