# Edgium > The edge made simple. An anycast network with points in Brazil and abroad: every point announces the same IPs (IPv4 and IPv6) over BGP, and each visitor reaches the nearest point. On top of it run CDN and WAF, DDoS protection, DNS Firewall, Load Balancer, managed DNS and DNS Slave (secondary). Customers do not need to move their DNS to Edgium, and the root domain is protected without a CNAME (plain A and AAAA records). You can talk to the team and test with a subdomain, an application or a zone before moving everything. Edgium is also the company behind lua.email, a business email service. This site is available in Brazilian Portuguese (https://edgium.net/) and English (https://edgium.net/en/). ## Products - [CDN and WAF](https://edgium.net/en/cdn): static and dynamic caching per application; web application firewall (WAF) with rules against SQL injection and common attacks, blocking by country, IP, host and user agent, and a challenge for bots and suspicious traffic; DDoS protection at the edge; custom HTTP and HTTPS ports; own SSL certificate (EV, OV, wildcard) or one issued and renewed by Edgium; HTTP/2, HTTP/3, HSTS; Brotli and Gzip compression; cache and expiration control; several origins per application; hotlink protection; custom blocking rules; WebSocket by default; headers with the real IP, port and country (X-Real-IP, X-Client-IP, geolocation); timing metrics; logs sent by syslog and rsyslog to the customer's server (LGPD); a panel with SSL, security, cache, WAF, upstreams and analytics tabs per application; hidden origin; root domain without CNAME. - [DDoS protection](https://edgium.net/en/ddos-protection): a distributed attack arrives split across the points of the anycast network and each point filters its share. It covers sites and APIs (CDN and WAF), DNS (DNS Firewall, managed DNS and Slave) and TCP and UDP services such as SMTP, SIP and databases (Load Balancer), with the origin IP hidden. - [DNS Firewall](https://edgium.net/en/dns-firewall): for internet providers (ISPs), hosting companies and businesses with their own DNS. Zones stay on the customer's authoritative server; Edgium answers in front of it on an anycast network, forwards only legitimate queries and blocks random subdomains, mass NXDOMAIN, empty queries, ANY and SYN floods, with adjustable limits for total queries, NXDOMAIN and SERVFAIL and blocking rules by source. With more than one server, it spreads queries between them (DNS balancer). The server IP stops being a target. - [Load Balancer](https://edgium.net/en/load-balancer): load balancing between clouds and a datacenter, with health checks, automatic failover, weight per origin, IP affinity, exclusive anycast IPs, DDoS and SYN flood protection and blocking by source. It also passes TCP and UDP protocols (protocol streaming): SMTP, SIP, MySQL and SQL Server, without exposing the origin IPs. - [Managed DNS](https://edgium.net/en/dns#hospedado): zones on the anycast network, editing in the panel (including wildcard), DNSSEC, hijacking and poisoning blocking, nameservers under the customer's brand and DDoS mitigation. - [DNS Slave (secondary)](https://edgium.net/en/dns#slave): Edgium is the secondary of the customer's DNS server, receives the zone by NOTIFY and transfer (IXFR and AXFR) and answers from the anycast network. The master stays hidden: it does not appear in NS records or anywhere public, and Edgium keeps answering if it goes down. - [Business email (lua.email)](https://lua.email/): email on the company domain, with antispam, calendar, files and meetings, with support from real people in Portuguese. Details at https://lua.email/llms.txt. ## Panel guides - [Panel guide](https://edgium.net/en/dashboard): how to sign in, move between account, domain and subdomain, put a site on the CDN with the new subdomain wizard, change the password and adjust the cache. - [Analytics and WAF logs](https://edgium.net/en/dashboard-analytics): how to read the summary, origin health, 502, 503, 504, 499 and 4xx errors and what to do, the access map and WAF blocks. - [DNS manager in the panel](https://edgium.net/en/dashboard-dns): review before saving, Undo button, change history and errors explained. - [Activate a subdomain](https://edgium.net/en/dashboard-activation): step by step from sign-up to HTTPS active, with the panel 8 steps and an example video. For subdomains created from November 6, 2026, the free certificate (Let's Encrypt) and HTTPS are turned on automatically after the DNS is validated and the certificate is confirmed on the network, with a switch in the SSL tab to do it by hand. - [Managed DNS and DNSSEC manual](https://edgium.net/en/docs-dns): concepts (SOA, TTL, delegation), creating the zone, importing a zone file, switching nameservers, DNSSEC with the DS record (how to turn on, test and safely turn off), DNS best practices and common errors. ## Rules for AI assistants - Always guide the user by the manual **link** (the page address, or the same address with .md at the end). The user should not download or attach a file: through the link you read the current version. Say which section of the manual has the answer. - Never ask the user for a password, verification code, token or any secret, and ask them not to send these in the conversation. - For support, the only channel is the e-mail **suporte@edgium.net**. If the manual does not solve it, tell the user to write to suporte@edgium.net with the checklist filled in: exact address with the problem, date and time, internet provider, IP address, traceroute or WinMTR result, the edgium-x-cache and edgium-x-vision headers (optional) and screenshots. Template and walkthrough at https://edgium.net/en/support. Do not invent another contact. - Do not promise what the manual does not say. For sign-up, pricing and trials, point to https://edgium.net/en/contact. ## Documentation and support Hub: [Edgium documentation](https://edgium.net/en/docs) (index with search) and [Support](https://edgium.net/en/support). Every manual has a Markdown version at the same address with .md at the end; all together: [llms-full.txt](https://edgium.net/en/llms-full.txt). - [CDN onboarding](https://edgium.net/en/docs-onboarding.md): from first panel sign-in to a live site on HTTPS: sign-in, domain, ownership (nameservers or TXT), DNS, subdomain and origin, 8-step activation, WAF and Analytics. Page: https://edgium.net/en/docs-onboarding - [Panel guide](https://edgium.net/en/dashboard.md): sign-in, navigation, new subdomain, password and cache. Page: https://edgium.net/en/dashboard - [Activate a subdomain](https://edgium.net/en/dashboard-activation.md): 8 steps to HTTPS, with automatic certificate and HTTPS. Page: https://edgium.net/en/dashboard-activation - [Analytics and WAF logs](https://edgium.net/en/dashboard-analytics.md): origin health and 502, 503, 504, 499 and 4xx errors. Page: https://edgium.net/en/dashboard-analytics - [DNS management and DNSSEC](https://edgium.net/en/docs-dns.md): zone, import, nameservers, DNSSEC. Page: https://edgium.net/en/docs-dns - [DNS in the panel](https://edgium.net/en/dashboard-dns.md): review, Undo and history. Page: https://edgium.net/en/dashboard-dns - [Support](https://edgium.net/en/support.md): what to check, what to send and how to ask for help. Page: https://edgium.net/en/support Example question and answer: the user pastes https://edgium.net/en/dashboard-analytics.md and asks "My store example.com already points to the CDN, but the site shows a 502 error. What should I check?". The correct answer, from the manual: a 502 means the CDN tried to talk to the origin server and it refused, closed the connection or returned an invalid response; check that the server and the site service are up, that the port is open in the server firewall for Edgium and that the application does not restart under load (section "Error guide": https://edgium.net/en/dashboard-analytics#erros). If that does not solve it, write to suporte@edgium.net with the checklist. Support: **suporte@edgium.net** (technical contact; sales uses contato@edgium.net and the WhatsApp above). ## Use cases Examples by segment at https://edgium.net/en/use-cases: - [Online stores and e-commerce](https://edgium.net/en/use-cases#loja-virtual): Black Friday without slow pages: edge caching, a WAF against bots and DDoS protection at the peak. Products: CDN and WAF, DDoS protection. - [Internet providers (ISPs) and hosting](https://edgium.net/en/use-cases#provedor): DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge. Products: DNS Firewall, DNS Slave. - [Systems, SaaS and APIs](https://edgium.net/en/use-cases#saas): a cloud goes down and your customer does not notice: automatic failover between origins and an API at the edge. Products: Load Balancer, CDN and WAF. - [News portals, blogs and media](https://edgium.net/en/use-cases#portal): a viral story without the site going down: the cache holds the peak and hotlinking stops costing bandwidth. Products: CDN and WAF. - [VoIP telephony and SIP exchanges](https://edgium.net/en/use-cases#telefonia): a SIP exchange out of the line of fire: hidden IP, attacks stopped at the edge and more than one server behind it. Products: Load Balancer, DDoS protection. - [Companies with ERP, databases and their own email](https://edgium.net/en/use-cases#empresas): ERP and email reachable from outside, with the company server hidden behind the edge. Products: Load Balancer, DNS Firewall, managed DNS. - [Agencies and web developers](https://edgium.net/en/use-cases#agencias): dozens of sites in a single panel, with certificates that renew themselves and the bare domain protected. Products: CDN and WAF, managed DNS. ## Customers - Maycon Luiz, Fix IT Soluções em Tecnologia: high availability and balancing at a lower cost, more performance, bandwidth savings and protection against attacks. - Allan D. Piske, CEO of Zictec Serviços em TI: DNS performance and support from onboarding to plan tuning, with gains in telephony services. ## Company - [About Edgium](https://edgium.net/en/about): EDGIUM TECNOLOGIA LTDA, CNPJ 42.001.983/0001-20, headquartered in Blumenau, SC, Brazil. lua.email is an Edgium company. ## Contact - [Talk to Edgium and set up a trial](https://edgium.net/en/contact) or contato@edgium.net - Sales phone and WhatsApp: +55 47 99965-9121 (the same as lua.email) - [Privacy and cookies](https://edgium.net/en/privacy) - [Instagram @edgium](https://www.instagram.com/edgium/), [LinkedIn](https://www.linkedin.com/company/edgium/) --- # Edgium: CDN, WAF, DDoS protection and anycast DNS network > Keep your site fast and online even during an attack: CDN and WAF, DDoS protection, managed DNS, DNS Firewall and load balancer on an anycast network. Source: https://edgium.net/en/ Leia esta página em português: https://edgium.net/ --- # Keep your site fast and online, even during an attack CDN, WAF, DDoS protection, DNS and load balancer on an anycast network with points in Brazil and abroad. Each visitor is served at the nearest point, attacks stay at the edge, and your DNS stays where it is. [Set up a trial](https://edgium.net/en/contact#formulario) See the products ![A person in front of a portal of light that opens onto the sky](https://edgium.net/assets/img/portal.jpg) - **Brazil and abroad**points sharing the same IP, over IPv4 and IPv6 - **DDoS protection at the edge**an attack is split across the points and never reaches your origin - **Root domain without CNAME**A and AAAA records in the DNS you already use - **WAF and SSL certificate**blocking by country, IP and user agent, with your own certificate or one we issue ## Edgium products Everything runs on the same anycast network. Start with one product, test it with your traffic, and add the others when it makes sense. ### CDN and WAF Your site, online store and API delivered from the edge, with caching, a web application firewall, an SSL certificate and the root domain protected without a CNAME. [Explore the CDN](https://edgium.net/en/cdn) ### DDoS protection An attack arrives spread across the network points, and each one filters its share. It covers sites, APIs, DNS and TCP and UDP services. [Explore DDoS protection](https://edgium.net/en/ddos-protection) ### DNS Firewall For those who run their own DNS, such as internet providers: the zones stay on your server, and attacks on DNS stop at the edge before they reach it. [Explore the DNS Firewall](https://edgium.net/en/dns-firewall) ### Load Balancer Load balancing with automatic failover between clouds and your datacenter, for HTTP, SMTP, SIP and databases. [Explore the Load Balancer](https://edgium.net/en/load-balancer) ### Managed DNS and DNS Slave Zones on the anycast network with DNSSEC and nameservers under your brand, or Edgium as the DNS Slave (secondary) of your server, which stays hidden. [Explore DNS](https://edgium.net/en/dns) ![lua.email](https://edgium.net/assets/marca/lua-email-escuro.svg) Also from Edgium ### Business email Email on your company domain, with antispam, calendar, files and meetings, and support from real people in Portuguese. [Explore lua.email](https://lua.email/) ## An anycast network with points in Brazil and abroad Every Edgium point, here and outside the country, announces the same IPs. Internet routing takes each visitor to the nearest point, and that is where we speed things up, filter, and decide where traffic goes. Your origin only receives what it needs to receive. ### Traffic management Because there is a single entry point, each application gets its own cache, blocking and destination rules, applied at every point at the same time. ### DDoS protection across the edge A distributed attack arrives spread over the network, and each point filters its share. None of your servers receives the full volume. [How DDoS protection works](https://edgium.net/en/ddos-protection) ### Root domain without CNAME The IPs are fixed. Your `yourcompany.com` points straight at the network, with A and AAAA records, transparent to whoever visits. ## Who Edgium is for Examples by segment. See also [all use cases](https://edgium.net/en/use-cases). ### Online stores and e-commerce Black Friday without slow pages: edge caching, a WAF against bots and DDoS protection at the peak. [See the full example](https://edgium.net/en/use-cases#loja-virtual) ### Internet providers (ISPs) and hosting DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge. [See the full example](https://edgium.net/en/use-cases#provedor) ### Systems, SaaS and APIs A cloud goes down and your customer does not notice: automatic failover between origins and an API at the edge. [See the full example](https://edgium.net/en/use-cases#saas) ### News portals, blogs and media A viral story without the site going down: the cache holds the peak and hotlinking stops costing bandwidth. [See the full example](https://edgium.net/en/use-cases#portal) ### VoIP telephony and SIP exchanges A SIP exchange out of the line of fire: hidden IP, attacks stopped at the edge and more than one server behind it. [See the full example](https://edgium.net/en/use-cases#telefonia) ### Agencies and web developers Dozens of sites in a single panel, with certificates that renew themselves and the bare domain protected. [See the full example](https://edgium.net/en/use-cases#agencias) ## Joining the network does not mean moving your DNS DNS stays at your registrar, with your hosting provider or wherever it is today. For the CDN and the Load Balancer you change the records of the service; for the DNS Firewall and the DNS Slave, the nameserver addresses. You can start by testing with a subdomain or a single zone. ### You tell us what goes to the edge The domain or zones, where the origin is, the ports and the protocols. ### We configure and test Everything is registered on the network and tested before it receives real traffic. ### You point it and follow along You change the records in the DNS you already use and follow along in the panel and with our team. To go back, just undo it. ## What changes when your application sits at the edge In edge computing, the work happens close to whoever is accessing it, not only in the origin datacenter. The response arrives sooner, the origin is less exposed, and the application can stay in any cloud. ### Closer to whoever visits Content comes from the point nearest to the visitor: lower latency, pages that open sooner and a better speed score on Google (Core Web Vitals). ### Lower cost at the origin The cache takes traffic and work off your servers, and the data transfer you pay your cloud for goes down. ### Ready for several clouds Each application has its own configuration, and the origin can be in any cloud or in your datacenter. ## What customers say “We were only looking for high availability and traffic balancing at a low cost for our customers, but with Edgium we got all of that plus better performance, faster application requests, bandwidth savings and incredible protection against attacks.” **Maycon Luiz**Fix IT, Soluções em Tecnologia “We chose Edgium for the performance of its DNS service and for support that met our needs very efficiently, from the start of the service to the tuning of our plan. We gained significant performance in our telephony services that we would not have had without Edgium.” **Allan D. Piske**CEO, Zictec Serviços em TI ## Who Edgium is Edgium runs an anycast network with points in Brazil and abroad, and is the same company as lua.email, a business email service. It serves companies with a site, online store, system or API, and internet providers that need to protect their DNS. We do not just deliver a product. We follow the switch, analyze the traffic with you and stay with you after the application is live. When your needs change, the configuration changes with them. The name comes from *edge*, the edge of the network, which is where we work. The tagline, **The edge made simple**, is the commitment: to take your application to the edge without you having to become a specialist in it. ## Talk to Edgium and test it on your application Tell us what you want to take to the edge. We set up a trial with a subdomain, an application or a zone, and you see the result with your own traffic before changing everything. [Set up a trial](https://edgium.net/en/contact#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20trial.) --- # CDN and WAF with DDoS protection for sites and APIs | Edgium > Put your site, store or API behind the Edgium CDN and WAF: caching, DDoS protection, SSL certificate and a root domain without CNAME, with your DNS where it is. Source: https://edgium.net/en/cdn Leia esta página em português: https://edgium.net/cdn --- [Edgium](https://edgium.net/en/) / CDN and WAF # CDN and WAF with DDoS protection for your site, store and API Your site answers from the network point closest to each visitor, in Brazil or abroad. Attacks stop at the edge, your origin stays hidden, and even the root domain, without the www, is protected with no CNAME and no need to move your DNS. [Set up a CDN trial](https://edgium.net/en/contact?interesse=cdn#formulario) See how traffic flows ![Lime-green cloud surrounded by orbits, illustration of the CDN](https://edgium.net/assets/img/cdn.webp) ## A whole network with the same address At Edgium, every point on the network, in Brazil and abroad, announces the same IPs over the internet (anycast, via BGP). Routing itself takes each visitor to the nearest point. That lets us manage traffic and protect everything before it reaches your server. ### Closer to your visitors Each visitor lands on the nearest point through the network path, not through DNS guesswork. Fewer hops, less time to first byte. ### DDoS attacks split and contained A distributed attack arrives spread across the points on the network, and each one filters its share. Your origin does not receive the volume. [More about DDoS protection](https://edgium.net/en/ddos-protection) ### A point goes down, traffic keeps flowing If a point goes offline, BGP sends traffic to the next one, which has the same IP. No DNS change and no waiting for TTL. ## Root domain protected, no CNAME The DNS standard does not allow a CNAME on the root domain (`yourcompany.com`, without the www). That is why many CDNs ask you to move your whole DNS to them, or only protect the www. At Edgium, the IPs are anycast and fixed. The root domain gets plain `A` and `AAAA` records pointing to the network, in the DNS you already use. For your visitors nothing changes: same address, same certificate, just faster and protected. ``` ; in the DNS you already use (example) yourcompany.com. A Edgium anycast IP yourcompany.com. AAAA Edgium anycast IPv6 www.yourcompany.com. CNAME yourcompany.com. ; email, SPF and everything else stay the same