TurtleGuard runs authoritative DNS for its customers. Once the zone is delegated at your registrar we become the single source of truth for it — which buys you fast updates (propagation under 60 seconds), DNSSEC and a proxy switch on any A/AAAA/CNAME record.
Our name servers
At your registrar, replace the name servers with these:
ns1.turtleguard.cloud
ns2.turtleguard.cloud
ns3.turtleguard.cloud
ns4.turtleguard.cloudThe servers are announced by anycast, so a resolver reaches the closest one. Propagation from the registrar usually takes from 5 minutes to 48 hours, depending on the registrar and on the TTL of the previous name servers.
Alternative: the A-record mode
If you would rather not delegate the zone, keep DNS where it is and simply point the A record of the domain at the IP address of our edge. We then do not manage the zone and you keep editing records at your provider. The trade-offs: no proxy switch on individual records, and no automatic update when edge nodes change.
Supported record types
| Type | What it holds | Proxy |
|---|---|---|
A | IPv4 address of your server | yes |
AAAA | IPv6 address of your server | yes |
CNAME | Alias to another domain | yes |
MX | Mail exchanger and priority | — |
TXT | SPF, DKIM, verification records | — |
SRV | Service location | — |
CAA | Certificate authority authorisation | — |
NS | Delegation of a sub-zone | — |
The proxy switch
Every A / AAAA / CNAME record in the DNS manager has a proxy switch. When it is on:
- DNS answers with the edge address instead of your own.
- Your real address stays out of public DNS answers.
- Traffic goes through request inspection and the CDN before it reaches your server.
With the switch off the record behaves like ordinary DNS — it points straight at your server, with no protection in front of it.
Availability: the proxy switch needs an entitlement — the Standart plan or higher, or the separate dns_proxy add-on ($5/mo). See the plans.
DNSSEC
Zone signing is switched on automatically when the zone is delegated to us (Standart and above). To close the chain of trust, add the DS record with the public key at your registrar — we show it in the DNS manager once the zone is created.
Algorithms: ECDSAP256SHA256 (KSK and ZSK), with the ZSK rotated every 90 days automatically.
TTL and propagation
- Automatic TTL (the default) is 300 seconds and fits most cases.
- Minimum — 60 seconds.
- Maximum — 86400 seconds (one day).
Inside our network a change spreads almost immediately (under 60 seconds). For outside resolvers, propagation is bounded by their cache and the previous TTL.
Importing an existing zone
If the zone is already set up at your current provider and you would rather not copy records by hand, the panel has an Import from registrar button: you give it the current name servers, we pull an AXFR (when it is allowed) or resolve everything we can find one by one, and create the records in our zone before delegation.
API
Everything here is available over the REST API. See REST API · DNS manager.
Something wrong with DNS? Write to dns@turtleguard.cloud and name the domain — we usually answer within an hour.