Official Documentation Hub

Registry is not merely a standard domain registrar; it operates as an advanced Global Edge Routing Protocol engineered for modern, high-performance applications. By provisioning a namespace through our platform, your infrastructure is instantaneously propagated across our massive global Anycast network.

This deep integration ensures that you benefit from single-digit millisecond latency, enterprise-grade Layer-7 Web Application Firewalls (WAF), and automated threat mitigation right out of the box. Our architecture eliminates the need for separate proxy configurations by baking Cloudflare's core infrastructure directly into the control plane.

Securing Your Identity Protocol:

• Access the Console

  Authenticate via standard encrypted credentials. If global 2FA is active, an initial One-Time Password (OTP) will be dispatched to your email automatically preventing brute-force access.

• Navigate to Identity Settings

  From your primary dashboard, access the Identity Settings interface. Locate the "Mandatory Authentication Method" panel to review your current security posture.

• Link Authenticator Application

  Select the "Authenticator App" protocol. Scan the generated QR Code using Google Authenticator, Authy, or any standard TOTP application. Input the 6-digit cryptographic code to finalize the binding process. This provides mathematically secure, offline-capable verification.

Failure to provide a valid Phone Number, Verified City, and Physical Address will trigger an automated deployment block. You will observe a critical red alert banner within your dashboard if your identity parameters are deemed incomplete.

To rectify this, navigate to the Identity Matrix, complete the "General Info" parameters, and execute the "Synchronize Identity" command. Falsified data will lead to immediate zone suspension.

To maintain absolute network stability and prevent resource abuse, every verified identity is assigned a strictly monitored deployment quota. This dynamic value dictates the maximum aggregate of active namespaces you are authorized to maintain simultaneously.

Your current utilization metrics are continuously displayed on the real-time Quota Bar located in the left navigation panel of your Dashboard. Your total quota is calculated as: Base Allowed + Bonus Quota + Active Invoiced Quota. You can purchase additional quota limits from the dashboard.

• Search & Verify Availability

  Utilize the "Deploy New Namespace" query interface on your Dashboard. Input your desired nomenclature, select the appropriate Top-Level Domain (e.g., .com, .dev) from the dropdown matrix, and initiate the availability scan. The system queries upstream registrars in real-time.

• Execute Deployment Sequence

  If the namespace is available and unreserved, trigger the "Deploy Zone" command. The platform will initialize a deployment loader, automatically communicating with the global API to provision your zone on the edge, assign DNS servers, and prepare SSL certificates.

Single Record Injection

Navigate to the Manage Zone interface for your specific domain. Within the "Advanced DNS Records" module, you can manually inject A, CNAME, TXT, or MX records. To target the root domain hierarchy, utilize the @ symbol in the Name parameter. Every record is proxy-enabled by default where applicable.

Bulk Import Engine (JSON/CSV/BIND)

For large-scale migrations, leverage the "Bulk Import" functionality. This initializes an overlay modal where you can paste raw DNS configurations. Our parsing engine automatically formats and dispatches the payload to the edge network simultaneously, eliminating manual entry.

By default, the platform leverages our deeply integrated Edge Proxy network to ensure maximum security and speed. However, for users requiring absolute external control over their zone files, we offer Custom Nameserver (NS) Delegation.

Switching to Custom NS allows you to point the domain directly to DigitalOcean, AWS Route53, or traditional cPanel servers. The change propagates globally within 5 to 15 minutes.

Implement highly efficient HTTP redirects directly at the edge layer without requiring a backend origin server or writing server-side code. This is exceptionally fast as the redirect executes at the network node closest to the visitor.

Navigate to the URL Forwarding Tab within your Zone Management console. Input your destination uniform resource locator (e.g., `https://github.com/your-repo`), and execute the "Activate Route" command. The system will instantly deploy a 301 Forwarding Page Rule via the API, overriding standard DNS configurations for that specific namespace.

• Purge Entire Edge Cache

  Executing the "Purge Everything" command sends a destruction signal to all global edge nodes. This forces the network to fetch a fresh, un-cached version of your HTML, CSS, JS, and image assets from your origin server. Use this immediately after deploying major website updates.

