Use the Help4 CDN page in your WHMCS client area to manage an owned Enterprise domain. Changes are restricted to the service and exact managed zone shown on the page.
Before changing web records: keep a copy of the current zone and confirm origin IPs. Do not remove MX, SPF, DKIM, DMARC, verification TXT, or mail host records during a website routing change.
Watch the Enterprise DNS walkthrough
A short, captioned visual walkthrough for adding one safe customer DNS record and validating it before wider use.
Captions are included. Only Enterprise services expose the DNS-record editor; use the exact provider-supplied values and leave protected routing records alone.
Choose the delivery mode
Proxy
WAF
Result
Use when
Off
Off
DNS-only
Help4 answers DNS, but web requests do not use Help4 edge processing.
On
Off
Proxy-only
You want POP delivery and caching without WAF inspection.
Off
On
WAF-only
You want edge security with shared caching forced off. Traffic still passes through Help4.
On
On
Proxy + WAF
You want the normal Enterprise combination of delivery, cache policy, and security.
Turning the Proxy switch off does not bypass the edge when WAF remains on. WAF-only mode routes through Help4 and forces cache bypass so security rules can still run safely.
Add and edit DNS records
Open Client Area > Help4 CDN and select the Enterprise service.
Under DNS records, edit an existing customer record or expand Add DNS record.
Enter the name, type, value, and TTL. The minimum TTL is 600 seconds.
Save the record, then verify it using an authoritative Help4 nameserver before relying on public resolver caches.
Editable typesA, AAAA, CNAME, TXT, MX, SRV, and CAA.
Protected recordsHelp4-managed nameserver, DNSSEC, and internal routing records are visible but read-only.
Apex nameUse @. Apex CNAME is rejected; use A/AAAA or request managed flattening.
WildcardsUse names such as *.assets. Confirm the wildcard does not unintentionally cover mail or verification hosts.
Safe record examples
Provider verification TXTUse the exact owner and value supplied by the provider, select TXT, and start with a 600-second TTL. Do not overwrite an existing SPF, DKIM, DMARC, or verification record.
New service hostnameUse the exact subdomain and CNAME or address target supplied by that service. Verify the hostname does not overlap a mail or application endpoint before saving.
Save one record at a time. Verify it against an authoritative Help4 nameserver, for example dig +short @ns1.help4.net TXT _verify.example.com, before relying on public recursive resolvers.
GeoDNS, routing, and health checks
GeoDNS can route by country, state, city, provider, ASN, or global policy. Automatic failover removes unhealthy targets from selection when the configured health evidence fails.
Simple: ordinary record with no geographic or weighted selection.
Geo: target selected using the configured geographic scope.
Weighted: traffic divided using the record weight.
Latency: healthy target selected using current routing telemetry.
Failover: priority controls the preferred and backup order.
Health-check URLs must use HTTPS. Test the URL directly and ensure it returns a small, stable success response without authentication.
Configure WAF and access rules
Enable Web application firewall.
Start with Basic/Standard. Move to Strict or High only after reviewing legitimate login, checkout, API, webhook, and upload traffic.
Set the HTTP/CDN upload limit high enough for expected file uploads and the request-per-minute limit high enough for normal bursts. Standard domains can select up to 1,024 MB; LiveAndSigned can select up to 5,120 MB. RTMP and SRT live ingest sessions are separate continuous media connections and are not limited by this upload size or by a CDN session duration.
Use one IP/CIDR, country code, ASN, user-agent pattern, or path per line in access-control lists.
Save, then test public pages, login, forms, checkout, callbacks, and APIs.
Default Block is restrictive. When access control is enabled with Default action set to Block, only matching allow rules should pass. Confirm an operator access path before saving it.
Safe change and rollback
Change one control group at a time and record the previous values.
Keep WAF logging on Standard during validation.
If caching causes application behavior problems, disable Proxy while leaving WAF on. This immediately selects WAF-only/no-store behavior.
If WAF blocks legitimate requests, return sensitivity to Standard or temporarily disable WAF while keeping Proxy on.
If both edge functions must be removed, disable both switches. DNS-only mode does not process web traffic at the Help4 edge.
Email DNS records are independent from the web Proxy and WAF switches. A delivery-mode rollback should not require changing MX, SPF, DKIM, or DMARC.
Troubleshooting
Message or symptom
Meaning
Action
Enterprise site not registered
The WHMCS service exists but the exact domain is not onboarded in the control plane.
Open a support ticket; do not create a second zone.
Managed zone pending
The domain has no matching GeoDNS inventory yet.
Finish zone import and nameserver readiness before enabling GeoDNS.
Record is read-only
It is a nameserver, DNSSEC, or Help4-managed routing record.
Use a support ticket for changes that affect authoritative routing.
Origin TLS pending/warning
End-to-end certificate or origin-guard evidence is incomplete.
Do not expose the origin; complete certificate and origin allowlist validation.
Website works but email fails
Email records were changed or omitted.
Compare MX/TXT records with the pre-cutover zone backup.