Getting started
How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.
Connect a hostname
Three ways in.
Shield needs to answer for a hostname before it can serve it. There are three ways to arrange that, and they differ in how much of your DNS has to move.
01
Which one
| Way in | Move | Pick it when |
|---|---|---|
| Whole domain | Name servers at the registrar | You want us to answer for the whole domain, including the apex. |
| One hostname | Two NS records in your existing DNS | The rest of the domain must stay where it is. |
| CNAME | One CNAME, plus one for certificates | You only want Shield, and your DNS stays untouched. |
The console recommends one for the hostname you type. An apex — example.com with nothing in front — cannot take a CNAME, so for an apex the answer is either the whole domain or a provider that supports apex aliasing.
02
The CNAME way, in full
- In the console add the site and give it your origin address. We generate a target name inside
edge.yunzheng.space. - In your own DNS, point the hostname at that target with a CNAME.
- Add a second CNAME for
_acme-challenge.<label>pointing at_acme-challengeunder the same target. This is what lets the certificate issue and renew without you doing anything again. - Remove the A and AAAA records for that hostname. While they exist, some resolvers will keep using them.
The exact two records, with the generated name filled in, are shown on the site's page in the console. Copy them from there rather than assembling them by hand.
03
What the edge does with your origin
Once a name is proxied, a lookup for it never returns your origin address. The edge answers with its own addresses, chosen for where the visitor is, with a 60-second TTL. Your origin address is not in DNS, not in a zone transfer, and not in an export.
That is only half of hiding an origin. The other half is that the origin must refuse everybody else — see Link, which removes the need for it to accept any inbound connection at all.
04
Questions
Will my certificate renew by itself?
Yes, as long as the <code>_acme-challenge</code> CNAME stays in place. That record is the whole renewal mechanism; deleting it is the usual reason a certificate stops renewing months later.
Can I use the apex with a CNAME?
Not with a plain CNAME — DNS does not allow it. Either host the whole domain with us and use an ALIAS record at the apex, or use a DNS provider that offers apex aliasing of its own.
Next
Related
DNS hosting
Add a zone, point your registrar at our name servers, manage records: weighted answers, health-checked records, ALIAS at the apex, zone-file import.
Link (origin tunnels)
A connector on your server dials out to a city you choose and holds the connection open; your site is reachable through Orbit with no public address or port.