BLAZINGFAST — WEBSITE PROTECTION
Reviewed: 5 October 2026. Setup: 00-index.txt.
Production release: SDK/CLI 0.1.17; contract 2026-10-07.1. Check GET /v1/version and GET /v1/capabilities before using optional workflow features. Strict response validation is enforced.

PURPOSE
HTTP/HTTPS proxying and mitigation for eligible DNS A records, with per-host
country access policy and supported HTTPS/origin/loading-page settings.
Proxy routing and mitigation are separate switches. Use the actual entitlement,
not a price or eligibility guess. External origins are supported for owned zones.

PUBLIC API
GET/POST /v1/dns/zones/{name}/records/protection: inspect/toggle record mitigation.
GET/PUT /v1/dns/zones/{name}/country-policy: saved per-record country policy.
GET /v1/services/{serviceId}/dns/waf: service protection eligibility/state.
Service-scoped record endpoints expose proxy, protection, origin sync and safe
config. Proxy-config endpoints support settings and SSL/custom loading pages.
Website country modes are off, allow, deny; ISO two-letter countries.
Permissions: dns.read / dns.write; service and zone ownership remain enforced.

CLI
bf dns protection show example.com --record @
bf dns country-policy show example.com --record @
bf service dns waf status SERVICE_UUID
After reviewing reduced protection:
bf dns protection set example.com --record @ --enabled off --request-key waf-change-001 --confirm
Use bf service dns waf record --help for service-scoped settings.

MCP
Hosted: get_dns_record_protection, request_dns_record_protection,
get_website_country_policy, request_website_country_policy, get_website_config,
get_website_protection, get_website_record, request_website_proxy/protection,
request_website_https_origin/force_https/origin_sync.
For external origins, prefer zone-scoped record-protection tools, not a guessed
hosting service ID. Hosted tools deliberately omit private keys/custom HTML.
Local MCP has no dedicated Website Protection tools; use CLI/SDK/API.

LIMITS AND SAFETY
Mitigation off keeps proxy routing, origin addresses, DNS values and TTL unchanged.
Proxy off publishes origin routing directly and has different security implications.
Country changes can block visitors/management. Review allow rules before replacing.
Saved configuration is not proof every edge has synchronized it. Inspect saved,
synchronized and unknown-state fields; never report a synchronization failure as
an automatic rollback. Statistics shown in the dashboard are not an advertised
customer statistics endpoint in this API. Do not send certificate private keys to AI.