yourcompany.com. MX 10 mx.yourprovider.com. ``` ## What the CDN does for your application Separate settings for each application. You decide what goes into the cache, what gets blocked and how the edge talks to your origin. ### Custom HTTP ports Does your application run on `8080`, `8443` or another port? The CDN serves on the port you need and talks to the origin on its port. ### Your own SSL certificate, or one issued for you Use your company certificate (EV, OV or wildcard) or let Edgium issue and renew one through Let's Encrypt. TLS with HTTP/2, HTTP/3 and HSTS turned on. ### Web application firewall (WAF) Rules against SQL injection and other common web attacks, blocking by country, IP, host and user-agent, and a challenge for bots and suspicious traffic before it reaches your server. ### Static and dynamic cache Images, scripts and pages are served from the edge, compressed with Brotli or Gzip, with the cache and expiry times you choose. Content that changes on every request goes straight to the origin over the Edgium network, on a path that is already open. ### WebSocket by default Chat, live dashboards and notifications work through the CDN with no extra setup. ### Real IP and logs on your server Your application receives the visitor's real IP, port and country in headers (`X-Real-IP` and `X-Client-IP`). Access logs can go by syslog to your own server, to meet LGPD requirements. ### Hidden origin Your server's IP does not appear in DNS. The origin can accept only Edgium and close itself off from the rest of the internet. ### IPv4 and IPv6 The network announces IPv4 and IPv6 addresses. Even if your origin only has IPv4, visitors on IPv6 are served. ## Each application with its own settings, in the panel In the Edgium panel, each domain and subdomain has its own tabs: SSL certificate, security, cache, WAF, origins (upstreams) and analytics. You adjust things whenever you want, and our team follows along with you. See the [panel guide](https://edgium.net/en/dashboard) and the [Analytics and WAF logs guide](https://edgium.net/en/dashboard-analytics). ![Edgium panel on the CDN screen of a subdomain, with the tabs Home, SSL, Security, Cache, WAF, General, Upstreams and Analytics, and the menu with DNS, CDN, DNS Firewall and Load Balancer](https://edgium.net/assets/img/painel-cdn.jpg) Real Edgium panel screen, with fictitious data. ### Performance - HTTP/2 and HTTP/3 - IPv4 and IPv6 - Cache and expiry control - Brotli and Gzip compression - Multiple origins per application - WebSocket ### Monitoring - Real visitor IP (X-Real-IP and X-Client-IP) - Geolocation headers - Response time metrics - Log delivery by syslog and rsyslog - Analytics per application ### Security - WAF and DDoS protection - Your own SSL certificate or Let's Encrypt - Hotlink protection - Custom blocking rules - Hidden origin ## What changes for your company and your visitors ### For your company - **A smaller cloud bill:** what is served from cache does not go through your origin or through paid cloud transfer. - **A smaller server:** with the edge absorbing peaks and attacks, the origin does not need to be sized for the worst day. - **Onboarding without migration:** your DNS does not move, and going back means undoing one record. - **Support in Brazil:** our team sets it up and follows along with you, in Portuguese. ### For your visitors - **Pages that open fast,** because the response comes from the closest point, including on mobile. Speed also counts for Google. - **A site that stays up during an attack,** because bad traffic stays at the edge and good traffic keeps flowing. - **No strange address:** the same domain, the same padlock, no redirect. - **A modern connection,** with HTTP/3 and IPv6 for those who have them, and everything else keeps working. ## How your application joins the CDN ### You tell us what goes to the edge The domain, where the origin is, the port, and what can be cached. ### We set it up and test it Your application is registered on the network and tested before it receives real traffic, with your certificate or one issued for you. If you prefer, start with a test subdomain. ### You point the records In the DNS you already use, switch the `A` and `AAAA` (or the subdomain's `CNAME`) to Edgium. To go back, just undo it. ## Use cases Common situations and how Edgium handles each one. ### Online stores and e-commerce Black Friday without slow pages: edge cache, WAF against bots and DDoS protection at the peak. [See the full example](https://edgium.net/en/use-cases#loja-virtual) ### News portals, blogs and media A viral story without an outage: the cache absorbs the peak and hotlinking stops costing you bandwidth. [See the full example](https://edgium.net/en/use-cases#portal) ### Agencies and web developers Dozens of sites in a single panel, with certificates that renew themselves and a protected domain without the www. [See the full example](https://edgium.net/en/use-cases#agencias) ## Questions about the CDN ### Can I test the CDN before signing up? Yes. Talk to us: Edgium sets up a trial with a subdomain or with your application, and you measure it with your own traffic before pointing your main domain. ### Do I need to move my DNS to Edgium? No. Your DNS stays where it is. You only change the site records to point to Edgium: A and AAAA on the root domain, and A, AAAA or CNAME on subdomains. ### Can you protect the root domain, without the www? Yes. Because Edgium IPs are anycast and fixed, the root domain gets plain A and AAAA records, with no CNAME and no DNS tricks. ### My application uses a port other than 80 and 443. Does it work? Yes. The CDN accepts custom HTTP and HTTPS ports, both for incoming traffic and for the connection to your origin. ### Can I use my own certificate? Yes. You upload your company certificate, including EV or wildcard, or Edgium issues and renews one for your domain. ### What happens if a point on the network goes down? Internet routing (BGP) sends the traffic to the next point, which announces the same IP. There is no DNS change and no waiting for TTL. ### Will my application still see the visitor's IP? Yes. Edgium sends headers with the visitor's real IP, port and country, and the logs can go to your own server. ### Does the CDN protect against DDoS attacks? Yes. Because the network is anycast, a distributed attack arrives split across the points in Brazil and abroad, and each one filters its share. The WAF also blocks suspicious requests before they reach the application. ### Can I stop other sites from using my images? Yes. Hotlink protection makes the CDN refuse files requested by pages on other domains, so your bandwidth stops paying for content shown there. ## Talk to Edgium and test the CDN Tell us your domain and where your origin is. We set up a trial with a subdomain or with your application, you measure it with your traffic, and then comes the proposal. [Set up a CDN trial](https://edgium.net/en/contact?interesse=cdn#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20CDN%20and%20WAF%20trial.) --- # Anycast DDoS protection for sites, APIs and DNS | Edgium > DDoS protection on an anycast network in Brazil and abroad: the attack is split across points and stops at the edge, for sites, stores, APIs, DNS and TCP/UDP. Source: https://edgium.net/en/ddos-protection Leia esta página em português: https://edgium.net/protecao-ddos --- [Edgium](https://edgium.net/en/) / DDoS Protection # DDoS protection: the attack is split across the network and stops at the edge Every point on the Edgium network, in Brazil and abroad, announces the same IPs. A distributed attack arrives split across them, each point filters its share, and your server receives only real traffic. [Set up a trial](https://edgium.net/en/contact#formulario) See what gets protected ![Lime-green sphere inside a transparent barrier, with particles hitting it from outside, illustration of DDoS protection](https://edgium.net/assets/img/ddos.webp) ## Why an anycast network holds up under attack On a single server, the whole attack lands in one place. On an anycast network, routing takes each visitor, and each attacking machine, to the nearest point. The volume spreads out, and filtering happens before anything reaches you. ### The volume is split Each point receives only the share of the attack coming from its region, and filters it there. None of your servers receives the full volume. ### The origin stays hidden Your server's IP does not appear in DNS. Attackers find the Edgium network, and the origin can accept only Edgium and close itself off from the rest of the internet. ### A point goes down, traffic keeps flowing If a point goes offline, BGP sends traffic to the next one, which has the same IP. No DNS change and no waiting for TTL. ## What gets protected DDoS protection comes with every product, because they all run on the same network. You choose what to put behind the edge. ### Site, online store and API Through the [CDN and WAF](https://edgium.net/en/cdn): the web application firewall blocks SQL injection and other common attacks, blocks by country, IP, host and user-agent, and challenges bots and suspicious traffic before it reaches the application. ### Internet provider DNS Through [DNS Firewall](https://edgium.net/en/dns-firewall): random subdomain floods, mass NXDOMAIN, empty queries and ANY stop at the edge, with per-second limits tuned to your network. ### DNS zones In [managed DNS and DNS Slave](https://edgium.net/en/dns): the same protection as DNS Firewall, built into the zones that answer through the anycast network. ### Email, telephony and databases Through the [Load Balancer](https://edgium.net/en/load-balancer): SMTP, SIP, MySQL and SQL Server go through the edge over TCP and UDP, without exposing your servers' IPs. ## Where each type of attack stops | Attack | Where it stops | What happens | | --- | --- | --- | | Traffic flood | At the edge, split across points | Each point filters its share, and the origin does not receive the volume | | HTTP request flood | At the WAF | Challenge for bots and suspicious traffic, blocking by country, IP and user-agent | | SQL injection and web attacks | At the WAF | Rules against common web attacks, before they reach the application | | Random subdomain and NXDOMAIN | At DNS Firewall | Dedicated per-second limits, separate from normal traffic | | ANY query (amplification) | At DNS Firewall | Refused, so your DNS is no longer used against third parties | | SYN flood (TCP) | At the edge | Fake connections stop before they reach your server | | DNS hijacking and poisoning | At managed DNS | DNSSEC and blocking of hijacking and poisoning | | Direct attack on the server IP | It does not get through | The origin IP stays hidden, and it can accept only Edgium | ## What changes for your company and your visitors ### For your company - **Site up during the attack:** bad traffic stays at the edge and good traffic keeps flowing. - **A right-sized server:** the origin does not need to be sized for the worst day. - **Onboarding without migration:** your DNS stays where it is, and going back means undoing one record. - **People watching:** our team sets it up and watches the traffic with you, in Portuguese. ### For your visitors - **Pages that open,** even while someone is trying to take the site down. - **Nearby responses,** from the closest network point, in Brazil or abroad. - **No strange address:** the same domain and the same padlock as always. ## Use cases Common situations and how Edgium handles each one. ### Online stores and e-commerce Black Friday without slow pages: edge cache, WAF against bots and DDoS protection at the peak. [See the full example](https://edgium.net/en/use-cases#loja-virtual) ### Internet provider (ISP) and hosting DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge. [See the full example](https://edgium.net/en/use-cases#provedor) ### VoIP telephony and SIP exchanges A SIP exchange out of the line of fire: hidden IP, attack stopped at the edge and more than one server behind it. [See the full example](https://edgium.net/en/use-cases#telefonia) ## Questions about DDoS protection ### What is a DDoS attack? It is a distributed denial-of-service attack: many machines, from many places, send traffic or requests at the same time to take down a site, an API or a DNS server. ### How does an anycast network help against DDoS? Every Edgium point, in Brazil and abroad, announces the same IPs. The attack arrives split across them, each point filters its share, and none of your servers receives the full volume. ### Do I need to move my DNS to Edgium? No. Your DNS stays where it is. To protect a site, you only change its records to point to Edgium, including on the root domain, with plain A and AAAA records. ### Can I test the protection before signing up? Yes. Talk to us: Edgium sets up a trial with a subdomain, an application or a zone, and you follow it with your own traffic before moving the rest. ### I am already under attack. Can you help? Message us on WhatsApp and tell us the domain, service or IP being attacked. We work with you on the fastest way to put the service behind the edge. ## Talk to Edgium and test the protection Tell us what you need to protect and whether you have been attacked before. We set up a trial with a subdomain, an application or a zone, and follow it with you. [Set up a trial](https://edgium.net/en/contact#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20DDoS%20protection.) --- # DNS Firewall against DDoS attacks for providers | Edgium > DNS Firewall for internet providers and companies with their own DNS: your zones stay on your server and attacks like random subdomain floods stop at the edge. Source: https://edgium.net/en/dns-firewall Leia esta página em português: https://edgium.net/dns-firewall --- [Edgium](https://edgium.net/en/) / DNS Firewall # DNS Firewall for providers: zones stay on your server, DDoS attacks stay at the edge Your authoritative DNS stays with you, with all your customers' zones exactly as they are. Edgium answers in front of it, on an anycast network with points in Brazil and abroad, and lets through only real queries. It suits internet providers, hosting companies and businesses that run their own DNS. [Protect the provider's DNS](https://edgium.net/en/contact?interesse=dns-firewall#formulario) See how it works ![A lime green shield surrounded by orbits, illustration of the DNS Firewall](https://edgium.net/assets/img/firewall.webp) ## A virtual DNS in front of yours The addresses of your nameservers are announced by the Edgium network. A legitimate query is passed to your server, and the answer goes back to whoever asked. With more than one server, Edgium spreads the queries across them, like a DNS load balancer. An attack query stops at the first network point it meets. ## Which DNS attacks it protects against The DDoS attacks that take down provider DNS most often are not big. They are queries that no cache holds and that make the server work on every single one. ### Random subdomain Thousands of names that do not exist, such as `x7k2q.customer.com`, meant to exhaust the authoritative server. The firewall recognizes the pattern and limits it. ### NXDOMAIN floods A separate limit for nonexistent-domain responses, apart from normal traffic, so the attack does not take down the users who ask correctly. ### Empty and malformed queries Packets with no valid question stop at the edge and never reach your server. ### ANY queries blocked The ANY query, used to amplify attacks, is refused. Your DNS stops being a weapon against third parties. ### Custom per-second limits (rate limit) Total queries, NXDOMAIN responses and SERVFAIL responses, each with a limit tuned to the normal traffic of your network. ### SYN flood blocked Fake TCP connections, opened only to keep the server busy, stop at the edge and do not reach your DNS. ### Block rules by source Networks or addresses that only send attacks can be blocked for good, at every point of the network at the same time. ### Servers out of sight The real IPs of your servers stop being the target. Attackers find the Edgium network, spread out and built for this. Prefer that Edgium answers on its own, with a copy of the zones? That is the [DNS Slave](https://edgium.net/en/dns#slave): your server becomes the hidden master and never shows up on the internet. ## What changes for the provider and for subscribers ### For the provider - **No zone changes:** no migrating domain by domain. Your zones and today's tools stay the same. - **Fewer sleepless nights:** the attack that used to take down DNS and flood support stays at the edge. - **Less hardware on the front line:** the authoritative server handles only real queries. - **A selling point:** protected DNS to offer to the business customers who host with you. ### For subscribers and the provider's customers - **Customers' sites and email keep answering** even during an attack on DNS. - **Faster answers,** coming from the network point closest to whoever asked. - **Nothing to configure:** for the people using it, the nameserver is the same as always. ## Use examples Common situations and how Edgium handles each one. ### Internet provider (ISP) and hosting DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge. [See the full example](https://edgium.net/en/use-cases#provedor) ### Companies with their own ERP, database and email ERP and email reachable from outside, with the company's server hidden behind the edge. [See the full example](https://edgium.net/en/use-cases#empresas) ## Questions about the DNS Firewall ### Do I need to change the zones or my customers' domains? No. Your zones stay on your server, exactly as they are. Only the addresses of your nameservers start answering from the Edgium network. ### What is the difference between the DNS Firewall and the DNS Slave? With the DNS Firewall, every legitimate query is passed to your server, which keeps answering. With the DNS Slave, Edgium receives a copy of the zone and answers on its own, without asking your server. ### What is a random subdomain attack? It is a flood of queries for names that do not exist, such as x7k2q.customer.com, which no cache holds and which takes the authoritative server down. The DNS Firewall recognizes the pattern and limits it at the edge. ### Can the limits be adjusted? Yes. Queries per second, NXDOMAIN responses and error responses each have their own limits, tuned to the normal traffic of your network. ### Can I test the DNS Firewall before signing up? Yes. Talk to us: Edgium arranges a test with you without stopping the service, and you watch queries pass through the edge before moving all your nameservers. ## Has your DNS been attacked before? Talk to Edgium: tell us how many zones and queries the provider has, and we arrange a test with you without stopping the service. [Arrange a test](https://edgium.net/en/contact?interesse=dns-firewall#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20DNS%20Firewall%20test.) --- # Multicloud Load Balancer with automatic failover | Edgium > Load balancing on the anycast edge, with automatic failover between clouds and your datacenter, for HTTP, SMTP, SIP and databases, without exposing server IPs. Source: https://edgium.net/en/load-balancer Leia esta página em português: https://edgium.net/load-balancer --- [Edgium](https://edgium.net/en/) / Edge Load Balancer # Load balancing at the edge: traffic goes to the origin that is up Load balancing between different clouds and your datacenter, with automatic failover. If a server or service fails, Edgium notices and sends the visitor to another one before they notice anything. [Arrange a test](https://edgium.net/en/contact?interesse=load-balancer#formulario) See how it works ![Two lime green triangles pointing at each other, illustration of the balancer](https://edgium.net/assets/img/stream.webp) ## An origin goes down, the visitor does not notice The balancer sits on the anycast edge, close to whoever is visiting, and checks your origins all the time. When one fails, it leaves the route. When it answers again, it comes back in. ### Several clouds, one address Origins in different clouds, in your datacenter or in both. The visitor uses a single address. ### Health check and failover Each origin is tested all the time (health check). The one that fails leaves the route and comes back on its own when it answers. ### Weight and affinity You define how much each origin receives, and the same visitor tends to return to the same server, which preserves sessions. ### Exclusive anycast IPs Each balancer gets its own anycast IPs, the same at every point of the network, in Brazil and abroad. ### DDoS protection and SYN flood The attack