The DNS cutover

The A record to change, and the three traps that cost the most time.

5 minUpdated Aug 16, 2026

This is when your traffic actually starts flowing through the firewall. One record to change:

Type	Name / Host	Value	TTL
A		"@" means the domain root. Some panels want an empty field or the full domain.	300

A low TTL (300 seconds) speeds up propagation during the cutover and lets you roll back quickly if needed. You can raise it afterwards.

The three traps

1. AAAA (IPv6) records

Delete them. If your domain keeps an AAAA record pointing at your old server, every IPv6 visitor — a large share of mobile traffic — keeps going straight to you with no protection. The site looks fine, and half the traffic escapes the firewall.

2. Only one record on "@"

An ALIAS/CNAME and an A record cannot coexist on the same name — that is the "ALIAS must not be used with A" error. Delete the existing one *before* creating the new one. On some hosts an ALIAS to a domain like …cdn.hstgr.net is there by default.

3. Leave your email alone

MX, SPF and DKIM records have nothing to do with the web and do not go through Zyre. Changing or deleting them would break your email for no benefit.

Check that it took effect

The wizard checks for you: it queries your domain and looks for the marker our proxy adds to every response. While it is missing, propagation is not finished — allow from a few minutes to 48 hours.

During propagation your site stays reachable the whole time. Some visitors still go direct, others already go through the firewall: both see the same site.