What is authoritative DNS and why does it matter for proxies?

An authoritative DNS server holds the definitive records for a zone and answers queries directly, without deferring to anyone else. Delegating your domain to Nodetonet's nameservers means every subdomain you create for a tunnel or proxy is resolved by our infrastructure automatically — no manual DNS updates each time you spin up a new endpoint.

Will changing my nameservers affect my existing website or email?

Yes, nameserver delegation replaces all DNS for the domain. Before switching, export your existing A, MX, TXT and other records and recreate them in the Nodetonet panel. After delegation the panel becomes the sole source of truth for that zone. If you only need a subdomain for proxies and want to leave the rest of the domain untouched, use the CNAME method instead — see our guide on bringing your own domain.

How long does DNS propagation take after I change my nameservers?

Most registrars publish the change within 1 to 6 hours. In rare cases it can take up to 24 hours before resolvers worldwide see the new nameservers. During this window your zone continues to answer from the old nameservers — there is no outage, just a delay before new records are live.

Can I get a wildcard SSL certificate for my domain?

Yes, and this is one of the main reasons to use authoritative delegation. Because Nodetonet controls the zone, we can issue a DNS-01 ACME challenge and obtain a Let's Encrypt wildcard certificate — *.yourdomain.com — covering all subdomains in a single cert. Renewals are handled automatically. See the wildcard SSL guide for details.

Is there a limit on how many subdomains I can create under a delegated domain?

There is no hard cap imposed by Nodetonet. You can create as many proxy, tunnel, or static subdomains as your plan allows. Each proxy or tunnel you add in the panel automatically gets its own DNS record without any manual steps on your part.

Can I move the domain back to my original DNS provider later?

Yes. Simply go to your registrar and point the nameservers back to your original pair (or any other provider). After propagation your zone is fully managed there again. Before switching away, export any records you created in the Nodetonet panel so you can recreate them at the new provider. There are no exit fees or contract obligations — billing is prepaid credit with no subscription.

Authoritative DNS using our nameservers — park your domain on Nodetonet

The CNAME approach to custom domains is easy and surgical: one record, your existing DNS keeps working. But for resellers running dozens or hundreds of subdomains under the same brand, setting a CNAME per subdomain gets tedious fast. The cleaner option is to hand us the whole zone — point your registrar at our nameservers and let Nodetonet be authoritative for the domain.

From that moment, every record under the zone is managed in the panel and propagates from our edge. No round-trips to your DNS provider, no CNAMEs anywhere, and every new proxy tunnel gets its own subdomain automatically.

CNAME vs authoritative — which should you pick?

Both modes let you run proxy endpoints and tunnels under your own brand. The right choice depends on how many subdomains you need and whether you care about owning the whole zone.

Criterion	CNAME delegation	Authoritative (NS delegation)
Setup effort	One record per subdomain	Two NS records, then done
Number of subdomains	Best for 1–5	Unlimited, automatic
Wildcard SSL	Not available	Available (DNS-01 challenge)
Automatic DNS per tunnel	No — you add each CNAME	Yes — panel mints it on tunnel create
Control over mail, TXT, SRV	Stays at your provider	Moves to Nodetonet panel
Reversibility	Seconds	Minutes (re-point NS back)

If you bought a domain specifically for proxy or HTTP tunnel hosting and you want unlimited subdomains and a single wildcard cert, delegate the whole zone. If you just need one vanity subdomain on a domain that also hosts your website and email, use a CNAME instead.

Step 1 — Add the domain in the panel

Go to /domains and click + Add domain. Pick Authoritative as the mode (the default is CNAME). Type the apex you want to delegate — usually something like acme-proxies.com, a brand-aligned name you bought for this purpose.

The panel returns two nameserver hostnames you will paste at your registrar:

ns1.nodetonet.com
ns2.nodetonet.com

These are anycast: physically distributed across multiple regions, replying to queries from whichever location is closest to the resolver asking. There is no single point of failure and no geographic latency penalty.