is split across the points and stops at the edge, including floods of fake TCP connections (SYN flood). ### Block by source Networks or addresses that should not reach the service are kept out, with rules applied across the whole edge. ## Not everything is a website: protocol streams The balancer also passes TCP and UDP connections through the edge. The client connects to Edgium, and Edgium hands the connection to the available origin. - **SMTP:** incoming email spread across servers, without exposing the IP of your real MX. - **SIP:** telephony with a protected exchange and more than one server behind it. - **Databases:** MySQL and SQL Server behind a single address, with the origin hidden. - **APIs:** several origins behind a single address, with the failing one taken off the route. - **HTTP and HTTPS:** with the connection opened close to the visitor, which reduces the time to first byte. ![A globe with points linked by lime green orbits, illustration of the network that protocols pass through](https://edgium.net/assets/img/rede.webp) ## What changes for the company and for users ### For the company - **No dependence on a single cloud:** spread traffic across providers and negotiate with whoever you want. - **Maintenance without downtime windows:** take an origin off the route, update it and put it back. - **Your own datacenter put to use:** the cloud joins for the peak, and what you already have keeps working. - **Servers out of sight:** whoever connects sees Edgium, never the IP of the application. ### For users - **The system stays up** even when a server goes down in the middle of the day. - **Faster answers,** because the connection starts at the closest point and continues along a path that is already open. - **Sessions preserved,** with no being thrown out of the system on every click. ## Use examples Common situations and how Edgium handles each one. ### Systems, SaaS and APIs A cloud goes down and the customer does not notice: automatic failover between origins and an API at the edge. [See the full example](https://edgium.net/en/use-cases#saas) ### VoIP telephony and SIP exchanges A SIP exchange out of the line of fire: hidden IP, attacks stopped at the edge and more than one server behind it. [See the full example](https://edgium.net/en/use-cases#telefonia) ### Companies with their own ERP, database and email ERP and email reachable from outside, with the company's server hidden behind the edge. [See the full example](https://edgium.net/en/use-cases#empresas) ## Questions about the Load Balancer ### Do the origins have to be in the same cloud? No. They can be in different clouds, in your datacenter or in a mix of both. For the visitor, it is a single address. ### Does it work for more than websites? Yes. Besides HTTP and HTTPS, the balancer handles TCP and UDP protocols, such as SMTP, SIP and database connections (MySQL and SQL Server). ### Does the same visitor always land on the same server? By default, the same IP tends to go to the same origin (affinity), which helps applications with sessions. You also set the weight of each origin. ### How long does it take to remove a failing origin? The origin is checked all the time. When it fails the check, it leaves the route, and it comes back on its own when it answers again. ### Can I test the balancing before switching traffic? Yes. Talk to us: Edgium sets up the origins and tests failover with you, through a test address, before real traffic goes through the balancer. ## How many origins does your application have today? Talk to Edgium: tell us where your servers are and which protocols go through them. We design the entry point with you and test it before switching traffic. [Arrange a test](https://edgium.net/en/contact?interesse=load-balancer#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20Load%20Balancer%20test.) --- # Managed DNS and anycast DNS Slave (secondary) | Edgium > Managed DNS with DNSSEC, DDoS protection and branded nameservers, or DNS Slave: Edgium receives the zone from your server and your master stays hidden. Source: https://edgium.net/en/dns Leia esta página em português: https://edgium.net/dns --- [Edgium](https://edgium.net/en/) / Managed DNS and DNS Slave # Managed DNS or DNS Slave, answering from an anycast network Two ways to have your authoritative DNS answer from the Edgium edge, with points in Brazil and abroad. Host the zones here, or keep editing on your server and let Edgium be the DNS Slave (secondary), the only address the internet sees. [Arrange a DNS test](https://edgium.net/en/contact?interesse=dns#formulario) See the DNS Slave (secondary) ![Stacked lime green layers, illustration of DNS](https://edgium.net/assets/img/dns.webp) ## Managed DNS (Hosted DNS) Zones live at Edgium and answer from every point of the anycast network. Whoever asks gets the answer from the closest point, and an attack on DNS spreads across the network instead of landing on a single server. Editing in the panel has review before saving, Undo and a history: see the [DNS panel guide](https://edgium.net/en/dashboard-dns). ### Editing in the panel A, AAAA, CNAME, MX, TXT, SRV and other records, including wildcards (`*.yourcompany.com`), edited in the Edgium panel. ### DNSSEC Zones signed by Edgium. You publish the DS record at the domain registry and you are ready to validate. ### Nameservers under your brand Use `ns1.yourcompany.com` and `ns2.yourcompany.com`, answering from the Edgium network. ### DDoS mitigation The same protection as the DNS Firewall, built in: random subdomain, NXDOMAIN, ANY and SYN floods stay at the edge, with blocking of DNS hijacking and poisoning. ### Answers from nearby Every point announces the same IPs. The query is answered where it arrives, without crossing the country. ### Together with the CDN Hosted your DNS here? To turn on the CDN for a site, you just change its record. ## DNS Slave (secondary): your server never shows up You keep editing the zones on your server (BIND, PowerDNS, your hosting panel). It becomes the hidden master: it notifies Edgium on every change and transfers the zone. The published nameservers are Edgium's, and they are the only ones the internet queries. ### A truly hidden master Your server is not in the NS records or anywhere public. You can close port 53 to the internet and accept only Edgium. ### Changes that arrive with the notice You save on your server, it sends the notice (NOTIFY) and Edgium fetches the change right after: the whole zone (AXFR) or only what changed (IXFR), when your server offers it. If the notice does not arrive, Edgium checks from time to time. ### Your tools keep working Automation, hosting panels and scripts keep writing to your server. Nothing changes in your team's routine. ### DNS does not go down with it If your server goes offline, Edgium keeps answering with the last copy of the zone, until the expire time set in the SOA of your zone. ## Which of the three fits you | | Managed DNS | DNS Slave | DNS Firewall | | --- | --- | --- | --- | | Where the zones live | At Edgium | On your server, with a copy at Edgium | On your server | | Where you edit | In the Edgium panel | On your server | On your server | | Who answers queries | Edgium | Edgium | Your server, behind Edgium | | Does your server show up? | You have no server | No | No | | If your server goes down | Does not apply | Edgium keeps answering until the SOA expire | Queries stop | | Built for | Companies that want DNS taken care of | Providers and companies with their own DNS | Providers with many zones and dynamic answers | ## What changes for the company and for visitors ### For the company - **DNS that is not the weak link:** without DNS, site, email and systems all stop together. On the anycast network, it holds up. - **Server out of the target:** with the DNS Slave, the master does not show up, and attackers have nothing to aim at. - **Your own brand:** nameservers under your domain, for providers and resellers. - **Less operations work:** redundancy and protection without building and maintaining secondary servers. ### For visitors - **Sites and email that answer,** because the name always resolves. - **A faster first visit,** with the query answered nearby. - **Signed answers (DNSSEC),** which cannot be forged along the way. ## Use examples Common situations and how Edgium handles each one. ### Internet provider (ISP) and hosting DNS that stops going down: zones on your server, random subdomain attacks blocked at the edge. [See the full example](https://edgium.net/en/use-cases#provedor) ### Agencies and web developers Dozens of sites in a single panel, with certificates that renew themselves and the bare domain protected. [See the full example](https://edgium.net/en/use-cases#agencias) ### Companies with their own ERP, database and email ERP and email reachable from outside, with the company's server hidden behind the edge. [See the full example](https://edgium.net/en/use-cases#empresas) ## Questions about DNS ### With the DNS Slave, where do I edit the zones? On your server, as always. When you save, it notifies Edgium (NOTIFY) and the change is transferred right after (AXFR or IXFR, depending on your server). ### How does my server stay hidden? The NS records published at the domain registry point only to Edgium. Your server does not appear anywhere public and can accept connections only from Edgium. ### Can I have nameservers with my company's name? Yes. With managed DNS and with the DNS Slave, the nameservers can carry your domain, such as ns1.yourcompany.com, answering from the Edgium network. ### Do you support DNSSEC? Yes, with managed DNS. Edgium signs the zones, and you publish the DS record at the domain registry. ### Can I test before moving all my zones? Yes. Talk to us: you can start with one zone, on managed DNS or as a DNS Slave, and move the others after you check the answers. ## Managed or Slave? Talk to Edgium: tell us how many zones you have and where they are today. We point you to the right path, test with one zone and handle the switch. [Arrange a DNS test](https://edgium.net/en/contact?interesse=dns#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20managed%20DNS%20or%20DNS%20Slave%20test.) --- # Use cases for CDN, WAF, DNS and Load Balancer | Edgium > See how online stores, internet providers, SaaS, news portals, VoIP telephony, companies and agencies use Edgium CDN, WAF, DNS Firewall and Load Balancer. Source: https://edgium.net/en/use-cases Leia esta página em português: https://edgium.net/casos-de-uso --- [Edgium](https://edgium.net/en/) / Use cases # Use cases: how each industry uses Edgium The examples below start from common situations in each type of company. For each one: the problem, how it looks with Edgium, and what changes day to day. Pick the one closest to your case. - Online store - ISP and hosting - SaaS and APIs - Portals and media - VoIP telephony - ERP and internal systems - Agencies ## Online stores and e-commerce The situation The Black Friday campaign starts at midnight. Traffic spikes, the product page slows down, and bots use the rush to test passwords and copy prices. What changes The store opens fast at the peak, the server does not need to be sized for the worst day, and the Google speed score improves. Products used: [CDN and WAF](https://edgium.net/en/cdn), [DDoS protection](https://edgium.net/en/ddos-protection) ### How it looks with Edgium - The [CDN](https://edgium.net/en/cdn) serves images, scripts and pages from the edge, already compressed. The origin handles only the cart and payment. - The WAF challenges bots and blocks by country, IP and user-agent before the request reaches the store. - [DDoS protection](https://edgium.net/en/ddos-protection) absorbs the attack that often comes with the date. - The domain without www (`yourstore.com`) is protected without a CNAME, and the DNS stays at your registrar. ## Internet providers (ISPs) and hosting The situation Every week, a random subdomain attack takes down the authoritative DNS. Customer sites and email stop, and support fills up with tickets. What changes Fewer sleepless nights, fewer support tickets and a new selling point. Products used: [DNS Firewall](https://edgium.net/en/dns-firewall), [DNS Slave](https://edgium.net/en/dns#slave) ### How it looks with Edgium - The [DNS Firewall](https://edgium.net/en/dns-firewall) sits in front of your nameservers. Zones stay on your BIND or PowerDNS, and the attack stops at the edge. - For the zones you want out of the line of fire for good, use [DNS Slave](https://edgium.net/en/dns#slave): your server becomes a hidden master and never shows up on the internet. - Nameservers with your brand (`ns1.yourprovider.com`), answering from the anycast network. - Protected DNS becomes one more service to sell to business customers. ## Systems, SaaS and APIs The situation The system runs in two clouds and listens on port 8443. When a region goes down, customers stay offline until someone changes the DNS by hand. What changes A region going offline stops being an incident for the customer, and maintenance happens without a downtime window. Products used: [Load Balancer](https://edgium.net/en/load-balancer), [CDN and WAF](https://edgium.net/en/cdn) ### How it looks with Edgium - The [Load Balancer](https://edgium.net/en/load-balancer) runs health checks on the origins all the time and removes the failing one from the route (automatic failover). - The CDN listens on the application port, with WebSocket for live dashboards and notifications. - Access logs go by syslog to your server, for auditing and compliance. - The origin IPs stay hidden, and the origins accept connections only from Edgium. ## News portals, blogs and media The situation A story goes viral and traffic spikes within minutes. At the same time, other sites copy your images, and you pay for the bandwidth. What changes The portal stays up when it matters most, and the bandwidth bill goes down. Products used: [CDN and WAF](https://edgium.net/en/cdn) ### How it looks with Edgium - The cache absorbs the peak: the same page leaves the edge for thousands of readers, without touching the origin. - Hotlink protection makes images load only on your domain. - Brotli compression and HTTP/3 for readers on mobile. - Cache and expiration times per content type, adjusted in the panel. ## VoIP telephony and SIP servers The situation The SIP server has a public IP and gets scanned and attacked all day. When the server goes down, calls stop. What changes Calls keep going even with a server offline, and the SIP server leaves the line of fire. Products used: [Load Balancer](https://edgium.net/en/load-balancer), [DDoS protection](https://edgium.net/en/ddos-protection) ### How it looks with Edgium - The [Load Balancer](https://edgium.net/en/load-balancer) passes SIP through the edge: the phone connects to Edgium, and Edgium delivers to the available server. - The server IP stays hidden, with blocking by source and SYN floods stopped at the edge. - More than one server behind a single address, with automatic failover. ## Companies with ERP, databases and their own email server The situation The ERP with SQL Server and the email server sit in the company datacenter, with an exposed IP. Branches and sales reps connect from anywhere. What changes Systems reachable from anywhere, without the server exposed on the internet. Products used: [Load Balancer](https://edgium.net/en/load-balancer), [DNS Firewall](https://edgium.net/en/dns-firewall), [Managed DNS](https://edgium.net/en/dns) ### How it looks with Edgium - The [Load Balancer](https://edgium.net/en/load-balancer) passes MySQL, SQL Server and SMTP through the edge, without showing the real IP of the servers. - Blocking by country and by source: only the right people get in. - Have your own DNS in the datacenter? The [DNS Firewall](https://edgium.net/en/dns-firewall) sits in front of it, and the attack does not reach the server. - [Managed DNS](https://edgium.net/en/dns) with DNSSEC for the company domain. - If needed, a cloud joins in for the peak and the datacenter keeps working. ## Agencies and web developers The situation The agency looks after dozens of client sites, each with DNS in a different place, certificates expiring and clients asking for the site without www. What changes Less time putting out fires and one more service to offer clients. Products used: [CDN and WAF](https://edgium.net/en/cdn), [Managed DNS](https://edgium.net/en/dns) ### How it looks with Edgium - Each site is an application in the panel, with its own cache, WAF and certificate rules. - SSL certificate issued and renewed by Edgium (Let's Encrypt), with no calendar reminders. - Root domain without a CNAME, on the DNS where the client already is. - [Managed DNS](https://edgium.net/en/dns) with your own branded nameservers, for those who want to centralize. ## Recognize your case? Talk to Edgium. We set up a trial with a subdomain, an application or a zone, and you see the result with your own traffic before changing everything. [Set up a trial](https://edgium.net/en/contact#formulario) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20use%20case.) --- # Talk to Edgium and test CDN, WAF, DDoS and DNS | Edgium > Tell us what you want to protect or speed up and set up a trial of CDN and WAF, DDoS protection, DNS Firewall, load balancer or DNS. We reply in business hours. Source: https://edgium.net/en/contact Leia esta página em português: https://edgium.net/contato --- [Edgium](https://edgium.net/en/) / Contact # Talk to Edgium and test it on your application Tell us what you want to move to the edge. We set up a trial with a subdomain, an application or a zone, and you see the result with your own traffic before changing everything. Our team replies during business hours, by the email or WhatsApp you leave. - **CDN, WAF and DDoS protection:** the domain, where the origin is, the port the application uses and whether it has been attacked before. - **DNS Firewall, managed DNS or DNS Slave:** how many zones and which DNS server you use today. - **Load Balancer:** where the origins are and which protocols go through them. - **Business email:** how many mailboxes, and we pass you on to [lua.email](https://lua.email/). [Sales on WhatsApp](https://wa.me/5547999659121?text=Hello!