Delivery modes
Proxy websites. Keep mail and control records direct.
DNS answers tell clients where to connect. Proxy and WAF settings determine whether compatible web traffic passes through Help4 before reaching the origin.
Default rule
Proxy public HTTP/HTTPS website hostnames. Keep MX, DKIM, DMARC, SPF, verification, and non-web protocols DNS-only unless a specific Help4 product supports proxying that protocol.
Mode chooser
Full proxy + WAFBest for public websites and supported APIs that need origin shielding, attack filtering, TLS, and edge delivery.
Proxy with limited cachingUse for dynamic websites where WAF and origin shielding are required but authenticated pages must bypass shared cache.
DNS-onlyUse for MX targets, mail, SSH, verification records, and protocols not explicitly supported by the proxy.
Temporary bypassUse only as a controlled diagnostic state. It can expose the origin and should have an owner, reason, and end time.
Typical choices
| Record/hostname | Typical mode | Reason |
|---|---|---|
| Apex website and www | Proxy + WAF | Public web delivery and origin protection. |
| API over HTTPS | Proxy + WAF, no-store where private | Protect requests without caching credentials or personalized responses. |
| MX and mail hostnames | DNS-only | SMTP is not ordinary website traffic. |
| SPF, DKIM, DMARC, verification | DNS-only records | These are DNS policy/ownership data, not proxied destinations. |
| Admin or origin identity | Restricted/direct by design | Never expose a private origin name merely to make setup easier. |
Cache safety
- Never cache authenticated requests, POSTs, private responses, or responses containing session cookies.
- Cache static public assets locally at the nearest POP.
- Use short or bypass policies for session-sensitive HTML.
- Purging cache does not change DNS, certificates, origin content, or mail routing.