Step 2 — Update your registrar

Log in wherever you bought the domain — Namecheap, GoDaddy, Cloudflare Registrar, Porkbun, Gandi, anywhere — and change the nameservers from your current pair to ns1.nodetonet.com and ns2.nodetonet.com. This is usually under a heading like "Nameservers", "DNS", or "Domain settings".

Two important caveats before you switch:

This replaces all existing DNS for that domain. If you currently have MX records pointing at a mail provider, A records for a website, or TXT records for SPF/DKIM, copy them first — you will recreate them in the panel after delegation.
Propagation is not instant. Registrars publish nameserver changes on their own schedule, often 1–6 hours, occasionally up to 24 hours. The zone keeps answering on your old nameservers during this window — there is no outage, but new records will not take effect immediately.

Step 3 — Watch the panel for "Delegated"

Nodetonet probes your domain's NS records every minute. The moment both nameservers point at us, the domain flips from Pending delegation to Delegated. At that point you own the zone — every query for any record under that domain comes to our infrastructure.

You also get an automatic SOA record, NS records, and an optional DNSSEC chain. If your registrar supports DS records and you want DNSSEC end-to-end, the panel shows the DS values to paste at the registrar — no separate tooling needed.

Step 4 — Manage records in the panel

The domain detail page now shows a full DNS editor. You can add:

A and AAAA records for static IPs.
CNAME records pointing wherever you like.
MX records for mail delivery.
TXT records for SPF, DKIM, DMARC and verification challenges.
SRV records for service discovery.

Records publish to our anycast edge within seconds of saving. There is no separate "deploy" step, and changes are visible globally as fast as resolver TTLs allow.

Step 5 — Proxy and tunnel subdomains are automatic

This is the real payoff for resellers using white-label proxy hosting. Once the zone is delegated to us, every mobile proxy, rotating proxy or HTTP tunnel you create under this domain gets its own subdomain — tun01.acme-proxies.com, tun02.acme-proxies.com, and so on — with no DNS work from you. We mint the A record, issue the Let's Encrypt certificate using a DNS-01 challenge (which works because we control the zone), and hand back a ready-to-use connection string.

This also unlocks wildcard certificates, because DNS-01 is the only ACME challenge type that supports them. The panel will offer to issue *.acme-proxies.com in one certificate instead of per-subdomain, cutting cert-management overhead to nothing. Renewals are handled automatically — see Let's Encrypt auto-renewal for how that works.

Routing traffic through delegated subdomains

With the zone delegated, each tunnel subdomain resolves to our edge servers running the data plane. Client connections arrive at the edge and are forwarded to the correct paired Android device (or upstream provider) based on the token embedded in the proxy credentials. You can still use all the standard connection options — SOCKS5 or HTTP/HTTPS, per-client IP whitelisting, domain restrictions, quota limits, and sticky sessions via the -session-XXXX username suffix — regardless of which subdomain the client connects through.

For teams running geo-distributed fleets, check choosing the right edge server to understand how edge placement affects latency for your end-users.

Reverting to CNAME or a different provider

Delegating a zone does not lock you in. If you ever want to move DNS management back to Cloudflare, Route 53 or your registrar's default nameservers, simply update the NS records at the registrar and wait for propagation. The only irreversible part is the propagation window itself — plan the switch during low-traffic hours and export any panel-managed records before pointing away.

There is no penalty for changing your mind in either direction, and Nodetonet billing is prepaid credit — no contract to terminate, no subscription to cancel.

What's next

CNAME-only custom domains — the lighter, single-subdomain alternative.
Wildcard SSL certificates — only possible on delegated zones.
Let's Encrypt auto-renewal — how certs stay current with zero attention.
Set up a rotating mobile proxy from scratch — full end-to-end guide once your domain is live.

Ready to delegate? Create a free account and add your first domain under the Domains section of the panel, or browse the features overview to see everything Nodetonet manages for you.