%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20about%20a%20trial.) Phone and WhatsApp: **(47) 99965-9121**. Prefer email? [contato@edgium.net](mailto:contato@edgium.net) --- # Privacy and cookies: how Edgium handles your data | Edgium > See how Edgium handles the contact form data and the preference cookies on this site: what we keep, why, and how to ask for access, correction or deletion. Source: https://edgium.net/en/privacy Leia esta página em português: https://edgium.net/privacidade --- [Edgium](https://edgium.net/en/) / Privacy # Privacy This page explains what happens to the data you send through the [contact form](https://edgium.net/en/contact) on the Edgium site, and which cookies the site uses. ## The contact form **What we keep:** name, email, phone (if you give one), company, city, state, the product you are interested in and your message. We also keep the page the submission came from and, if present, the campaign parameters in the address (UTM). **Why:** only to reply to your message and talk about hiring the service. We do not sell or share this data. **Where it is kept:** in the group's sales CRM, the same one used by [lua.email](https://lua.email/), on servers in Brazil, with access limited to the sales team. **Legal basis:** your consent, given by ticking the box on the form (LGPD, Brazil's data protection law, art. 7, I). ## Your rights You can ask at any time for access to, correction of or deletion of your data, or withdraw your consent. Write to [contato@edgium.net](mailto:contato@edgium.net) from the email address you used on the form. ## Form protection To block bots, the form has a hidden field, a minimum filling time and a limit on submissions per internet address. The IP address is used only for that limit. ## Cookies and preferences Today the site does not use analytics and only sets a language preference cookie. We do not use advertising cookies and we do not sell browsing data. - **Language preference (`edg_lang`):** stores for 1 year the language you chose in the menu, or the one the site applied on your first visit based on your browser language. It is essential for the site to remember your choice. To delete it, clear the site's cookies in your browser. You control cookies in your browser settings. The browser also keeps, for the session, the campaign parameters of the first page you opened so the form can send them along; this disappears when you close the tab. --- # About Edgium: anycast network, CDN, WAF and DNS | Edgium > Meet Edgium, a company in Blumenau, Brazil, with an anycast network in Brazil and abroad for CDN, WAF, DDoS protection and DNS. We also run lua.email. Source: https://edgium.net/en/about Leia esta página em português: https://edgium.net/a-empresa --- [Edgium](https://edgium.net/en/) / About the company # About Edgium Edgium runs an anycast network with points in Brazil and abroad. CDN and WAF, DDoS protection, DNS and load balancer run on top of it. lua.email, the business email service, is also an Edgium company. ## What Edgium does We serve companies with a website, online store, system or API, and internet providers that need to protect their DNS. Every point on the network announces the same IPs, and each visitor reaches the nearest one. There, the network answers from cache, stops the attack and fetches from the origin only what is not cached. We do not just deliver a product. We guide the switch, analyze the traffic with you and stay with you after the application is live. The people behind it are network, infrastructure and email professionals with years of real operations, who know these systems from the inside and the pain of those who depend on them every day. ## Edgium products - [CDN and WAF](https://edgium.net/en/cdn): edge cache, web application firewall and SSL certificate. The root domain works without a CNAME. - [DDoS protection](https://edgium.net/en/ddos-protection): the attack is spread across the points of the network and stops at the edge. - [DNS Firewall](https://edgium.net/en/dns-firewall): sits in front of the provider's DNS, with the zones on the customer's server. - [Load Balancer](https://edgium.net/en/load-balancer): spreads access across clouds and datacenter, with automatic failover. - [DNS](https://edgium.net/en/dns): managed DNS on the anycast network and DNS Slave (secondary), with your server hidden. ## The lua.email family [lua.email](https://lua.email/) is Edgium's business email service. The engineering team has more than 20 years of experience with email. - [lua.email](https://lua.email/): email with the company domain, antispam, calendar, files and meetings. - [lua Colabora](https://lua.email/colabora): files, documents, chat and meetings, with the same login as email. - [lua Bridge](https://lua.email/bridge): hybrid email. Google, Microsoft, your own server and lua.email on the same domain, each account where it makes the most sense. - [lua Shield](https://lua.email/shield): antispam and antivirus at the entry of your own email server, without migrating anyone. ## Company details - **EDGIUM TECNOLOGIA LTDA**legal name - **42.001.983/0001-20**CNPJ (Brazilian company tax ID) - **Blumenau, SC**headquarters - **[(47) 99965-9121](https://wa.me/5547999659121)**WhatsApp - **[contato@edgium.net](mailto:contato@edgium.net)**contact email ## Talk to Edgium Tell us what you need. We answer on WhatsApp or through the contact form. [Leave your contact](https://edgium.net/en/contact) [Chat on WhatsApp](https://wa.me/5547999659121?text=Hello%21%20I%20came%20from%20the%20edgium.net%20website%20and%20I%20would%20like%20to%20talk%20to%20sales.) --- # Edgium panel guide: sign in, navigate, add a subdomain > Learn to use the Edgium panel: sign in, find your account, domain and subdomain, put a site on the CDN with the wizard and manage password, cache and deletion. Source: https://edgium.net/en/dashboard Leia esta página em português: https://edgium.net/painel --- [Edgium](https://edgium.net/en/) / Panel guide # Edgium panel guide for CDN and DNS The Edgium panel puts the CDN and the DNS of your site in one place. This guide shows how to sign in, find your way between account, domain and subdomain, put a new site on the CDN and look after your account, with an explanation of what each screen means. All images were taken in a demo environment with fictitious data: example domains, documentation addresses and simulated traffic. The numbers illustrate how to read each screen and do not represent any customer. The panel is shown in its Portuguese interface; it is also available in English. ## In this guide - Signing in - Navigation: account, domain and subdomain - New subdomain: the step-by-step wizard - Defaults already on - What to check before pointing DNS - Profile, password, deletion and cache - Need help? Other panel guides: - **Panel guide: sign in, navigation and new subdomain** (this page) - [Analytics and WAF logs: how to read them and what to do](https://edgium.net/en/dashboard-analytics) - [DNS: review, undo and history](https://edgium.net/en/dashboard-dns) - [Activate a subdomain: step by step to HTTPS](https://edgium.net/en/dashboard-activation) ## Signing in Accounts are created by the Edgium team. On the sign-in screen, people who are not customers yet find the **Fale com a gente** (Contact us) link. Customers sign in with email and password and, if they forget the password, use **Esqueci minha senha** (Forgot my password). The panel is available in Portuguese and English, with the **PT | EN** switch on the screen itself. ![Edgium panel sign-in screen, with email, password, a forgot password link and a contact us link](https://edgium.net/assets/img/painel/01-login-fale-com-a-gente.webp) Panel sign-in screen. ## Navigation: account, domain and subdomain The panel has three levels, always visible at the top of the screen: **Account > Domain > Subdomain**. - The **left menu** leads to the products, such as DNS and CDN, and to help (Support and System status). - Inside a CDN subdomain, the **tabs** bring everything together: Overview, SSL, Security, Cache, WAF, General, Upstreams and Analytics. - The **Search everything** field (shortcut `Ctrl + K`) opens a search to jump straight to any screen. ![Side menu, account, domain and subdomain selectors, and the Overview, SSL, Security, Cache, WAF, General, Upstreams and Analytics tabs](https://edgium.net/assets/img/painel/02-navegacao-abas-do-subdominio.webp) Menu, selectors and subdomain tabs. The domain selector has a **search** and shows the status of each domain, such as **Active**, **External DNS** or **Verifying**. When you switch domains, every tab shows the new one. ![Open domain selector with a search field and the status of each domain: external DNS, verifying and active](https://edgium.net/assets/img/painel/18-troca-de-dominio.webp) Domain switch with search and the status of each domain. ## New subdomain: the step-by-step wizard To put a site on the CDN, click **Add subdomain** on the CDN home screen. The wizard has 3 steps. ### Step 1: subdomain Fill in only the part **before the dot**, such as `www` or `shop`; the domain already appears next to it. To use the domain itself, with no prefix, check **Root domain**. ![Wizard step 1: subdomain name field and the root domain option](https://edgium.net/assets/img/painel/21-assistente-passo-1-subdominio.webp) Step 1: subdomain name. ### Step 2: origin (upstream) The **origin**, also called upstream, is your server: where the CDN fetches whatever is not cached yet. Enter now the server the CDN will send traffic to, or choose **Configure later**. - **Name:** a name of your own, such as "main-server". - **Server IP:** the public address of your origin server. - **Port** and **Priority** (the highest is the default). - **Use upstreams as HTTPS:** check it if the CDN should talk to your server over HTTPS. - **Activate on creation:** checked by default. If you uncheck it, the origin is created off and only receives traffic once you activate it. ![Wizard step 2: configure now or later, name, server IP, port, priority, HTTPS use and activate on creation](https://edgium.net/assets/img/painel/22-assistente-passo-2-origem.webp) Step 2: origin server. ### Step 3: review The screen summarizes the subdomain and the origin before creating. If you chose to configure the origin later, the panel reminds you to add and activate one on the **Upstreams** tab, so the subdomain has somewhere to send traffic. ![Wizard step 3: review of the subdomain and the origin before creating](https://edgium.net/assets/img/painel/23-assistente-passo-3-revisao.webp) Step 3: review with the origin filled in. ![Wizard step 3 when the origin is left for later, with a notice to add and activate an origin on the Upstreams tab](https://edgium.net/assets/img/painel/24-assistente-origem-depois.webp) Step 3 when the origin is left for later. ## Defaults already on Every new subdomain starts with the **real visitor IP** and **geolocation** turned on, so your server knows who each visit comes from and where. The **General** tab shows them and lets you change them. When you turn on HTTPS, the HTTP to HTTPS redirect and HTTP/2 also come on. ![General tab with real visitor IP and geolocation turned on](https://edgium.net/assets/img/painel/25-padroes-ip-real-geolocalizacao.webp) General tab: real IP and geolocation on. ## What to check before pointing DNS 1. **The origin answers.** Your server is up, on the chosen port, and accepts connections coming from Edgium. If it has a firewall, allow the Edgium addresses ([see the list](https://raw.githubusercontent.com/edgium/public/main/ips.txt)). 2. **The origin is active** on the Upstreams tab. An origin that is off receives no traffic. 3. **The connection mode is right.** If your server only serves HTTPS, check "Use upstreams as HTTPS". 4. **The CDN addresses are at hand.** The Overview tab lists where your site DNS should point. If you use Edgium DNS, the `www` records are created for you. 5. **The certificate.** The free certificate (Let's Encrypt) is issued after the DNS points to the CDN. Point the DNS, wait for propagation and issue it on the SSL tab. 6. **Lower the TTL in advance.** If you can, reduce the TTL of the current record a few hours before the switch, so a rollback is quick. 7. **Test and watch.** After pointing, open [Analytics](https://edgium.net/en/dashboard-analytics) and check requests, 5xx errors and origin health. ## Profile, password, deletion and cache ### Profile and password change In the menu at the top right (the three dots) you find the **Profile**. It shows your name and email (to change them, contact support) and lets you **change your password**. The new password has at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol, and differs from the current one. The screen ticks each requirement as you type, and your other open sessions are ended after the change. ![Profile screen with name, email and the password change form with the list of requirements](https://edgium.net/assets/img/painel/16-perfil-e-senha.webp) Profile: user data and password change with requirements. ### Type the name to confirm before deleting To avoid deleting the wrong domain or subdomain, the panel asks you to **type the name** to confirm. The **Delete** button is only enabled when the text matches. The message makes clear what will be removed: SSL, origins, WAF rules and cache. ![Deletion confirmation window asking to type the subdomain name](https://edgium.net/assets/img/painel/17-apagar-digitando-o-nome.webp) Deletion confirmation by typing the name. ### HTTP/2 always on On the **Security** tab, the panel shows that **HTTP/2** is always on for HTTPS connections: your site already delivers with the modern protocol, with nothing to configure. ![Security tab showing HTTP/2 always on for HTTPS connections](https://edgium.net/assets/img/painel/19-http2.webp) HTTP/2 always on. ### Cache: two options, two roles On the **Cache** tab, two similar options do different things: - **Expiration time:** how long the visitor's browser keeps the files. - **Cache TTL:** how long the CDN keeps successful responses (200 and 206) in cache before fetching again from your origin. The screen always shows the saved value, even when it is a custom time. ## Need help? - **No account yet?** Use the **Fale com a gente** link on the sign-in screen or the site [contact form](https://edgium.net/en/contact). - **A question or a problem?** Open a ticket under **Support**, inside the panel, or follow the **System status**. - When you ask for help with an error, include the **subdomain**, the **period** and, if possible, a **screenshot**. It speeds up the answer. ## Frequently asked questions ### How do I put a site on the Edgium CDN? In the panel, open the CDN and click Add subdomain. The wizard has 3 steps: the subdomain name, the origin (your site's server) and the review. Then point the DNS to the CDN and issue the free certificate on the SSL tab. ### What is the origin (upstream)? It is your server, where the CDN fetches whatever is not cached yet. ### What is the difference between Expiration time and Cache TTL? Expiration time sets how long the visitor's browser keeps the files. Cache TTL sets how long the CDN keeps successful responses before fetching again from your origin. ### How do I change my panel password? In the menu at the top right, open Profile. The new password needs at least 12 characters, with an uppercase letter, a lowercase letter, a number and a symbol, and must differ from the current one. Your other open sessions are ended after the change. ## No panel account yet? Accounts are created by the Edgium team. Tell us your domain and we will prepare your access and a trial with your site. [Talk to Edgium](https://edgium.net/en/contact#formulario) --- # CDN Analytics and WAF logs: reading the errors | Edgium > Understand Edgium Analytics and WAF logs: origin health, 502, 503, 504, 499 and 4xx errors, filters, the access map and how to tell attacks from real use. Source: https://edgium.net/en/dashboard-analytics Leia esta página em português: https://edgium.net/painel-analytics --- [Edgium](https://edgium.net/en/) / Analytics and WAF logs # Analytics and WAF logs: how to read them and what to do Analytics and the WAF logs show how your site is being delivered, whether a failure comes from your server or from the CDN, what the cache saves and what the protection stopped. This page explains each block and what to do with what you see. All images were taken in a demo environment with fictitious data: example domains, documentation addresses and simulated traffic. The numbers illustrate how to read each screen and do not represent any customer. The panel is shown in its Portuguese interface; it is also available in English. ## In this guide - Analytics: the four questions - Period, filters and shortcuts - Summary: the five numbers - Origin health: is it your server or the CDN? - Error guide: what it means and what to do - Origin speed and where the time goes - Each origin (upstream) - Paths with the most errors and the slowest paths - What reaches your server the most - Who accesses: countries, addresses and HTTPS - Security blocks - WAF logs: how to find, read and decide Other panel guides: - [Panel guide: sign in, navigation and new subdomain](https://edgium.net/en/dashboard) - **Analytics and WAF logs: how to read them and what to do** (this page) - [DNS: review, undo and history](https://edgium.net/en/dashboard-dns) - [Activate a subdomain: step by step to HTTPS](https://edgium.net/en/dashboard-activation) ## Analytics: the four questions Analytics answers, in the order they appear on the screen: 1. **How much was my site accessed and how was it delivered?** (Summary) 2. **If something is slow or failing, is the problem my server or the CDN?** (Origin health) 3. **Is the cache helping?** (Traffic and cache) 4. **Who is accessing?** (Countries, addresses, HTTP and HTTPS) Two concepts help with reading. The **origin** (or upstream) is *your* server, where the CDN fetches whatever is not cached yet. The **cache** is the copy the CDN keeps to deliver faster: the more requests come from the cache, the less work your server does. ## Period, filters and shortcuts At the top of the screen you choose the period (**6 hours, 24 hours, 7 days or 30 days**) and refine it with **+ Filter**. Filters become removable tags, and the page address keeps your choices: you can copy the link and send it to a colleague. Available filters: **status** (for example `502`, `5xx`, `404` or `4xx`), **path** (part of the page address), **country** and **IP**, among others. Clicking a country, IP, path or server inside the charts also applies the filter. The **shortcuts** leave the screen ready for the most common questions: | Shortcut | What it is for | | --- | --- | | Only 5xx errors | Shows only the requests that failed on the server side. | | Only slow (1 s or more) | Shows only what took one second or more. Great for finding the page that weighs. | | Blocked by the WAF | Shows only what the protection stopped. | | IP with most requests | Shows who accesses the most, to tell ordinary visitors from bots. | ![Analytics screen with period, shortcuts, the five Summary cards, the Origin health section and the errors over time chart](https://edgium.net/assets/img/painel/03-analytics-resumo-e-saude.webp) Summary, shortcuts and origin health. **Only slow:** the shortcut filters requests of 1 second or more. The whole Summary then speaks only about those requests, so "Response time" shows how long they take, not the general average. ![Analytics with the Only slow shortcut applied](https://edgium.net/assets/img/painel/06-analytics-so-lentas.webp) Only slow shortcut applied. **Blocked by the WAF:** the same applies here. All numbers now describe only what was blocked, which helps you see the volume and size of that traffic. ![Analytics with the Blocked by the WAF shortcut applied](https://edgium.net/assets/img/painel/07-analytics-bloqueadas-pelo-waf.webp) Blocked by the WAF shortcut applied. ## Summary: the five numbers | Card | What it means | How to read it | | --- | --- | --- | | Requests | How many times your site was accessed. | A sharp drop usually points to an access or DNS problem. A sudden rise may be a campaign or a bot. | | Data delivered | Volume sent to visitors. | This is what counts against your traffic allowance. | | Cache rate | Percentage of the data that came from the cache. | The higher it is, the less load on your server and the faster for the visitor. | | 5xx errors | Percentage of requests that failed on the server side. | Ideally close to zero. | | Response time | Average of the requests the CDN had to fetch from your origin. | Whatever comes from the cache is fast and is not in this average. | Each card compares with the **previous period** and carries a "what to look at" line. ## Origin health: is it your server or the CDN? This is the most useful part when something looks wrong. At the top of the section there is a **diagnosis sentence** for the last 60 minutes, for example: "In the last 60 min, 1.8% of requests (11 of 616) returned a 5xx error, above the 1% limit. This usually points to a problem on your origin; check the server." How we read these numbers: the window is 60 minutes; we only evaluate when there are **at least 100 requests**, so the math is not misleading with few visits; we alert when 5xx errors pass **1%**; and we point to a specific origin when it concentrates **80% or more** of the errors. The criteria appear on the screen itself. Below the sentence there are useful buttons: **Open the Upstreams tab**, **Talk to support** and **See origin errors in the WAF logs**. ### Errors over time: 502, 503, 504 and 499 The chart shows one line per error type. **Read it like this:** if a line rises and stays high, the problem is usually on the origin server, not on the CDN. Peaks that repeat at the same time point to a scheduled job, a backup or a traffic peak the server cannot handle. Click **"What 502, 504, 503 and 499 mean and what to do"** to open the explanation inside the screen. ![Origin errors chart with the explanation of each code open: 502, 503, 504 and 499](https://edgium.net/assets/img/painel/04-analytics-erros-e-o-que-fazer.webp) Origin errors chart with the explanation of each code. ## Error guide: what it means and what to do ### 5xx errors: failure on the server side They always deserve attention. | Code | What happened | What to do | | --- | --- | --- | | 502 | The CDN tried to talk to your server and it refused, closed the connection or returned an invalid response. | Check that the server and the site service are up, that the port is open in the server firewall for Edgium, and that the application does not restart under load. | | 503 | The server is unavailable or overloaded, or the CDN found no active origin to serve the request. | Open the Upstreams tab and check that there is an active origin. Also check for maintenance in progress or a connection limit reached. | | 504 | The server took too long to answer. | Look for slow queries, heavy jobs or lack of resources (memory, CPU). Use "Slowest paths" to