• Engage Development Mode

  If you are actively pushing rapid code deployments and need to bypass cache continuously, engage "Development Mode". This temporarily halts all caching layers, allowing real-time visibility of changes. To protect your origin server from traffic spikes, Development mode automatically deactivates after 3 hours.

• Dynamic Namespace Isolation

  Use the "Current Namespace" dropdown in your management dashboard to switch contexts between your Root Domain (@) and any configured Subdomains. Settings applied while a specific context is active (such as Page Rules, Bot Defense, or URL Forwarding) are isolated strictly to that namespace. This allows different security policies for your API vs your Frontend.

• Active/Standby Matrix Nodes

  When you navigate to the Subdomains tab (or Matrix Routing tab when inside a subdomain context), you can configure multiple endpoints (A or CNAME records) for a single namespace. Utilize the toggle switch to instantly shift traffic to the Active node while keeping secondary servers on Standby. This is perfect for Blue/Green deployments or instant failover during server maintenance.

Emergency Threat Neutralization

In the event of a catastrophic Layer-7 DDoS attack, a massive automated botnet swarm, or a heavy scrapers attack, the DEFCON 1 Panic Mode serves as your ultimate infrastructure kill-switch. Navigate to the Security Tab and trigger the ENGAGE PANIC MODE sequence.

This action instantly injects aggressive mitigation rules (Cloudflare "I'm Under Attack" mode) across your entire zone. All incoming traffic will be aggressively filtered through a computational JS challenge and CAPTCHA, completely neutralizing malicious automated scripts before they reach your origin, keeping your server online.

Protect your incoming traffic from devastating DNS cache poisoning, unauthorized zone spoofing, and Man-In-The-Middle (MITM) redirection attacks by enabling Domain Name System Security Extensions (DNSSEC).

Toggling the "DNSSEC Status" switch within the Security console will instruct the edge network to apply cryptographic signatures to all your DNS records. By establishing this chain of trust, clients verify that the IP addresses returned match exactly what you published. Note that global resolver validation may take up to 24 hours to fully propagate.

Absolute control over the cryptographic handshake between the Edge Network and your Origin Server is vital for compliance and security. Choose the appropriate mode from the Security tab:

• Flexible Mode: Encrypts traffic solely between the client browser and the Edge. Traffic from the Edge to your server is unencrypted. Recommended only if your origin server cannot support an SSL certificate at all.
• Full Mode: Encrypts traffic end-to-end. Requires an SSL certificate on your origin server, but it can be self-signed or expired. Protects against packet sniffing.
• Full (Strict) Mode: The highest echelon of security. Mandates end-to-end encryption requiring a strictly valid, unexpired certificate natively signed by a trusted CA (like Let's Encrypt) on your origin server. Recommended for E-commerce and APIs.

Transmitting plaintext passwords, sensitive API keys, or root server credentials across standard communication channels is a critical security vulnerability. Our platform incorporates a Quantum Secret Vault designed specifically for secure data transmission to Network Administrators during support requests.

When generating a Support Ticket or submitting a reply, select the "Encrypt with Burn-After-Reading Protocol" checkbox and input your sensitive credentials. The data is encrypted at rest. Once viewed by the authorized administrator, the system automatically purges the data from the underlying database forever, ensuring zero residual traces.

High Security Bot Block

Enable Advanced Bot Protection from the Security tab to aggressively filter traffic. The system utilizes machine learning heuristics to challenge all suspicious and headless browser requests with CAPTCHAs before they can reach your server, dramatically reducing server load from scraping and spam networks without impacting human users.

Registrar Lock

As the primary owner of a namespace, enabling Registrar Lock enforces absolute security over your infrastructure. While locked, no modifications can be made to DNS records, page rules, SSL settings, 1-Click apps, or team memberships. This completely protects your domain from unauthorized hijacking, accidental deletions, or malicious internal manipulation by compromised team accounts.

Within the Team Tab of your Zone Manager, input the registered email address of your developer or agency partner to dispatch a secure access invitation. The recipient must hold an active account on the platform.

