Help4 Net

Enterprise DNS, proxy, and WAF controls

Use the Help4 CDN page in your WHMCS client area to manage an owned Enterprise domain. Changes are restricted to the service and exact managed zone shown on the page.

Before changing web records: keep a copy of the current zone and confirm origin IPs. Do not remove MX, SPF, DKIM, DMARC, verification TXT, or mail host records during a website routing change.

Watch the Enterprise DNS walkthrough

A short, captioned visual walkthrough for adding one safe customer DNS record and validating it before wider use.

Captions are included. Only Enterprise services expose the DNS-record editor; use the exact provider-supplied values and leave protected routing records alone.

Choose the delivery mode

ProxyWAFResultUse when
OffOffDNS-onlyHelp4 answers DNS, but web requests do not use Help4 edge processing.
OnOffProxy-onlyYou want POP delivery and caching without WAF inspection.
OffOnWAF-onlyYou want edge security with shared caching forced off. Traffic still passes through Help4.
OnOnProxy + WAFYou want the normal Enterprise combination of delivery, cache policy, and security.
Turning the Proxy switch off does not bypass the edge when WAF remains on. WAF-only mode routes through Help4 and forces cache bypass so security rules can still run safely.

Add and edit DNS records

  1. Open Client Area > Help4 CDN and select the Enterprise service.
  2. Under DNS records, edit an existing customer record or expand Add DNS record.
  3. Enter the name, type, value, and TTL. The minimum TTL is 600 seconds.
  4. Save the record, then verify it using an authoritative Help4 nameserver before relying on public resolver caches.
Editable typesA, AAAA, CNAME, TXT, MX, SRV, and CAA.
Protected recordsHelp4-managed nameserver, DNSSEC, and internal routing records are visible but read-only.
Apex nameUse @. Apex CNAME is rejected; use A/AAAA or request managed flattening.
WildcardsUse names such as *.assets. Confirm the wildcard does not unintentionally cover mail or verification hosts.

Safe record examples

Provider verification TXTUse the exact owner and value supplied by the provider, select TXT, and start with a 600-second TTL. Do not overwrite an existing SPF, DKIM, DMARC, or verification record.
New service hostnameUse the exact subdomain and CNAME or address target supplied by that service. Verify the hostname does not overlap a mail or application endpoint before saving.

Save one record at a time. Verify it against an authoritative Help4 nameserver, for example dig +short @ns1.help4.net TXT _verify.example.com, before relying on public recursive resolvers.

GeoDNS, routing, and health checks

GeoDNS can route by country, state, city, provider, ASN, or global policy. Automatic failover removes unhealthy targets from selection when the configured health evidence fails.

Health-check URLs must use HTTPS. Test the URL directly and ensure it returns a small, stable success response without authentication.

Configure WAF and access rules

  1. Enable Web application firewall.
  2. Start with Basic/Standard. Move to Strict or High only after reviewing legitimate login, checkout, API, webhook, and upload traffic.
  3. Set the HTTP/CDN upload limit high enough for expected file uploads and the request-per-minute limit high enough for normal bursts. Standard domains can select up to 1,024 MB; LiveAndSigned can select up to 5,120 MB. RTMP and SRT live ingest sessions are separate continuous media connections and are not limited by this upload size or by a CDN session duration.
  4. Use one IP/CIDR, country code, ASN, user-agent pattern, or path per line in access-control lists.
  5. Save, then test public pages, login, forms, checkout, callbacks, and APIs.
Default Block is restrictive. When access control is enabled with Default action set to Block, only matching allow rules should pass. Confirm an operator access path before saving it.

Safe change and rollback

  1. Change one control group at a time and record the previous values.
  2. Keep WAF logging on Standard during validation.
  3. If caching causes application behavior problems, disable Proxy while leaving WAF on. This immediately selects WAF-only/no-store behavior.
  4. If WAF blocks legitimate requests, return sensitivity to Standard or temporarily disable WAF while keeping Proxy on.
  5. If both edge functions must be removed, disable both switches. DNS-only mode does not process web traffic at the Help4 edge.
Email DNS records are independent from the web Proxy and WAF switches. A delivery-mode rollback should not require changing MX, SPF, DKIM, or DMARC.

Troubleshooting

Message or symptomMeaningAction
Enterprise site not registeredThe WHMCS service exists but the exact domain is not onboarded in the control plane.Open a support ticket; do not create a second zone.
Managed zone pendingThe domain has no matching GeoDNS inventory yet.Finish zone import and nameserver readiness before enabling GeoDNS.
Record is read-onlyIt is a nameserver, DNSSEC, or Help4-managed routing record.Use a support ticket for changes that affect authoritative routing.
Origin TLS pending/warningEnd-to-end certificate or origin-guard evidence is incomplete.Do not expose the origin; complete certificate and origin allowlist validation.
Website works but email failsEmail records were changed or omitted.Compare MX/TXT records with the pre-cutover zone backup.

For delegation steps, use the DNS cutover tutorial. After cutover, complete the origin bypass-prevention checklist.