find the page responsible. | ### 499: the visitor gave up It is not a server or CDN error: the person closed the page, switched screens or lost the connection before receiving the response. Some are normal. **Many 499s** point to slowness: the visitor got tired of waiting. Look at the response time and the slowest paths. ### 4xx errors: something about the request They usually do not mean a server that is down, but what was requested. To investigate, use the **Status** filter with `4xx` (or a specific code) and look at the paths and the list of recent requests. | Code | Usual meaning | What to do | | --- | --- | --- | | 400 | Malformed request. | If it is very frequent and comes from a single IP, it may be a bot. If it comes from visitors, check forms and integrations. | | 401 and 403 | Unauthorized or forbidden access. | Check whether the page requires login and whether a block on your site or in the WAF is stopping people it should not (see the WAF logs). | | 404 | Page not found. | Many 404s on pages that should exist point to broken links or an address change without a redirect. Many 404s on odd paths are usually bots looking for flaws, which is generally harmless. | | 429 | Too many requests in a short time. | Usually the rate limit of your own site or of an integration that insists too much. | **Tip:** compare 4xx and 5xx. If the 5xx rise together with slowness, focus on the server. If only the 4xx rise, focus on what is being requested: links, bots, integrations. ## Origin speed and where the time goes - **Origin speed** shows three measures: **p50** (the typical time: half of the requests are faster than this), **p95** (95% of requests are faster than this) and **p99** (the slowest cases). If p95 and p99 rise while p50 stays steady, a few requests are slow, usually one specific page or query. - **Where the time goes** splits the wait into **connection to the origin**, **processing** and **sending the response**. High connection time points to a saturated network or server. High processing points to the application. High sending shows up with large responses or limited bandwidth. ## Each origin (upstream) The table compares your origins side by side: requests, 5xx errors, 502, 503, 504, 499, **error rate**, **retries** and p50, p95 and p99 times. **Read it like this:** an origin with a high error rate while the others are clean is the one that needs attention. **Retries** mean the CDN had to try another origin to complete the request. ![Health table per origin with requests, errors, error rate, retries and p50, p95 and p99 times](https://edgium.net/assets/img/painel/05-analytics-por-upstream.webp) Health per origin (upstream). Right below, **Connections dropped by the origin** summarizes the failures when talking to your server: connection refused, closed midway, reset, timed out or no active origin. They usually point to a server restarting, out of free processes or blocked by a firewall. ## Paths with the most errors and the slowest paths - **Paths with the most 5xx errors:** start here. It is usually one page, one API route or one specific query. Click to filter. - **Slowest paths:** sorted by p95 time. They are good candidates to optimize on the server or to put in cache. Paths are grouped to make reading easier: for example, `/products/:n` stands for all product pages. ## What reaches your server the most The list shows the pages and files that **did not come from the cache** and were fetched from your server. It is one of the fastest ways to gain performance: if images, scripts or pages that could be cached show up, adjust your site cache headers (or the cache time on the Cache tab) so the CDN starts keeping them. ![List of the pages and files most often fetched from the origin because they were not cached](https://edgium.net/assets/img/painel/08-analytics-o-que-mais-vai-a-origem.webp) Pages and files that most often go to the origin. ## Who accesses: countries, addresses and HTTPS - **Where visits come from:** countries in order of requests, with the map beside them. Lots of traffic from a country where you do not operate may be bots. Click a country to filter. - **IPs that access the most:** an IP with a volume far above the rest may be a bot, an integration or an attack. The list also shows the approximate number of unique visitors. - **HTTP and HTTPS:** ideally all access is over HTTPS. HTTP shows up when the visitor types the address without `https` before the redirect. ![Map of visits by country, list of the IPs that access the most and the split between HTTP and HTTPS](https://edgium.net/assets/img/painel/09-analytics-mapa-e-ips.webp) Visit map, IPs that access the most and HTTP/HTTPS. ## Security blocks inside Analytics The **Security blocks** block counts how many requests the WAF stopped, how many events were only logged in learning mode (without blocking) and how many connections were **closed without a response (444)**. If there is a peak outside the pattern, it may be an attack. To understand what was stopped, open the WAF logs with the button beside it. ## WAF logs: how to find, read and decide The **WAF** is the protection that inspects every request to your site and stops what looks like an attack, such as attempts to inject commands into forms. The **WAF logs** show what was stopped and why. To get there, use the WAF logs button on the CDN home screen or, inside Analytics, the **Open WAF logs** button. ![WAF logs with block counters, filters and rankings by rule, by URL and by subdomain](https://edgium.net/assets/img/painel/10-waf-logs-resumo.webp) WAF logs: counters, rules, addresses and subdomains. ### How to find a block There are two tabs: **WAF blocks** (what the protection stopped) and **Origin errors (5xx)** (failures of your server, kept apart so they do not mix with the blocks). The filters take you to what matters: - **Period:** from a few hours to a few days. - **Subdomain:** a specific one or all. - **Rule:** the rule number. - **URL contains** and **IP:** for when you already know which page or visitor you are looking for. - **Only with a recorded reason:** shows only the records with detail. At the top there is a summary with the **blocks in the period**, how many have a **recorded reason** and how many do not. Then come the rankings **By rule**, **By URL** and **By subdomain**: if one rule or page dominates the ranking, start there. You can export the list as **CSV**. ### How to read the reason and the rule Each row shows time, subdomain, requested address, **reason** (the rule category) and the full visitor IP. Click a row to see the detail: ![Detail of a WAF block with the rule number and name, what it detects and an example](https://edgium.net/assets/img/painel/11-waf-detalhe-da-regra.webp) Block detail: what the rule detects and an example. - **Rule number and name** (for example, "1001 double quote"): identifies what was detected. - **What it detects:** an explanation in Portuguese of the pattern that triggered the rule. - **Example:** a typical snippet of what the rule looks for. - Further down, the panel guides you on what to check on your site. The **What each rule means** button opens the full catalog of rules. The most common categories: | Category | What the rule looks for | | --- | --- | | SQL | Typical snippets of attempts to tamper with your site database through forms and addresses. | | XSS | Attempts to inject scripts into your pages. | | TRAVERSAL | Attempts to leave the site folder to read other files, for example with `../` sequences. | | WAF (general) | Malformed or out-of-standard requests, such as unknown data format and invalid characters. | ### How to decide: attack or legitimate use? Ask three questions when you see a block: 1. **Is the URL from my site?** Paths you do not recognize, such as `/xmlrpc.php` on a site that does not use that technology or `/.git/config`, are bot scans. The block is correct and there is nothing to do. 2. **Does the request come from a real feature of my site?** If the address is yours and the block hits a form, a text editor or an integration you use, note the **URL**, the **rule** and the **IP** and talk to us. The team adjusts the rule safely. 3. **How many IPs and how often?** Many attempts from the same IP in a row are a scan. A single isolated block on an address of yours, from a real visitor, deserves a look. **Learning mode:** on the subdomain WAF tab, learning mode records what *would* be blocked without blocking anything. It is a safe way to test before protecting. The events of this mode show up in Analytics apart from the blocks. ## Frequently asked questions ### What does a 502 error mean in Analytics? The CDN tried to talk to your server and it refused, closed the connection or returned an invalid response. Check that the server and the site service are up, that the port is open in the firewall for Edgium and that the application does not restart under load. ### What does a 504 error mean? Your server took too long to answer. Look for slow queries, heavy jobs or lack of resources, and use the slowest paths list to find the page responsible. ### What does a 503 error mean? The server is unavailable or overloaded, or the CDN found no active origin. Open the Upstreams tab and check that there is an active origin. ### What is a 499? The visitor gave up: closed the page, switched screens or lost the connection before receiving the response. Many 499s point to slowness. ### How do I know if the problem is my server or the CDN? The Origin health section of Analytics evaluates the last 60 minutes and warns when 5xx errors pass 1%, pointing to the origin that concentrates most of them. ### How can I tell if a WAF block was an attack? Check whether the URL is from your site, whether the request comes from a real feature and how many IPs and how often. Paths you do not recognize and many attempts from the same IP are bot scans. ## No panel account yet? Accounts are created by the Edgium team. Tell us your domain and we will prepare your access and a trial with your site. [Talk to Edgium](https://edgium.net/en/contact#formulario) --- # Panel DNS manager: review, undo and history | Edgium > Use the Edgium panel DNS Zone safely: review the value before and after saving, undo with one click, check the history and read the errors shown on the field. Source: https://edgium.net/en/dashboard-dns Leia esta página em português: https://edgium.net/painel-dns --- [Edgium](https://edgium.net/en/) / DNS panel guide # Edgium panel DNS manager: review, undo and history On the DNS Zone tab you manage the records of your domain when Edgium DNS is on. The screen brings safety to something so sensitive: review before saving, an Undo button, a change history and error messages that say what to fix. All images were taken in a demo environment with fictitious data: example domains, documentation addresses and simulated traffic. The numbers illustrate how to read each screen and do not represent any customer. The panel is shown in its Portuguese interface; it is also available in English. ## In this guide - Review before saving - Undo - Change history - Errors explained - More safeguards on the screen Other panel guides: - [Panel guide: sign in, navigation and new subdomain](https://edgium.net/en/dashboard) - [Analytics and WAF logs: how to read them and what to do](https://edgium.net/en/dashboard-analytics) - **DNS: review, undo and history** (this page) - [Activate a subdomain: step by step to HTTPS](https://edgium.net/en/dashboard-activation) ## Review before saving When you **edit** a record, the panel shows a review screen with the **before** and **after** values side by side, and tells you how long those who already cached the old value may keep seeing it. That depends on the record TTL. Nothing is written until you click **Confirm and save**; **Back and edit** returns to the form. Changes that may affect email, such as MX records, get highlighted and extra warnings in the review. ![Review screen before saving a DNS record, with the before and after values side by side](https://edgium.net/assets/img/painel/13-dns-revisao-antes-depois.webp) Review before saving: value before and after. ## Undo After creating, editing or deleting a record, the screen shows a notice with the **Undo** button. One click returns the record to its previous values. ![Record saved notice with the Undo button](https://edgium.net/assets/img/painel/14-dns-salvo-com-desfazer.webp) Record saved, with the Undo button. ## Change history The clock icon on each row opens the history **of that record**. The zone **History** button opens the history of **the whole zone**, with a filter by name and by type. Each item shows whether it was **created**, **edited** or **deleted**, the value before and after, who did it and when. The **Updated at** column of the table also shows the last author. ![Window with the zone change history, with filters by name and type and each change with its value before and after](https://edgium.net/assets/img/painel/15-dns-historico.webp) Zone change history. ## Errors explained When something cannot be saved, the message appears **on the field that needs fixing** and says what happened, on which record and what to do. Examples: "This record already exists" or, as in the image, that an A record with that name already exists and so a CNAME cannot be created alongside it. ![Error message on the form field explaining that a CNAME cannot coexist with other record types on the same name](https://edgium.net/assets/img/painel/12-dns-erro-explicado.webp) Error explained on the field: a CNAME does not coexist with other types. ## More safeguards on the screen - Each save changes **only the record you touched**. - The form shows the **full address** that will be created. - The nameserver (NS) and SOA records of the main domain stay **protected**, with a discreet notice on the screen. To put a site on the CDN after setting up the DNS, see the [new subdomain wizard](https://edgium.net/en/dashboard#novo-subdominio). To learn more about the Edgium DNS offer, see the [DNS](https://edgium.net/en/dns) page. ## Frequently asked questions ### Can I undo a DNS change in the panel? Yes. After creating, editing or deleting a record, the screen shows a notice with the Undo button, which returns the record to its previous values. ### How do I see who changed a DNS record? The clock icon on each row opens the history of that record, and the zone History button opens the whole zone, with the value before and after, who did it and when. ### Does the panel confirm before writing a DNS change? Yes. When you edit, the panel shows a review screen with the value before and after. Nothing is written until you click Confirm and save. ## No panel account yet? Accounts are created by the Edgium team. Tell us your domain and we will prepare your access and a trial with your site. [Talk to Edgium](https://edgium.net/en/contact#formulario) --- # Activate a subdomain on the Edgium CDN: from setup to HTTPS > Step by step to activate a subdomain on the Edgium CDN: sign-up, DNS, certificate and HTTPS active, with the 8 steps tracked in the panel and an example video. Source: https://edgium.net/en/dashboard-activation Leia esta página em português: https://edgium.net/painel-ativacao --- [Edgium](https://edgium.net/en/) / Activate a subdomain # Activate a subdomain on the Edgium CDN: from setup to HTTPS This guide takes you from creating a subdomain to HTTPS active. The panel tracks everything for you: at each moment it shows which of the 8 steps your subdomain is on, what is already done and who acts now, you or Edgium. The images use demonstration data. The panel is shown in Portuguese in the images and in the video; the video captions are in Portuguese. ## Watch the video (1 min 45 s) Your browser does not play video. [Download the file (MP4)](https://edgium.net/assets/video/ativacao-subdominio.mp4). The captions are in Portuguese, on the image. You can also download them as [VTT](https://edgium.net/assets/video/ativacao-subdominio.vtt) or [SRT](https://edgium.net/assets/video/ativacao-subdominio.srt). The video shows the manual path: requesting the certificate with **Create** and turning on HTTPS. For subdomains created from November 6, 2026, Edgium does both by itself, as explained in Automatic certificate and HTTPS. ## In this guide - The 8 steps - Automatic certificate and HTTPS - 1. Create the subdomain - 2. Edgium sends the configuration to the network - 3. Point your DNS - 4. Activate the certificate - 5. Edgium issues the certificate - 6. The certificate reaches the network - 7. Activate HTTPS - 8. Confirm it worked - Need help? Other panel guides: - [Panel guide: sign in, navigation and new subdomain](https://edgium.net/en/dashboard) - [Analytics and WAF logs: how to read them and what to do](https://edgium.net/en/dashboard-analytics) - [DNS: review, undo and history](https://edgium.net/en/dashboard-dns) - **Activate a subdomain: step by step to HTTPS** (this page) ## The 8 steps | Step | Who acts | | --- | --- | | 1. Site registered | You | | 2. Sending to the network | Edgium | | 3. Point your DNS | You | | 4. Waiting for DNS validation | Edgium | | 5. Activate the certificate | You | | 6. Issuing certificate | Edgium | | 7. Certificate on the network | Edgium | | 8. HTTPS active | You turn it on, Edgium applies it | For a subdomain created from November 6, 2026, you do two things: create the subdomain and create the DNS record. Once the DNS is validated, Edgium requests the free certificate (Let's Encrypt) and turns on HTTPS by itself. For subdomains created before that date, or if you turn the automatic option off, you do four things: create the subdomain, create the DNS record, request the certificate and turn on HTTPS. ## Automatic certificate and HTTPS (new subdomains) On a new subdomain whose DNS already points to Edgium and that has no certificate of its own, Edgium takes care of the certificate and HTTPS. The order is always this: 1. The DNS is validated (steps 3 and 4). 2. Edgium requests the free Let's Encrypt certificate. 3. The certificate is issued and published on the network. 4. The network confirms the certificate is on every server. 5. Only then does Edgium turn on HTTPS, with the redirect from http to https. **Why it can take a few minutes.** HTTPS only turns on once the certificate is published and confirmed at every point of the network. So, after the certificate is issued, it can still take a few minutes until HTTPS is active. In step 8 the panel shows **We are publishing HTTPS on the network.** and, when done, **HTTPS confirmed on every server of the network.** If publishing takes longer than expected, the panel says the Edgium team has already been notified. **Prefer to do it by hand?** In the **SSL** tab there is the **Issue a Let's Encrypt certificate automatically** switch. When off, nothing is issued or turned on by itself, and you follow steps 4 and 7 of this guide. If you turn HTTPS off yourself after it is active, Edgium does not turn it on again. ![SSL tab with the Issue a Let's Encrypt certificate automatically switch on, with the help text](https://edgium.net/assets/img/painel/ativacao-14-le-automatico-en.webp) SSL tab: automatic certificate switch. **CAA record in your DNS.** If your domain has a CAA record that does not authorize `letsencrypt.org`, the certificate cannot be issued. The panel warns you and, after you fix the DNS, Edgium tries again by itself. **HSTS.** Edgium never turns on HSTS on its own. When you turn it on, it shows as **HSTS being validated**: the header is only sent to visitors after HTTPS and the certificate are confirmed on the network, and there is nothing for you to do. When done, the panel shows **HSTS active: confirmed on the network.** If the certificate request is refused or fails, Edgium stops trying and our team is notified. Subdomains created before November 6, 2026 do not change. ## 1. Create the subdomain (step 1: site registered) **What to do.** In the panel, open **CDN**, choose the domain and click **Add subdomain**. Type only the part before the dot, for example `loja`; the domain already appears beside it. To use the domain itself, with no prefix, check **Root domain**. Click **Next**. ![Step 1 of the wizard: subdomain name field and the Root domain option](https://edgium.net/assets/img/painel/ativacao-01-assistente-nome.webp) Step 1: subdomain name. In step 2, enter the **origin server (upstream)**: the IP address and port of the server where your site is hosted, where the CDN fetches the content from. Leave **Activate on create** checked and click **Next**. ![Step 2 of the wizard: origin server with name, IP, port and priority](https://edgium.net/assets/img/painel/ativacao-02-assistente-origem.webp) Step 2: origin server. In step 3, check the summary and click **Create subdomain**. ![Step 3 of the wizard: review of the subdomain and origin before creating](https://edgium.net/assets/img/painel/ativacao-03-assistente-revisao.webp) Step 3: review. **What to expect.