Upon formal acceptance, they are granted scoped permissions allowing them to manipulate DNS records, toggle Dev mode, and adjust routing configurations. Crucially, Team Members are strictly prohibited from initiating zone deletions, executing ownership transfers, altering registrar locks, or modifying team structures. Team access is currently granted at the Root Domain level.

Execute secure, permanent namespace ownership handovers utilizing our dual-handshake protocol:

1. Access the Transfer Tab within the specific Zone Management console (must be Root owner).
2. Input the exact verified email address of the target recipient and execute the "Initiate Transfer" command.
3. If a transfer fee applies based on the TLD, you will be securely redirected to our Cart system to provision the transfer payload.
4. The designated recipient must authenticate into their dashboard to review and formally accept the request. They will assume full billing responsibility going forward.
5. Critical Event: Upon target acceptance, the platform automatically purges all existing Team Members and irrevocably shifts the root ownership. You will immediately lose access to the namespace.

Every successful namespace deployment, quota purchase, renewal sequence, or ownership transfer transaction automatically triggers our internal accounting engine.

The system generates compliant invoice records dynamically. Navigate to the Ledger & Invoices module within your Identity Matrix. From here, you can view transaction histories, check payment gateways used, and execute one-click downloads of high-fidelity PDF documents for your corporate accounting.

Our platform features native, single-click integration with over 20 global deployment networks including:

• Provisioning Target Information

  Go to your hosting provider's dashboard (e.g., Vercel or Netlify), add your custom domain, and obtain the necessary Verification TXT or App URL (e.g., your-app.vercel.app or cname.vercel-dns.com).

• Execute Auto-Connect

  Select the corresponding provider in the Go Live Connect tab, input the target data into the modal, and click Connect. The system automatically scrubs conflicting root records, provisions the necessary A/CNAME endpoints, injects verification TXTs, and synchronizes the Edge Network.

• Partial Connection States

  If you manually delete an auto-provisioned record later, the system will flag the connection as Partial. You can click the "Fix Connection" button to automatically restore the missing routing records.

If you utilize standard cPanel, WHM, VPS, or Dedicated Hosting, you can utilize the Custom Server / Web Hosting connect widget located at the bottom of the Go Live tab.

By entering your server's IPv4 address (A Record) or Target Domain (CNAME), the engine instantly provisions both the root @ and www endpoints simultaneously. This ensures your domain points correctly to your custom infrastructure without needing to manually configure individual DNS matrices in the Advanced tab. It also automatically cleans up any conflicting 1-Click platform records.

Navigate to the Email Setup tab to access the Enterprise Workspace Matrix. This module allows you to automatically inject highly complex, multi-priority routing configurations for premium providers with a single click.

• Supported Providers: Google Workspace, Microsoft 365, Zoho Mail, Apple iCloud+, Proton Mail, and Fastmail.
• Injection Protocol: Entering your custom DKIM selector, the system automatically provisions all primary and backup MX servers, injects the provider's specific SPF identities, configures custom DKIM cryptographic keys, and establishes strict DMARC anti-spoof policies to ensure high deliverability and security.

If you do not require a full paid Enterprise Mailbox, utilize our native Edge Email Engine.

You can create an unlimited number of professional email aliases (e.g., [email protected]) directly from the dashboard. Once configured, the Cloudflare network intercepts incoming mail and routes it directly to your personal verified inbox (e.g., your personal Gmail or Outlook).

Break free from the limitations of standard email alerts. Integrate critical infrastructure notifications—such as domain expiration warnings, DNS mutation alerts, and support matrix updates—directly into your organization's daily communication workflows.

Navigate to the Channels & Webhooks module within your Identity Settings. Here you may define specific API endpoints and activate routing toggles to dispatch JSON payloads directly to Discord, Slack workspaces, or custom internal endpoints.

Initially, you must generate your unique cryptographic Master Token (Format: RPRO_...) from the "Developer REST API" sector within your Identity Settings. This token acts as your root key and must be included within the standard Authorization: Bearer HTTP header for all programmatic requests originating from your CI/CD pipelines. Never commit this token to public repositories.