Bridge CDN

Bridge DNS · part of Bridge CDN

Authoritative DNS. Answered at the edge. Privacy by proxy.

Bridge DNS is the DNS layer of Bridge CDN: authoritative nameservers that answer from the edge, with DNSSEC signing available per zone and your record changes live within seconds.

Bring your zone to Bridge Hide your origin

Authoritative nameservers · Edge-instant record updates · Optional DNSSEC

Instant DNS

Instant DNS at the edge

Proxied A and AAAA records take effect at the edge the moment you save — the proxied answer itself doesn't change, so there is nothing stale for resolvers to hold. Every other record follows the TTL you set.

Save, and the edge is already answering.

Changes to proxied records apply at Bridge CDN's authoritative edge within seconds. Every other record ships with a default TTL — 3600 seconds, customizable per record — so public resolvers refresh on a predictable schedule.

  1. You edit a record

    you

    Change an address, add a TXT record, or drop a TTL from the Bridge CDN dashboard.

  2. The edge serves it in seconds

    seconds

    Authoritative nameservers pick up the change and answer with the new value within seconds.

  3. Resolvers refresh on their own clock

    per-record TTL

    Public resolvers keep the old value until each record's TTL runs out. Set a short TTL before a planned change so they come back sooner.

Zone management

Everything a zone needs

A Bridge DNS zone supports eleven record types with a TTL you set per record, and Bridge DNS maintains its zone-apex SOA and NS records for you.

  • Authoritative management

    Bridge DNS runs the authoritative nameservers for your zone. Answers come from the source of record, not a cache in front of someone else's DNS.

  • Premium record types

    Eleven types — A, AAAA, CNAME, MX, TXT, NS, CAA, SRV, HTTPS, SVCB, and TLSA. HTTPS, SVCB, TLSA, and CAA are editable by hand on every plan, and Bridge DNS can also manage HTTPS and SVCB records for you automatically.

  • Per-record TTL

    3600 seconds by default, adjustable per record at any time. The new value applies from the next resolver query.

  • The apex, handled

    Bridge DNS creates and maintains the zone-apex SOA and NS records as part of the zone. You never hand-edit them.

  • Nameservers across three TLDs

    Your delegation is spread over ns1.bb-ns.com, ns1.bb-ns.net, and ns1.bb-ns.org — three top-level domains behind your nameservers, not one.

  • Sync from live DNS

    Refresh from live DNS reads your name's public answers and proposes a diff. Nothing changes unless you apply it.

DNSSEC

DNSSEC when you want it.

Enable DNSSEC per zone and Bridge DNS signs it automatically with no manual key management. Modern elliptic-curve keys and NSEC3 per RFC 9276 handle the signing; you control the switch.

To complete the chain of trust, your registrar must support DNSSEC delegation. Once enabled there, resolvers can validate every answer your zone gives.

Origin controls

Proxy on your terms.

Flip the bridge switch on an A or AAAA record and the Bridge CDN edge steps in front of your origin. The DNS table is where you control exactly how the edge reaches it — port, protocol, TLS, and the Host header it sends.

shop.example.com

2 records Proxied
Name Type Value TTL Proxied
shop.example.com A 203.0.113.10 3600
shop.example.com AAAA 2001:db8::10 3600

$ dig +short shop.example.com

198.51.100.7Bridge CDN edge

Your origin 203.0.113.10 never appears in public DNS.

Working demo — a preview of the real Bridge CDN DNS interface. Flip the switches and edit the fields.

Force HTTPS to origin Fetch from your origin over HTTPS.
Any port from 1 to 65535.
Verify origin certificate Reject invalid origin TLS certificates.
Sent to your origin instead of the record name. Leave blank to use shop.example.com.

edge → https://203.0.113.10:8443 · Host: shop.internal.example

Applies to all A/AAAA records for shop.example.com.

Custom ports · Host header

Many names, one origin server

The Bridge CDN edge terminates TLS for every proxied name, then opens its own connection to the port you choose and sends the Host header you choose. With certificate verification off, one origin can serve many names without holding a certificate or an SNI virtual host for each of them.

  • Any origin port from 1 to 65535, over HTTP or HTTPS — separate ports per scheme.
  • A different Host header per name, so your origin knows exactly which site is being asked for.
  • The edge terminates TLS for every name — with verification off, your server needs no per-site certificates or SNI virtual hosts.

  • Route to any port

    Origins don't have to listen on 80 and 443. Point a proxied name at any port from 1 to 65535, with separate HTTP and HTTPS ports, and the edge connects there.

  • Proxy per record

    Every A and AAAA record has its own bridge switch. Route one name through the Bridge CDN edge while its siblings answer direct — and flip it back any time.

  • Your origin IP stays private

    Proxied names resolve to Bridge CDN edge addresses, not your server. Your origin's real IP stays out of public DNS, and the edge connects to the address you set, not one it looks up publicly.

  • Send the Host header you need

    Multi-tenant platforms and PaaS origins often expect a specific Host. Override it per name — the edge sends your value and, with certificate verification on, validates the origin's TLS certificate against that same name.