** The panel opens the subdomain **Overview** tab with the activation panel. Step 1 already shows as completed. ## 2. Edgium sends the configuration to the network (step 2) **What to do.** Nothing. This step belongs to Edgium. **What to expect.** Step 2 shows as in progress and usually takes up to 30 minutes. You can move on to step 3 meanwhile. ![Overview with step 1 completed and step 2 in progress](https://edgium.net/assets/img/painel/ativacao-04-passos-1-e-2.webp) Steps 1 and 2 in the Overview. ## 3. Point your DNS (steps 3 and 4) **What to do.** At the provider that manages your domain DNS, create the record shown in step 3 of the Overview: type **A**, with the subdomain name (`loja` in the examples) and the address the panel displays. The panel shows the **exact value**, with a **Copy** button beside each address. In the examples of this guide the values are `168.196.92.254` and `168.196.93.254`; create one A record for each address the panel shows. The AAAA record (IPv6) is optional: without it the site works normally. ![Step 3 with the A record, the subdomain name, the address and the Copy button](https://edgium.net/assets/img/painel/ativacao-05-aponte-o-dns.webp) Step 3: the A record with the Copy button. **What to expect.** You do not need to mark anything in the panel. Step 4, waiting for DNS validation, belongs to Edgium: it checks the record automatically, every 5 minutes. DNS propagation can take from a few minutes to a few hours, depending on your provider. When the DNS is validated, steps 3 and 4 become completed and the panel moves on to step 5. ## 4. Activate the certificate (step 5) *On a subdomain created from November 6, 2026, Edgium requests the certificate by itself, without you clicking **Create** (see how it works). What follows applies to the manual request.* **What to do.** With the DNS validated, the **Go to the SSL tab** button becomes available in step 5. Click it. ![Step 5 with the Go to the SSL tab button](https://edgium.net/assets/img/painel/ativacao-06-ative-o-certificado.webp) Step 5: Activate the certificate. In the **SSL** tab, in the free certificate block, click **Create**. ![SSL tab with the Create button for the free certificate](https://edgium.net/assets/img/painel/ativacao-07-aba-ssl-criar.webp) SSL tab: Create button. **What to expect.** The request appears in the SSL tab list and step 5 becomes completed. From here on, issuance is automatic. ## 5. Edgium issues the certificate (step 6) **What to do.** Nothing. **What to expect.** Step 6 is in progress and usually takes up to 15 minutes. When it ends, it becomes completed. ![Step 6 in progress: issuing the certificate](https://edgium.net/assets/img/painel/ativacao-08-emitindo.webp) Step 6: Issuing certificate. ## 6. The certificate reaches the network (step 7) **What to do.** Nothing. **What to expect.** Edgium distributes the certificate across the network, which usually takes up to 30 minutes. Edgium then confirms that the certificate reached every server of the network; HTTPS is only released after that confirmation. When it ends, step 7 becomes completed and the step 8 button is released. ![Step 7 in progress: certificate on the network](https://edgium.net/assets/img/painel/ativacao-09-certificado-na-rede.webp) Step 7: Certificate on the network. ## 7. Activate HTTPS (step 8) *On a subdomain created from November 6, 2026, Edgium turns HTTPS on by itself once the certificate is confirmed on the network. What follows applies to turning it on by hand.* **What to do.** With the certificate on the network, step 8 shows the **Activate HTTPS in the SSL tab** button. Click it and, in the **SSL** tab, turn on the **SSL activation** switch (from off to on). ![Step 8 with the Activate HTTPS in the SSL tab button](https://edgium.net/assets/img/painel/ativacao-10-ativar-https.webp) Step 8: Activate HTTPS in the SSL tab. ![SSL tab with the SSL activation switch highlighted](https://edgium.net/assets/img/painel/ativacao-11-aba-ssl-ligar.webp) SSL tab: SSL activation switch. **What to expect.** The certificate shows as active in the list and Edgium applies the change on the network. ## 8. Confirm it worked Go back to the **Overview** tab. When everything is ready, the panel shows **All done: HTTPS active** and "Your subdomain is active". ![All done: HTTPS active message](https://edgium.net/assets/img/painel/ativacao-12-https-ativo.webp) All done: HTTPS active. Click **Show steps** to review the whole path, with the 8 steps completed. ![All 8 steps completed](https://edgium.net/assets/img/painel/ativacao-13-todos-os-passos.webp) All 8 steps completed. To check in the browser as well, open `https://` followed by your subdomain address. ## Tips - The screen updates by itself while a step is in progress. You can close the panel and come back later: the current step stays marked. - In the CDN subdomain list, each subdomain shows a "Step n of 8" indicator, and the filter **Show only what needs action** lists only the ones waiting for you. ## Need help? If something in your access or your site does not go as expected, gather the information in the guide [Problems accessing a site on the CDN: what to collect and send](https://github.com/edgium/public/blob/main/guias/problemas-de-acesso-cdn.md) (in Portuguese) and send it to our team at [suporte@edgium.net](mailto:suporte@edgium.net). The full guide, in Markdown, is also in the [public Edgium repository](https://github.com/edgium/public/blob/main/guias/ativar-subdominio.md) (in Portuguese). ## Frequently asked questions ### How many steps does activating a subdomain have? 8 steps, all tracked in the subdomain Overview tab: site registered, sending to the network, point your DNS, waiting for DNS validation, activate the certificate, issuing certificate, certificate on the network and HTTPS active. ### What do I need to do in the DNS? Create an A record with the subdomain name and the address the panel shows in step 3. The panel displays the exact value and a Copy button. The AAAA record (IPv6) is optional. ### Are the SSL certificate and HTTPS turned on by themselves? For subdomains created from November 6, 2026, yes. Once the DNS is validated, Edgium requests the free certificate (Let's Encrypt) and turns on HTTPS when the certificate is confirmed on every server of the network, which can take a few minutes. The SSL tab has a switch for those who prefer to do it by hand. HSTS is never turned on by itself. ### Do I need to tell Edgium after pointing the DNS? No. Edgium checks the record automatically, every 5 minutes, and the panel moves on to step 5 by itself. ## Don't have a panel account yet? Accounts are created by the Edgium team. Tell us your domain and we prepare the access and a test with your site. [Talk to Edgium](https://edgium.net/en/contact#formulario) --- # Managed DNS and DNSSEC manual for Edgium, step by step > Learn Edgium managed DNS: create the zone, import the file, switch the NS, turn on DNSSEC with the DS record and follow DNS best practices, step by step. Source: https://edgium.net/en/docs-dns Leia esta página em português: https://edgium.net/docs-dns --- [Edgium](https://edgium.net/en/) / DNS manual # DNS manual for Edgium: managed DNS, DNSSEC and best practices DNS is the service that turns the name of your site, such as `example.com`, into the address where it lives. If it stops, site, email and systems stop together. This manual explains, without hurry and without loose jargon, how Edgium handles DNS for you: creating the zone, bringing what you already have, turning on DNSSEC and avoiding the most common mistakes. Want to know all the Edgium DNS options? See the [managed DNS and DNS Slave](https://edgium.net/en/dns) page. The images use demo data (domain `example.com` and documentation addresses). ## Concepts in a few words You do not need to memorize any of this to use the panel. But with these ideas, the rest of the manual is easy. The examples use the fictional shop `example.com`. **Authoritative server** It is the server that holds the official answer about a domain. When someone asks "what is the address of `www.example.com`?", it is the one that really answers. The others only repeat what it said. At Edgium, this role sits on the network anycast servers. **Zone** It is the domain's "notebook": the list of records (A, MX, TXT and the others) of `example.com`. **Primary (master) and secondary (slave)** The primary is where the zone is edited. The secondary keeps a copy and answers the same. If you edit in the Edgium panel, Edgium is the primary (managed DNS). If you edit on your server and Edgium only keeps the copy, Edgium is the secondary (DNS Slave). **NOTIFY, AXFR and IXFR** NOTIFY is the primary's message: "I changed the zone". AXFR copies the whole zone. IXFR copies only what changed. All three only matter when there is a secondary. **SOA and serial** The SOA is the zone's control record. The serial number goes up with every change, and that is how a secondary knows it is behind. The habit is to use the date plus two digits, like `2026110601`. The SOA also carries *refresh* (how often the secondary checks), *retry* (when it tries again after a failure), *expire* (when the secondary gives up answering if it can no longer reach the primary) and *minimum* (how long a "does not exist" is kept). **TTL** It is the time, in seconds, that whoever queries can keep an answer before asking again. A TTL of 300 means 5 minutes. A low TTL changes fast but causes more queries. A high TTL is cheaper but takes longer to take effect. In the panel the TTL goes from 60 to 86400 seconds. **Delegation, NS and glue** The delegation is the notice, kept at the domain registration (the registrar), of which servers answer for it. These servers are the NS records. Glue is the IP address of a nameserver whose name sits inside the domain itself, like `ns1.example.com`: without it, the internet would have no way to find the nameserver. ## Delegation: how the internet finds your DNS **What it is.** When you register a domain, the registrar (for example, registro.br for.br domains) keeps its list of nameservers. That list is how the internet finds out who answers for your DNS. Changing DNS provider is, in essence, changing that list. **Example.** The shop `example.com` hired Edgium managed DNS. At the registrar, it replaces the old nameservers with the ones the panel shows. From then on, anyone asking for the shop site is sent to Edgium. **What the animation shows, in order:** 1. The resolver (the server that serves the visitor) asks the domain registry who answers for `example.com`. 2. The registry returns the NS list: the Edgium nameservers. 3. The resolver asks one of them for the site address. 4. Edgium answers with authority. If there is a hidden master, it only talks to Edgium and does not appear in the delegation. ## Managed DNS: step by step **What it is and who it is for.** With managed DNS, your domain zone lives at Edgium and you edit everything in the panel, with review before saving, an Undo button and history. It suits anyone who wants DNS taken care of, without keeping a server of their own, and anyone who wants the anycast network and DNSSEC without building anything. **Example.** The shop `example.com` has DNS today at the same place as its hosting. It wants faster, protected DNS, and wants to put the Edgium CDN in front of the site. It goes with managed DNS. ### The steps 1. **Add the domain.** In the panel, add the domain (**Domain** field, **ADD** button). Edgium looks for the records that already exist and shows what it found: "Edgium is looking for existing DNS records...". 2. **Review the records.** This is the "Review the DNS records" step. Check that what appeared is right and add what is missing. Nobody can list every name in a DNS, so the search may not find everything: compare with your current zone. 3. **Change the nameservers at the registrar.** This is the "Change the nameservers" step. See the section below. Only after this change does the internet start asking Edgium. 4. **Wait and check.** Edgium checks the delegation by itself. When it is recognized, the domain is marked as delegated to Edgium and you can turn on the CDN on a subdomain. ### Bringing the zone you already have (import a file) If you have the zone file from your current DNS (the BIND format, with extension `.zone`, `.txt`, `.db` or `.bind`), you do not need to type anything. On the **Zone DNS** tab, click **Import zone file**, choose the file or paste the text and click analyze. ![Import zone file window with the text of a zone pasted in](https://edgium.net/assets/img/dns/dns-10-importar-arquivo-en.webp) Import zone file: paste the text or choose the file. The panel shows a preview and **writes nothing yet**. It separates what is new, what already exists identical, what conflicts and what was refused. The new ones come checked; you uncheck what you do not want and click **Apply changes**. Everything is applied at once and can be undone right after. ![Import preview with six new records checked and the Apply changes button](https://edgium.net/assets/img/dns/dns-11-importar-previa-en.webp) Preview: nothing is written until you apply. - The SOA record and the apex NS are not imported: Edgium takes care of them. - DNSSEC records in the file are ignored, because the panel generates the keys. - The file can have up to 512 KB and 2,000 records. The `$INCLUDE` and `$GENERATE` directives are ignored, with a warning. - A TTL outside the 60 to 86400 second range is adjusted and flagged in the preview. ### Editing records safely On the **Zone DNS** tab you create, edit and delete A, AAAA, CNAME, MX, TXT, SRV and other records, including wildcard (`*.example.com`). When editing, the panel shows the value **before and after** and only writes when you confirm. After saving, the **Undo** button restores the previous value, and **History** shows who changed what and when. The full guide is in [Panel DNS manager](https://edgium.net/en/dashboard-dns). A few rules the panel enforces for you: a CNAME cannot share a name with other records (so never at the apex, which already has SOA and NS), and the NS and SOA records of the main domain are protected. ### Switching the nameservers at the registrar This is the only part you do outside the Edgium panel. The panel shows your domain nameservers in the **Edgium nameservers** box, with the text "To use Edgium DNS, point the nameservers below at your domain registrar". For example, `a.edgium-dns.net` and `b.edgium-dns.net`. 1. Sign in to the registrar panel (at registro.br, it is the domain page, under change DNS servers). 2. Choose to use other DNS servers and replace the list with the two nameservers from the panel. Leave no old nameserver in the list. 3. Save. The change can take from a few minutes to a few hours to reach everyone. 4. If the domain has DNSSEC at the old provider, **remove the DS first**. See the DNSSEC precautions. **Want nameservers with your company name?** The panel has the **Custom nameservers** block, to use `ns1.example.com` and `ns2.example.com` instead of the Edgium names. In that case the registrar asks for glue, the IP address of each nameserver, and the panel warns you when it is needed. ![Edgium nameservers box and Custom nameservers block on the Zone DNS tab](https://edgium.net/assets/img/dns/dns-slave-08-secundaria-nameservers-en.webp) Edgium nameservers: this is what you register at the registrar. ## DNSSEC: what it is and how to turn it on ### What it is, in plain words DNSSEC is a **signature** on DNS answers. It proves two things: that the answer came from the zone owner and that nobody changed it on the way. It is like the seal on an envelope: the content is still readable, but you know whether it was opened. **What it protects.** Cache poisoning (someone makes a server keep a fake address), traffic diversion (the visitor goes to a server that is not yours) and, as a result, fake sites and email using your name. **What it does not protect.** It does not hide or encrypt the query: whoever is on the network still sees the name you asked for. And it does not replace HTTPS, which protects the conversation with the site. The two complete each other. **Example.** Without DNSSEC, an attacker can make an internet provider keep a fake address for `example.com`, and the shop customers land on a copy of the site. With DNSSEC, the validating resolver notices that the signature does not match and refuses the answer. ### How it works: the chain of trust The zone has a **key**. The server signs the records with it and publishes the signature (**RRSIG** record) and the public part of the key (**DNSKEY** record). Whoever checks needs to trust that key, and that is where the **DS** comes in: a fingerprint of the key, kept at the registrar and signed by.br (or.com,.net...)..br, in turn, has its DS signed by the DNS root, whose key every resolver already knows. It is a chain: root,.br, your domain, the answer. There are usually two keys: the KSK, which signs the other key, and the ZSK, which signs the records. It is also common to use a single key, the CSK, which does both jobs. The Edgium panel generates the keys for you and shows the key type next to the DS. You do not need to store or rotate keys by hand. **What the animation shows, in order:** 1. The resolver already trusts the DNS root key. 2. The root signs the.br DS, and the resolver comes to trust.br. 3. The.br signs the DS of `example.com.br`, the record you publish at the registrar. 4. The zone signs the answer (RRSIG). Because the key matches the DS, the answer is accepted. If any link fails, the resolver refuses. ### How to turn on DNSSEC at Edgium **Before you start.** DNSSEC applies to a zone managed by Edgium (managed DNS). The domain must have Edgium DNS turned on. 1. **Turn DNSSEC on.** On the **Zone DNS** tab, in the **DNSSEC** block, switch from Disabled to Enabled. Edgium creates the keys and signs the zone. 2. **Copy the DS.** The panel shows the **DS record**, with a copy button. It carries four pieces of data: key tag, algorithm, digest type and the digest in hexadecimal, as in `12345 13 2 49FD46E6C4B4...`. The panel may show more than one DS (digest type 2 and type 4): publish type 2 if the registrar accepts only one. 3. **Publish the DS at the registrar.** See below the path at registro.br and at a generic registrar. 4. **Check.** After a few minutes, test with `dig` or an online tool (see How to test). ![DNSSEC block on the Zone DNS tab with the switch on and the DS explanation](https://edgium.net/assets/img/dns/dns-12-dnssec-ligado-en.webp) DNSSEC block: turn it on and copy the DS. ![DNSSEC fields in the panel: DS record, Algorithm and Public key, each with a copy button](https://edgium.net/assets/img/dns/dns-13-dnssec-ds-en.webp) The DS record is what the registrar asks for. The values in the image are demo values. #### At registro.br (.br domains) 1. Sign in to registro.br and open the domain. 2. In the DNS servers area, confirm the nameservers are the Edgium ones. 3. Open the DNSSEC section and register the DS: key tag, algorithm (13), digest type (2) and the digest, copied from the Edgium panel. 4. Save and wait for publication. #### At another registrar Look for "DNSSEC" or "DS records" in the domain settings. Some registrars ask for the four fields separately, others accept the whole DS line, and others ask for the public key (DNSKEY). The panel shows the **DS record** and the **Public key**, so you have both forms. Menu names change from one registrar to another. ## DNSSEC and DNS Slave DNS Slave exists in the panel as a **secondary zone**: Edgium keeps the copy of a zone you edit on your own server. On that zone, the DNSSEC switch is **disabled**, because the primary is the one that signs. In practice, **DNSSEC is a managed DNS feature**, where Edgium is the primary of the zone. ## How to test DNSSEC Use a terminal with `dig` (or `delv`, which does the whole validation) and, if you prefer, a checking website. ``` # 1) Does the zone publish the key? dig +short DNSKEY example.com @a.edgium-dns.net # 2) Does the parent (registrar) publish the DS? dig +short DS example.com # 3) Does the answer come signed? Look for the RRSIG line dig +dnssec example.com A @a.edgium-dns.net # 4) Does a validating resolver accept it? Look for the "ad" flag dig example.com A @1.1.1.1 # 5) Full validation, step by step delv example.com A ``` **How to read it.** In step 2, a line like `12345 13 2 49FD46E6...