Onboarding

1. Order and origin

Order with your primary FQDN. In the portal enter the origin: address, port, whether the origin speaks TLS and which SNI to send. Add aliases (www., other hostnames) under the same service; each alias gets its own certificate.

2. DNS

Each service gets an edge hostname in edge.protect.zeroservices.eu, derived from the primary FQDN, for example www-example-com.edge.protect.zeroservices.eu. The primary and all aliases use the same hostname.

• Subdomains: CNAME to the edge hostname. This lets us move the anycast address without you touching DNS.
• Apex (example.com): DNS forbids a CNAME, so create A and AAAA records with the anycast IPv4 and IPv6 shown in the portal.
• Keep any CAA record compatible with the ACME provider you choose.

The DNS check in the portal reads your authoritative nameservers and a public resolver and reports per hostname: ok_cname, ok_a, wrong_target, apex_cname, or not set up yet.

3. Certificate

Once the DNS check passes, request the certificate: ACME HTTP-01 through the edge, issued within minutes, renewed daily when less than 30 days remain. Or upload your own certificate and key. Details: TLS and redirects.

4. Shield the origin

Restrict your origin to our edge (IP allowlist) or connect it over IPsec, MPLS or a CrossConnect. Otherwise an attacker who knows the origin address bypasses the edge. Origin settings and health checks: Origins.

Guided onboarding with our engineers is available and billed by effort, see the terms of service.