  • HTTPS, handled

    Certificates are issued automatically — apex and wildcard, via ACME DNS-01 against Bridge DNS itself — and Force HTTPS keeps the fetch to your origin on TLS. Bridge DNS can also publish and maintain your HTTPS and SVCB hint records; CAA automation is on the roadmap.

  • Secure by design

    DNSSEC signing is available per zone. The resolver edge minimizes ANY responses per RFC 8482, drops query floods automatically, and truncates client subnets for privacy — and there is no public DNS API to attack.

Bring your zone

Two ways in

Bring an existing zone into Bridge DNS during domain onboarding — connect Cloudflare, or import from any other provider.

Coming from Cloudflare

OAuth

Already on Cloudflare? Authorize via OAuth and your zone imports in one click.

  1. Authorize with Cloudflare

    Grant Bridge DNS access to your Cloudflare account.

  2. Pick the zone

    Bridge DNS pulls A, AAAA, CNAME, MX, TXT, NS, and SRV records into your DNS table, along with page rules, workers, and other settings.

  3. Review and save

    Records land editable; adjust anything — or add records by hand — before you delegate.

Coming from anywhere else

Scan or zone file

Switch from any DNS service — scan your public DNS or paste a zone file.

  1. Scan public DNS, or paste a zone file

    Bridge DNS reads your domain's current records from public resolvers and proposes a zone — or parses a standard zone file you paste.

  2. Review the proposed zone

    Everything is editable before anything is saved, and you can add records by hand.

  3. Save, then delegate your nameservers

    Records first, nameservers after.

Records first, nameservers after — both flows run during domain onboarding.

The whole edge

DNS that carries the whole stack

One delegation enables the rest of Bridge CDN. The same zone that answers your DNS queries routes proxied traffic through the CDN edge and proves domain control for automatic certificates, including wildcards via ACME DNS-01. Prerendering is on by default, so Bridge CDN's crawler and AI-agent delivery step in front of your origin too. DNS, TLS, caching, and bot delivery — each ready behind the same delegation, enabled per record and per domain.

See everything Bridge CDN includes

Cloudflare alternative

Compared to Cloudflare DNS

This table compares feature availability, not benchmarks — no performance or pricing claims, just what each DNS layer includes.

Capability Bridge DNS Cloudflare
Authoritative DNS Included Every plan
DNSSEC Per-zone opt-in One-click opt-in
Record types 11 types, incl. HTTPS, SVCB, TLSA Standard types
Per-record TTL 3600s default, customizable Varies by plan
Zone import Cloudflare OAuth, DNS scan, zone file Scan or BIND file upload
Origin port control Any port, 1–65535 Limited proxied port set
Per-record proxy toggle Every A and AAAA record Per record
Host header override Included, per name Via Origin Rules

Questions

What to know before you switch

Can I move my existing DNS records to Bridge DNS?

Yes. During onboarding, import your zone with Cloudflare OAuth, a public DNS scan, or a pasted zone file — your records are in place before your nameservers move. You can also enter records manually from the dashboard.

Will my site go down when I switch nameservers?

No. Import your records first, so Bridge DNS holds the same zone your current provider serves, then change nameservers — resolvers move over gradually while both sides keep answering. Delegation stays reversible: point your nameservers back whenever you want (turn off DNSSEC delegation at your registrar first if you enabled it).

How long does a nameserver switch take?

That depends on your registrar and TLD, not Bridge DNS: resolvers pick up new nameservers as their cached delegation expires. From the first query Bridge DNS receives, it answers with the records you imported, and later changes go live at the authoritative edge within seconds.

How long do DNS changes take to propagate?

Changes are live at the Bridge DNS authoritative edge within seconds. Public resolvers pick up the new value when each record's TTL expires, so lower a TTL ahead of a planned change to shorten the window.

Do I have to set up DNSSEC myself?

No. Enable DNSSEC for your zone in Bridge DNS and it signs automatically. To complete the chain of trust, your registrar must support DNSSEC delegation.

What TTL do records use?

3600 seconds by default. You can set a custom TTL per record at any time; the new value applies from the next resolver query.

Does Bridge DNS route answers by visitor location?

No. Bridge DNS returns the same authoritative record set to every resolver. There is no GeoDNS and no latency-based routing.

Does Bridge DNS hide my origin server's IP address?

Yes, for proxied records. Proxied names resolve to Bridge CDN edge addresses, so your origin's IP stays out of public DNS. Records with the proxy switched off answer with the address you set.

How do I get Bridge DNS?

Bridge DNS is included with Bridge CDN. Create an account at bridge-cdn.com, add your domain, and delegate your nameservers — DNS, certificates, and the CDN edge come with the same delegation.

One delegation, the whole edge.

Point your nameservers at Bridge CDN once. DNS, certificates, caching, and bot delivery are ready behind the same delegation.

Create your account See everything Bridge CDN includes

Bridge DNS is included with Bridge CDN.