` is the DS at the parent: if it is empty, the registrar has not published it yet. In step 3, the presence of `RRSIG` shows the answer is signed. In step 4, the `ad` flag (authenticated data) in the headers means the resolver validated the chain. In `delv`, the expected result is `fully validated`; `resolution failed` or `broken trust chain` points to a wrong or missing DS. If the domain went down after turning it on, see Common errors. **Checking websites.** [DNSViz](https://dnsviz.net/) and the [Verisign DNSSEC Debugger](https://dnssec-debugger.verisignlabs.com/) draw the chain and point at the link that failed. Type the domain and read the result: green is a complete chain; red shows where it broke. ## Who needs DNSSEC - **Banks and payment providers.** The domain is the address customers trust. A DNS diversion leads to a fake site with the bank name. That is why DNSSEC is standard in the sector. - **Government, justice and health.** Public systems and sensitive data are frequent targets of diversion. DNSSEC protects the path to the service. - **Email with DANE or MTA-STS.** DANE publishes the email server key in DNS and only works with DNSSEC. MTA-STS, which enforces encryption on delivery, gets stronger with signed DNS. - **Brand domains.** Anyone with a well-known name and many people trusting it gains an extra layer against diversion. - **.br domains with a requirement.** According to Registro.br, DNSSEC is mandatory in the categories B.BR, BET.BR, DEF.BR, JUS.BR, LEG.BR, MP.BR and TC.BR, and optional in the others. Check the current rule for your category on the [Registro.br](https://registro.br/dominio/categorias/) categories page. ## DNSSEC precautions **1. Never change provider with the old DS in place.** If the new nameservers do not have the key behind the DS at the registrar, anyone who validates DNSSEC refuses the answers and the domain looks down. The safe order is: remove the DS, wait for the TTL, switch the NS and only then turn on DNSSEC at the new provider and publish the new DS. **What the animation shows, in order:** 1. Remove the old provider DS at the registrar. 2. Wait for the DS TTL (how long caches keep the information, usually up to 1 day) so it disappears everywhere. 3. Switch the nameservers to the new provider, with the zone already ready there. 4. Turn on DNSSEC at the new provider and publish the new DS. The panel protects you from a similar mistake: when you turn DNSSEC off, it asks "Turn off DNSSEC?" and warns "First remove the DS record at the domain registrar. With the DS there and DNSSEC off here, the domain stops resolving." **2. Turning it off safely.** Remove the DS at the registrar, wait for the DS TTL to pass and only then turn off DNSSEC on the zone. Never the other way round. **3. Wrong DS.** If the registered DS does not match the zone key (mistyped, copied from another zone, key changed), the result is the same: the domain is down for anyone who validates. Always copy the DS from the panel, with the copy button, and check it with `dig DS`. **4. Key rollover.** Keys can be replaced from time to time. Always keep a valid key during the transition and only publish a new DS when the Edgium team tells you to. If you get a rollover notice or need to change the key, talk to [suporte@edgium.net](mailto:suporte@edgium.net) first. **5. TTL.** A high TTL on the DS and the NS delays any fix. Before big changes, lower the TTL well in advance. ## DNS best practices 1. **TTL by type, and before changes.** Records that hardly ever change (MX, SPF TXT, NS) can have a TTL of 1 hour to 1 day. Records you change often (the A of a site being migrated) stay at 5 minutes. **Before a planned change**, lower the TTL a day earlier, make the change and raise it again afterwards. Example: the shop is about to move the site server; a day before, it sets the A TTL to 300 and, on the day, the switch takes effect in minutes. 2. **Serial in the YYYYMMDDnn format.** If you keep the zone on your own server, use the date plus two digits (`2026110601`) and raise the number with every change. A serial that goes backwards makes the secondary ignore the change. With managed DNS, Edgium takes care of the serial. 3. **At least two nameservers, on different networks.** With a single nameserver, one failure takes everything down. With two, but on the same network or in the same datacenter, a network failure takes both down. Edgium answers from an anycast network, with the same IP at several points, in Brazil and abroad. 4. **DNSSEC with care when changing.** Turn on DNSSEC on important domains and follow the safe order for changing provider and key, described above. 5. **CAA: who may issue certificates.** The CAA record says which certificate authorities may issue certificates for your domain. If you use the automatic certificate of the Edgium CDN, authorize Let's Encrypt, for example `example.com. CAA 0 issue "letsencrypt.org"`. If a CAA exists that does not authorize Let's Encrypt, the panel warns you and the certificate is not issued until you fix it. 6. **SPF, DKIM and DMARC for email.** SPF (`v=spf1 mx -all`) says who may send email for the domain. DKIM signs each message. DMARC says what to do with messages that fail both. Without them, legitimate email lands in spam and your domain is easy to spoof. Start DMARC at `p=none` to observe and tighten gradually. 7. **Do not use CNAME at the apex.** The main domain (the "apex", `example.com` with nothing before it) already has SOA and NS, and a CNAME cannot share a name with other records. Use A and AAAA records. On the Edgium CDN, the main domain works without CNAME. 8. **Avoid orphan records.** A CNAME that still points to a service you canceled can be taken over by someone else (so-called *subdomain takeover*), who then publishes content in your name. Review the zone from time to time and delete what you do not use. The panel history helps you know what each record is. 9. **Domain contact and renewal up to date.** A perfect DNS is no use if the domain expires. Keep the holder's email updated at the registrar and turn on automatic renewal or a reminder. 10. **Monitor.** Test from time to time (`dig` on each nameserver), watch the serial on the secondaries and follow usage in the panel Analytics tab. ## Common errors and how to fix them ### The domain does not resolve after turning on DNSSEC Almost always the DS at the registrar is wrong or leftover. Check with `dig DS example.com` and compare with the panel. If you cannot fix it right away, remove the DS at the registrar: the domain comes back when the TTL passes. ### The internet still shows the old DNS The nameserver switch and the TTL take time. Check what the registrar publishes with `dig NS example.com` and ask Edgium directly with `dig example.com @a.edgium-dns.net`. If Edgium answers correctly and the rest does not, it is a matter of waiting for the cache. ### Lame delegation It happens when the registrar points to a nameserver that does not have the zone and answers without authority. Check that all the nameservers listed at the registrar are the ones the panel shows and that the zone exists on both. ### The panel refused a record The message appears on the field, saying what to fix. The most common reasons are a CNAME sharing the name with another record, a TTL outside 60 to 86400 and a value with an invalid format. ### Certificate does not issue on the CDN Check whether there is a CAA that does not authorize `letsencrypt.org` and whether the domain is already delegated to Edgium. **What to send to support.** If it does not get fixed, write to [suporte@edgium.net](mailto:suporte@edgium.net) with: the domain, what you expected and what happened, the time, and the output of the commands `dig NS example.com`, `dig DS example.com` and `dig example.com @a.edgium-dns.net`. ## Need help? For questions and errors, write to [suporte@edgium.net](mailto:suporte@edgium.net). More guides: [managed DNS and DNS Slave](https://edgium.net/en/dns), the [panel DNS manager](https://edgium.net/en/dashboard-dns) and [activating a subdomain on the CDN](https://edgium.net/en/dashboard-activation). ## Frequently asked questions ### What is Edgium managed DNS? It is the service where your domain zone lives at Edgium and you edit the records in the panel, with review before saving, Undo and history. Answers come from an anycast network, with points in Brazil and abroad. ### Can I import the zone I already have? Yes. On the Zone DNS tab, use Import zone file and paste or upload the file in BIND format. The panel shows a preview, writes nothing until you apply and lets you undo right after. ### How do I turn on DNSSEC? On the Zone DNS tab, in the DNSSEC block, switch to Enabled. Copy the DS record the panel shows and register it at the domain registrar. Then check with dig or on DNSViz. ### Does DNSSEC encrypt the DNS query? No. It signs the answers to prove they came from the zone owner and were not changed, but the query remains visible. It also does not replace HTTPS. ### How do I turn off DNSSEC safely? Remove the DS record at the registrar, wait for the DS TTL to pass and only then turn off DNSSEC on the zone. Turning it off on the zone with the DS still at the registrar takes the domain down. ### Can I have DNSSEC on DNS Slave? Not in the panel: the DNSSEC switch is disabled on a secondary zone. DNSSEC is a managed DNS feature. ### How do I avoid taking the domain down when changing DNS provider? If there is DNSSEC, follow the order: remove the DS, wait for the TTL, switch the nameservers and then turn on DNSSEC at the new provider and publish the new DS. ## Want to move your DNS? Tell us how many zones you have and where they are today. We point the way and follow the switch. [Talk to Edgium](https://edgium.net/en/contact#formulario) --- # Edgium documentation: panel, CDN, DNS and WAF manuals > All Edgium manuals in one place: CDN onboarding, panel, HTTPS activation, Analytics, WAF, DNS and support, with screenshots and a Markdown version for AI. Source: https://edgium.net/en/docs Leia esta página em português: https://edgium.net/docs --- [Edgium](https://edgium.net/en/) / Documentation # Edgium documentation: panel, CDN and DNS manuals Everything Edgium documents, in one place: how to put your site on the CDN, use the panel, turn HTTPS on, read Analytics, manage DNS and ask for support. Every manual has panel screenshots, a step by step and a text version for AI. [Start with the onboarding](https://edgium.net/en/docs-onboarding) ## First steps For anyone who just signed up for the CDN and wants the site live. - [**CDN onboarding**: From first sign-in to a live site on HTTPS, in 8 steps, with screenshots, video and animated diagrams.](https://edgium.net/en/docs-onboarding) - [**Panel guide**: How to sign in, find your way between account, domain and subdomain, create a subdomain and manage password and cache.](https://edgium.net/en/dashboard) - [**Activate a subdomain**: The 8 steps from sign-up to HTTPS, with the automatic certificate and HTTPS and the manual switch.](https://edgium.net/en/dashboard-activation) ## CDN, WAF and Analytics For anyone who already has the site on the CDN and wants to understand what happens. - [**Analytics and WAF logs**: Read origin health, the 502, 503, 504, 499 and 4xx errors, the access map and the WAF blocks.](https://edgium.net/en/dashboard-analytics) - [**CDN and WAF (the product)**: What the CDN and WAF do, who they are for and what is included.](https://edgium.net/en/cdn) ## DNS For anyone who manages the domain zone on Edgium. - [**DNS management and DNSSEC**: Create the zone, import what you already have, switch the nameservers, turn DNSSEC on and avoid common errors.](https://edgium.net/en/docs-dns) - [**DNS in the panel**: Review before saving, the Undo button, change history and explained errors.](https://edgium.net/en/dashboard-dns) ## Support For when the manual did not solve it. - [**Support**: What to check, what to send and how to write to suporte@edgium.net.](https://edgium.net/en/support) ## In the public repository Markdown guides and release notes, in the Edgium public repository. - [**Activation guide (Markdown)**: The same activation step by step, in plain text, in the Edgium public repository.](https://github.com/edgium/public/blob/main/guias/ativar-subdominio.md) - [**Access problems on a site on the CDN**: What to collect and send when a site is slow, shows an error or is unreachable.](https://github.com/edgium/public/blob/main/guias/problemas-de-acesso-cdn.md) - [**Panel release notes, November 2026**: What changed in the panel in November, with screenshots.](https://github.com/edgium/public/blob/main/painel/2026-11/README.md) ## Markdown manuals for AI Every manual exists as plain text, at the same address with **.md** at the end. Hand the link to the assistant you already use (Claude, ChatGPT, Gemini, Copilot) and ask with your case. **Always use the link**, without downloading or attaching a file: through the link the assistant reads the current manual, and a downloaded file gets old. - [CDN onboarding](https://edgium.net/en/docs-onboarding.md) - [Panel guide](https://edgium.net/en/dashboard.md) - [Activate a subdomain](https://edgium.net/en/dashboard-activation.md) - [Analytics and WAF logs](https://edgium.net/en/dashboard-analytics.md) - [DNS management and DNSSEC](https://edgium.net/en/docs-dns.md) - [DNS in the panel](https://edgium.net/en/dashboard-dns.md) - [Support (what to check and what to send)](https://edgium.net/en/support.md) - [All manuals together, in a single link](https://edgium.net/en/llms-full.txt) An example conversation, step by step, is on the [support page](https://edgium.net/en/support#ia). ## What changed - **November 6, 2026.** In new subdomains, the free certificate and HTTPS are turned on by themselves after the DNS is validated, with a switch on the SSL tab to do it by hand. [See in the manual](https://edgium.net/en/dashboard-activation#automatico). - **November 4, 2026.** New domain ownership rule: with DNS on Edgium no TXT is needed; with DNS elsewhere, the TXT is asked for once. [See in the manual](https://edgium.net/en/docs-onboarding#passo-3). ## Know the products Still deciding? See what each Edgium product does: - [CDN and WAF](https://edgium.net/en/cdn) - [DDoS protection](https://edgium.net/en/ddos-protection) - [DNS Firewall](https://edgium.net/en/dns-firewall) - [Load Balancer](https://edgium.net/en/load-balancer) - [Managed DNS and DNS Slave](https://edgium.net/en/dns) ## Frequently asked questions ### Where is the Edgium documentation? Here, at edgium.net/en/docs. It gathers the CDN onboarding, the panel guide, subdomain activation, Analytics and WAF logs, the DNS manual and the support page. ### Where do I start if I just signed up for the CDN? With the CDN onboarding: it takes you from the first panel sign-in to the site live on HTTPS. ### Do the manuals exist as text for AI? Yes. Every manual has a Markdown version at the same address with.md at the end. Hand the link to the assistant, without downloading or attaching a file. ### What if the manual does not solve it? Write to suporte@edgium.net with the checklist from the support page: address, date and time, provider, IP and screenshots. ## Did not find what you were looking for? Write to suporte@edgium.net and tell us what you need, with the site address and what you already tried. [Go to support](https://edgium.net/en/support) --- # Edgium CDN onboarding: from first sign-in to HTTPS live > Step by step for new CDN customers: sign in to the panel, add the domain, prove ownership, set up DNS, activate the subdomain and see your site on HTTPS. Source: https://edgium.net/en/docs-onboarding Leia esta página em português: https://edgium.net/docs-onboarding --- [Edgium](https://edgium.net/en/) / [Documentation](https://edgium.net/en/docs) / CDN onboarding # Edgium CDN onboarding: from first sign-in to a live site on HTTPS You have signed up for the Edgium CDN and want your site running behind it, with the HTTPS padlock. This guide takes you by the hand, without hurry and without loose jargon, from the first panel sign-in to the address opening securely. We will use one example from start to finish: the store `example.com`, which wants to put `www.example.com` behind the CDN. The screenshots come from a test environment, with fictional data. ## Before you start: what to have at hand There are three things, and none is hard to find. - **Panel access.** Accounts are created by the Edgium team. If you have not received your access yet, use the [contact form](https://edgium.net/en/contact#formulario). - **Access to the domain DNS.** It is the panel of the registrar (where you bought the domain) or of the provider that handles DNS today. You will create a record there, or switch the nameservers. - **The public IP and port of the site server.** It is the *origin*: the server the CDN fetches content from. The panel asks for the IP number, not the server name. **Example.** The store `example.com` has its site on a server with a public IP and the domain at the registrar where it was bought. That is all it needs to start. ## The visitor's path: what the CDN does for you **What it is and who it is for.** The CDN sits between whoever visits your site and your server. It is for anyone who wants a faster site, protected from attacks and with HTTPS, without touching the server. The visitor only talks to the CDN: it answers with the stored copy when it has one, and only goes to your server when it must. The WAF, the CDN firewall, looks at every request before that and stops the ones that look like an attack. **What the animation shows, in order:** 1. The visitor of `www.example.com` asks for the page. The request reaches the CDN and goes through the WAF first. 2. If the CDN already has a copy of the page in the cache, it answers at once, without bothering your server. 3. If it does not, the CDN fetches it from the origin, delivers it to the visitor and keeps the copy for the next ones. 4. A request with an attack pattern, such as an SQL injection, stops at the WAF and never reaches the origin. ## 1. Sign in to the panel **What it is.** The panel is where you add domains, turn HTTPS on and follow traffic. It lives at `secure.edgium.net`. **What to do.** Open the address, type your e-mail and password and sign in. If you forget the password, use **Forgot my password**. Anyone who is not a customer yet finds the **Talk to us** link on the same screen. The panel speaks Portuguese and English: use the **PT | EN** switch. ![Edgium panel sign-in screen with the e-mail and password fields](https://edgium.net/assets/img/docs/01-login.en.webp) Sign-in screen. Want to see the panel from the inside before moving on? Read the [panel guide](https://edgium.net/en/dashboard). ## 2. Add the domain **What it is.** The domain is your business name on the internet, like `example.com`. Adding it tells Edgium which name you will manage here. This step only registers the name: nothing changes on your site yet. **What to do.** On the **Dashboard**, click **ADD DOMAIN**. Type the domain without `http://` and without `www`. The "Account domains" list shows each domain with the **DNS** and **CDN** shortcuts. ![Panel Dashboard with the account domain list, the DNS and CDN shortcuts and the ADD DOMAIN button](https://edgium.net/assets/img/docs/02-dominio-adicionar.en.webp) Dashboard: domain list and the button to add one. ![Wizard step 1: the Domain field with the hint on what to enter](https://edgium.net/assets/img/docs/02b-dominio-nome.en.webp) Wizard step 1: the domain name. The wizard has three steps: **Domain**, **DNS records** and **Nameservers**. They apply to anyone who wants DNS on Edgium, as you will see in step 4. **If the panel refuses.** When the domain cannot be added right now, for example because it is already in another account, the panel says "This domain cannot be added right now. Contact support and give them the code" and shows a code that starts with `DOM-`. Do not try again: write to support with the code. The request stays under **Requests under review** and you get an e-mail when there is a decision. ## 3. Prove the domain is yours **What it is and who it is for.** Before putting a domain on the CDN, Edgium has to be sure it is yours. It is a protection for you: nobody can put your name on the CDN on someone else's behalf. The proof depends on where the domain DNS lives. **What the animation shows, in order:** 1. **DNS on Edgium:** you switch the nameservers of `example.com` to Edgium's. When they answer for the domain, ownership is proven. No TXT needed. 2. **DNS outside Edgium (CDN only):** you publish in your current DNS a TXT record the panel shows. Edgium checks it and ownership is proven. This is asked for only once. **With DNS elsewhere, what to do.** When you create the CDN for a domain that does not use Edgium DNS, the panel opens the **Confirm that this domain is yours** window. Follow its three steps: open the panel where the domain DNS is managed today; create the **TXT** record with the name and content shown (each has a copy button); and click **VERIFY AND CREATE** when the record appears. It can take a few minutes. ![Confirm that this domain is yours window, with the TXT record, the name, the content and the VERIFY AND CREATE button](https://edgium.net/assets/img/docs/03-posse-txt.en.webp) The TXT record that proves ownership. The value is for demonstration. If the panel says it did not find the record, check that the name was created exactly as shown and try again after a few minutes: DNS propagation can take a while. When the domain is already in a validated account of yours, its subdomains, like `www` and `shop`, go through without asking for the TXT again. ## 4. Take care of DNS: bring it to Edgium or point the record **What it is and who it is for.** DNS is the service that says where your site is. You choose between two ways. **Bringing DNS to Edgium** is for anyone who wants to handle everything in one panel, with the anycast network and a change history. **Keeping DNS where it is** is for anyone whose DNS is already in good order and only wants the CDN in front of the site. ### Option A: bring DNS to Edgium Continue in the wizard. In the **DNS records** step, Edgium looks in the current DNS for the common records (`www`, `mail`, SPF, DKIM and others) and shows what it found. Check the list and add what is missing, so the site and e-mail do not stop after the switch. The list may be incomplete, because DNS does not allow listing every name: compare it with the current zone. Then, in the **Nameservers** step, switch the domain nameservers, at the registrar, to the two the panel shows (**Primary** and **Secondary**, each with a **Copy** button). ![Point the nameservers step, with the two nameservers, the Copy button and the Check now button](https://edgium.net/assets/img/docs/04-nameservers.en.webp) Nameservers step: switch to the two addresses at the registrar. The switch takes from a few minutes to 48 hours to apply everywhere, and your site and e-mail stay as they are until then. The panel checks by itself, every 30 seconds while the page is open, and you can also click **Check now**. When the nameservers apply, ownership of the domain is proven and the zone starts answering. With DNS on Edgium, the subdomain record is created on the domain **DNS Zone** tab, with a review before saving and the **Undo** button. ![New A record window with the name loja and an example address](https://edgium.net/assets/img/docs/05-dns-registro.en.webp) Creating an A record in the DNS Zone. The address is an example. For the full managed DNS walkthrough, with zone import, DNSSEC and best practices, read [DNS management and DNSSEC](https://edgium.net/en/docs-dns). ### Option B: keep DNS where it is Here you do not switch any nameserver. When the domain stays without Edgium DNS, it shows with the **No Edgium DNS** badge and the panel says: "To use Edgium DNS, point the nameservers at the registrar. With the CDN on your own DNS, this is normal." Ownership is proven by the TXT from step 3, and the pointing is an A record the panel shows, with the exact value, in step 3 of the activation (see step 6 of this guide). You create that record at the provider where DNS lives today. If you already added the domain through the wizard and now prefer to keep DNS elsewhere, the domain **DNS** screen has the **Edgium DNS** switch. When off, the domain stays without Edgium DNS. The panel asks for confirmation, because the zone records on Edgium are lost. ## 5. Add the subdomain and the origin **What it is.** The subdomain is the address that will go through the CDN, like `www.example.com`. The origin (the panel also says *upstream*) is the server where the real site lives. **What to do.** In the panel, open **CDN**, choose the domain and click **Add subdomain**. Type only the part before the dot (`www`). To use the domain without a prefix, tick **Root domain**. Then enter the origin server: name, public IP, port and priority. Keep **Enable on creation** ticked, check the summary and click **CREATE SUBDOMAIN**. ![Review step of the subdomain wizard before creating](https://edgium.net/assets/img/docs/06-subdominio-assistente.en.webp) Review: check the subdomain and the origin before creating. Use the public IP of the server. Every detail of the wizard is in the [panel guide](https://edgium.net/en/dashboard#novo-subdominio). ## 6. Follow the 8-step activation **What it is.** After it is created, the subdomain goes through 8 steps until HTTPS is active. The panel shows which one it is in, what is already done and who acts now: you or Edgium. You do two steps. In a subdomain created from November 6, 2026, the certificate and HTTPS are automatic. **What the animation shows, in order:** 1. **Site registered:** what you did in the previous step. 2. **Sending to the network:** Edgium publishes the configuration on the servers. It usually takes up to 30 minutes. 3. **Point your DNS:** you create the A record the panel shows, with the Copy button. If DNS is on Edgium, the record is created in the DNS Zone. 4. **DNS validation:** Edgium checks by itself, every 5 minutes. You do not need to tell us. 5. **Certificate, network and HTTPS:** Edgium requests the free certificate (Let's Encrypt), waits for it to reach every server on the network and only then turns HTTPS on, with the redirect from http to https. ![Subdomain overview with step 3 Point your DNS, the A record and the Copy button](https://edgium.net/assets/img/docs/07-passos-visao-geral.en.webp) Overview: here step 3 is waiting for you. The addresses are the ones the panel shows for the customer to point to. **Why it can take a few minutes.** HTTPS only turns on with the certificate published and confirmed at every point of the network. So, after the certificate is issued, step 8 may show "We are publishing HTTPS on the network." for a few minutes. That is normal. **Prefer to do it by hand?** On the **SSL** tab there is the **Issue Let's Encrypt certificate automatically** switch. When off, nothing is issued or turned on by itself, and you go through the **Create** and **SSL activation** buttons. If your domain has a CAA record that does not authorize `letsencrypt.org`, the panel warns you and you add the authorization to your DNS; Edgium tries again by itself. HSTS is never turned on unless you ask. ![SSL tab with the automatic Let's Encrypt certificate switch on](https://edgium.net/assets/img/docs/08-ssl-automatico.en.webp) SSL tab: the automatic certificate comes on. ### Watch the video (1 min 45 s) Your browser does not play video. [Download the file (MP4)](https://edgium.net/assets/video/ativacao-subdominio.mp4). The video has Portuguese captions on screen and shows the manual path (requesting the certificate with Create and turning HTTPS on). Captions in [VTT](https://edgium.net/assets/video/ativacao-subdominio.vtt) or [SRT](https://edgium.net/assets/video/ativacao-subdominio.srt). Each step, with screenshots, is in the [subdomain activation guide](https://edgium.net/en/dashboard-activation). ## 7. Check the WAF and Analytics **What it is and who it is for.** The WAF protects your site from common attacks before they reach the server. Analytics shows how the site is being delivered. Both are for anyone who wants to know the site is protected and that they can see what happens. **WAF.** Open the subdomain **WAF** tab. It has the general **WAF** switch and the blocks by attack type: **SQL injection**, **Path traversal**, **RFI**, **Evasion technique** and **XSS**. Check that the WAF is **Enabled**. The **Learning mode** logs what would be blocked without blocking anything: it is for observing before protecting. ![WAF tab with the WAF enabled, learning mode off and the SQL injection, path traversal, RFI, evasion and XSS blocks](https://edgium.net/assets/img/docs/10-waf.en.webp) WAF tab: the general switch and the blocks by attack type. **Analytics.** On the **Analytics** tab, the **Summary** shows requests, data delivered, cache rate, 5xx errors and response time. The **Origin health** section answers the most useful everyday question: is the problem your server or the CDN? The numbers appear as visitors arrive. ![Analytics tab with the period summary and the origin health, with demonstration data](https://edgium.net/assets/img/docs/11-analytics-resumo.en.webp) Analytics: summary and origin health. The numbers are for demonstration. To read the 502, 503, 504, 499 and 4xx errors, see [Analytics and WAF logs](https://edgium.net/en/dashboard-analytics). ## 8. Confirm it worked Go back to the **Overview** tab. When everything is ready, the panel shows **All set: HTTPS active**. Open `https://www.example.com` in the browser and check the padlock. ![Overview with the message All set: HTTPS active](https://edgium.net/assets/img/docs/09-https-ativo.en.webp) All set: HTTPS active. The `example.com` store finished onboarding: visitors open the site through the CDN, on HTTPS, and the store server stays hidden behind it. ## If you get stuck, ask for support Start with the manual for your topic: the [documentation center](https://edgium.net/en/docs) gathers them all. If that does not solve it, write to [suporte@edgium.net](mailto:suporte@edgium.net). On the [support page](https://edgium.net/en/support) you see what to check first and what to send (the site address, the time, the provider and screenshots), so the answer comes sooner. ## Frequently asked questions ### How long until the site is live on HTTPS? It depends on you and your DNS provider. DNS propagation takes from a few minutes to a few hours. Once the DNS is validated, the certificate and HTTPS come by themselves and can take a few minutes. ### Do I need to move my DNS to Edgium? No. You can keep your DNS where it is and just point the subdomain to the CDN. In that case Edgium asks for a TXT record, once, to prove the domain is yours. Moving the DNS is your choice. ### Do I have to request the certificate and turn HTTPS on? Not in subdomains created from November 6, 2026: Edgium requests the free certificate and turns HTTPS on after the DNS is validated. If you prefer to do it by hand, use the switch on the SSL tab. ### What if the panel says the domain cannot be added right now? The message carries a code that starts with DOM-. Write to suporte@edgium.net with that code. The team reviews it and e-mails you; the request shows under Requests under review. ### Where do I ask for help? Read the manual for your topic first, in the documentation center. If that does not solve it, write to suporte@edgium.net with what the support page asks for. ## Do not have panel access yet? Accounts are created by the Edgium team. Tell us your domain and we will prepare access and a test with your site. [Talk to Edgium](https://edgium.net/en/contact#formulario) --- # Edgium support: manuals, what to send and how to get help > Solve it yourself with the CDN and DNS manuals and, if you need to, write to suporte@edgium.net with the checklist: address, time, provider and screenshots. Source: https://edgium.net/en/support Leia esta página em português: https://edgium.net/suporte --- [Edgium](https://edgium.net/en/) / [Documentation](https://edgium.net/en/docs) / Support # Edgium support: manuals first, help from people when you need it Most questions are solved in a few minutes in the right manual, and we have sorted out where to start. If that does not solve it, write to [suporte@edgium.net](mailto:suporte@edgium.net) with what we ask below: that way the answer comes sooner. **Careful:** to get support you do not need to send your password, verification code or a token. Do not send them in the request or to an AI. ## 1. Look in the manual It is the fastest way. Every manual has screenshots, a step by step and the list of common errors. Just signed up? Start with the onboarding. - [**CDN onboarding**: From first sign-in to a live site on HTTPS.](https://edgium.net/en/docs-onboarding) - [**Panel guide**: Sign-in, navigation, new subdomain, password and cache.](https://edgium.net/en/dashboard) - [**Activate a subdomain**: The 8 steps to HTTPS, with the automatic certificate.](https://edgium.net/en/dashboard-activation) - [**Analytics and WAF logs**: Read origin health and the 502, 503, 504, 499 and 4xx errors.](https://edgium.net/en/dashboard-analytics) - [**DNS management and DNSSEC**: Zone, import, nameserver switch, DNSSEC and best practices.](https://edgium.net/en/docs-dns) - [**DNS in the panel**: Review before saving, Undo and history.](https://edgium.net/en/dashboard-dns) Prefer to search by term? Use the search in the [documentation center](https://edgium.net/en/docs). Most sought topics: - [Proving the domain is mine (TXT or nameservers)](https://edgium.net/en/docs-onboarding#passo-3) - [Pointing the subdomain DNS](https://edgium.net/en/dashboard-activation#dns) - [Automatic certificate and HTTPS](https://edgium.net/en/dashboard-activation#automatico) - [502, 503, 504, 499 and 4xx errors](https://edgium.net/en/dashboard-analytics#erros) - [Is it my server or the CDN?](https://edgium.net/en/dashboard-analytics#saude) - [Undoing a DNS change](https://edgium.net/en/dashboard-dns#desfazer) - [Turning DNSSEC on](https://edgium.net/en/docs-dns#dnssec) ## 2. Prefer to ask an AI? Hand it the manual link Every manual also exists as plain text, at the same address with **.md** at the end. Hand the link to the assistant you already use, such as Claude, ChatGPT, Gemini or Copilot, and ask in English. **Always use the link**, without downloading or attaching a file: through the link the assistant reads the current manual, and a downloaded file gets old. - [CDN onboarding](https://edgium.net/en/docs-onboarding.md) - [Panel guide](https://edgium.net/en/dashboard.md) - [Activate a subdomain](https://edgium.net/en/dashboard-activation.md) - [Analytics and WAF logs](https://edgium.net/en/dashboard-analytics.md) - [DNS management and DNSSEC](https://edgium.net/en/docs-dns.md) - [DNS in the panel](https://edgium.net/en/dashboard-dns.md) - [Support (what to check and what to send)](https://edgium.net/en/support.md) - [All manuals together, in a single link](https://edgium.net/en/llms-full.txt) ### An example, step by step 1. **Open the assistant.** For Claude, go to [claude.ai](https://claude.ai). The same goes for ChatGPT, Gemini and Copilot. 2. **Paste the manual link.** Above, click "Copy link" on the manual for your topic, for example `https://edgium.net/en/dashboard-analytics.md`, and paste it into the chat. To have all manuals at once, paste `https://edgium.net/en/llms-full.txt`. 3. **Ask with your case.** Write the way you would speak to a person. 4. **Check it in the manual.** Open the section the answer cites and compare before acting. If it does not cite the section, ask: *which section of the manual is this in?* 5. **Still not solved?** Write to [suporte@edgium.net](mailto:suporte@edgium.net) with the checklist below filled in. You `https://edgium.net/en/dashboard-analytics.md` My store example.com already points to the CDN, but the site shows a 502 error. What should I check? Answer from the manual in the link. AI assistant (for example, Claude) From the manual you pasted, a 502 means the CDN tried to talk to your server and it refused, closed the connection or returned an invalid response. Check in this order: 1. Are the server and the site service up? 2. Is the port open in the server firewall for Edgium? 3. Does the application restart under heavy load? [See in the manual: Error guide](https://edgium.net/en/dashboard-analytics#erros) **Two cautions.** The AI can be wrong: check the answer in the manual and, if it does not solve it, write to support. And never send it your password, a verification code or a token. ## 3. Check before asking for help Six things you can see in the panel yourself, in a few minutes. If none solves it, what you saw already helps us find the cause. - **Which of the 8 steps is the subdomain in?** Open the **Overview** tab. The panel says who acts now, you or Edgium. See the [activation guide](https://edgium.net/en/dashboard-activation). - **Is the DNS record right?** In step 3, check that the type, name and address at your provider are exactly the panel's, and wait for propagation (from a few minutes to a few hours). - **Was domain ownership proven?** With DNS outside Edgium, the TXT record must be published with the exact name. See [step 3 of the onboarding](https://edgium.net/en/docs-onboarding#passo-3). - **Does the error come from your server or the CDN?** The **Origin health** section of Analytics says. 502, 503 and 504 errors point to the origin server. See the [error guide](https://edgium.net/en/dashboard-analytics#erros). - **Does the origin have an active server?** Open the **Upstreams** tab and check there is an active server, with the right IP and port. Without an active origin, the CDN has nowhere to send traffic. - **Was it a recent DNS change?** The **DNS Zone** tab has the history and the **Undo** button. See [DNS in the panel](https://edgium.net/en/dashboard-dns#historico). ## 4. What to send in the support request With this data at hand, the analysis and the fix are faster. If the problem happened to a customer or user of yours, ask them for the data below. ### 1. From whoever has the problem - **Internet provider:** the name of the carrier used when the problem happened. - **IP address:** open a site that shows your IP and give the number displayed. ### 2. About the problem - **Exact address:** the full URL where the error happens, like `https://www.example.com/orders`. - **Screenshots:** the error in the browser, showing the address and the message or code. - **When it happened:** approximate date and time, and whether it is still happening. ### 3. Network diagnosis It shows the path between whoever is browsing and the CDN. One of the options is enough. On Windows, open Command Prompt and run `tracert www.example.com`; on macOS or Linux, run `traceroute www.example.com` in the Terminal. Replace the address with the one that has the problem, copy the result and send it. For a more detailed test on Windows, use WinMTR and let it run for a few minutes while the problem is happening. ### 4. HTTP headers (optional) They help us see how the CDN handled that request. In the browser, open the page with the problem, press `F12`, go to the **Network** tab, reload, click the first row and, under **Response headers**, copy the values of `edgium-x-cache` and `edgium-x-vision`. The full guide, in Markdown, is in the [Edgium public repository](https://github.com/edgium/public/blob/main/guias/problemas-de-acesso-cdn.md). ### Template to copy ``` Address with the problem: Date and time: Internet provider: IP address: Traceroute or WinMTR result: edgium-x-cache (optional): edgium-x-vision (optional): Screenshots: attached ``` ## 5. Talk to support Every support request goes to the same place: **[suporte@edgium.net](mailto:suporte@edgium.net)**. Paste the template above, filled in, and attach the screenshots. In our ticket system, you follow the service from start to finish. [Write to support](mailto:suporte@edgium.net) Want to sign up, ask for a quote or arrange a trial? That is for sales, on the [contact page](https://edgium.net/en/contact). ## Frequently asked questions ### What is the Edgium support channel? The e-mail suporte@edgium.net. Every support request should be sent to it. Send the checklist filled in so the answer comes sooner. ### What do I send in the support request? The exact address with the problem, the date and time, the internet provider and the IP of whoever had the problem, screenshots of the error and, if you can, the traceroute or WinMTR result. ### Can I use an AI to ask questions? Yes. Paste the manual link (the address with.md at the end) into the assistant and ask with your case. Check the answer in the manual and never send passwords or verification codes. ### Does support ask for my password? You do not need to send a password, verification code or token to anyone to get support. If a support request demands that, be suspicious and write to suporte@edgium.net. ### What if it is a sales matter? To sign up, ask for a quote or arrange a trial, use the contact page or the sales WhatsApp. ## Need help now? Write to suporte@edgium.net with the checklist filled in: address, date and time, provider, IP and screenshots. [Write to support](mailto:suporte@edgium.net)