IBM NS1 Connect

Publishing a Webflow site to a custom domain depends on DNS records held wherever your domain is answered. Webflow runs the hosting, the SSL certificates, and the CDN, but authoritative DNS stays outside Webflow. Teams with strict uptime targets, compliance obligations, or a lot of automation want real control over that layer. IBM NS1 Connect, the managed DNS platform formerly sold as NS1, covers it.

With NS1 Connect as your authoritative provider, your domain resolves from a global anycast network: the same IP address is announced from many locations, so a query is answered at the nearest one. Standard A and CNAME records send visitors on to Webflow's hosting. Around those records you get per-record traffic steering through Filter Chains, a REST API, DNSSEC online signing, and a Terraform provider for the domain sitting in front of your site.

DevOps and SRE teams accountable for uptime run this setup, as do web ops engineers maintaining records across many zones. Agencies use it to operate dozens of Webflow client domains from a single account. In regulated industries, NS1 Connect also supports multi-provider DNS alongside services such as Amazon Route 53, with an account activity log behind every change.

How to integrate NS1 with Webflow

What is NS1? NS1, now sold as IBM NS1 Connect, is a managed DNS platform with a real-time traffic control plane. Its anycast network answers from 26 points of presence across six continents. Traffic steering runs on Filter Chains, ordered rules that decide which answer a given query receives. The platform also carries DNS observability reports, a REST API, and a Terraform provider.

Teams reach for this pairing when a Webflow-hosted site sits behind a domain with enterprise DNS requirements. Everything happens at the DNS layer: there is no Marketplace app and no pre-built connector between the two products. NS1 Connect answers queries for your domain and points browsers at Webflow's servers. Only the records you add change, so your existing MX records keep mail flowing to your current mail provider.

Two approaches work here. Manual DNS configuration in the NS1 Connect portal points your domain at Webflow hosting without writing code. The Webflow and NS1 Connect APIs give you control over record automation, monitoring, and publish workflows, at the cost of server-side development. Most setups start in the portal and add the API layer once automation across many zones justifies the build.

Configure your domain in the NS1 Connect portal

This path uses the NS1 Connect web interface and Site settings in Webflow, with no code involved. You need a paid Webflow Site plan to connect a custom domain, plus an NS1 Connect account with a zone for your domain. NS1 Connect sells Essentials, Standard, and Premium subscriptions and offers a free trial from the portal login page. On the Webflow side, the manual domain guide is the reference for the records themselves. The steps below create the zone, delegate it at your registrar, add the records, and publish the site.

Create a zone and delegate your nameservers

The zone holds the A, CNAME, and TXT entries Webflow needs, along with every other record for your domain. Delegating at your registrar is what tells resolvers to ask NS1 Connect for those records. Get registrar access before you start, because the delegation change happens there and not in NS1 Connect.

To create a primary zone and delegate it:

1. In NS1 Connect, go to DNS > Zones and click Add zone.
2. Enter your domain's fully qualified domain name, select at least one DNS network, then save.
3. Open the zone and read the nameservers assigned to it from its NS record.
4. At your domain registrar, update the nameserver delegation to match.

NS1 Connect assigns nameservers from pools that follow the dns[1-4].p[01-10].nsone.net pattern, and two zones in the same account can land on different pools, so read the NS record rather than copying a generic list. Nothing changes on the Webflow side, since Webflow hosting accepts external authoritative nameservers.

Add Webflow's DNS records

Get your site's exact record values before you touch NS1 Connect. Open Site settings > Publishing > Production, click Add a custom domain, and choose Manually add domain. The A record IP and the www CNAME target are the same for every Webflow site; only the _webflow TXT value is unique to yours. Sites created before April 21, 2025 may still show two legacy A records and need migrating to the current values.

To add each record in NS1 Connect:

1. Go to DNS > Zones, open your zone, and click Add record in the Records tab.
2. Create an A record with the name left blank, which is the zone apex, and the answer 198.202.211.1.
3. Create a CNAME record with the name www and the answer cdn.webflow.com.
4. Create a TXT record with the name _webflow and your site's value, which begins with one-time-verification=.
5. Click Save record after each entry.

CNAME records cannot sit at the zone apex, which is why the root domain takes an A record. Remove any other A record on the root, because it will compete with Webflow's. NS1 Connect defaults every record to a 3,600 second TTL and caps it at 86,400 seconds, so a value above that is silently reduced.

Verify the domain and publish

Verification reads the _webflow TXT record you just created in NS1 Connect. SSL provisioning starts once the domain verifies, and publishing then pushes the site out to every connected domain.

To verify and go live:

1. Back in Site settings > Publishing > Production, click Check status to confirm the records resolve.
2. Click Verify domain and wait for the "Custom domain verified" message.
3. Set www as the default domain, because making the root the default without matching DNS can cause redirect loops.
4. Click Publish, check your target domains, and click Publish to selected domains.

DNS changes can take up to 48 hours to propagate everywhere, though they usually settle within a few hours. SSL certificates are issued with no setup and renew for as long as the records keep pointing at Webflow. One date matters here: since January 13, 2026, a domain still pointing at the retired values 75.2.70.75, 99.83.190.102, or proxy-ssl.webflow.com cannot publish. Those values are dead rather than an alternative set, and the DNS migration guide covers the swap.

Build with the Webflow and NS1 Connect APIs

Programmatic control over both sides means server-side development against two REST APIs. This path suits agencies and ops teams automating records across many zones. Some wire availability alerts into incident tooling; others keep DNS as code beside a Webflow deploy pipeline. NS1 Connect authenticates requests with an X-NSONE-Key header over HTTPS, and the first API key has to be created in the portal. Webflow's Data API uses bearer tokens, either site tokens for internal tools or OAuth for public apps.

Programmatic setup rests on these documented endpoints and event interfaces:

• NS1 Connect API: The API Hub reference documents zone and record CRUD, monitoring jobs, data feeds, and account activity.
• NS1 base URLs: Legacy calls sit under https://api.nsone.net/v1, while newer categories such as /alerting/v1 and /apikeys/v1 follow a {category}/v1 pattern.
• Webflow site endpoints: The Data API handles custom domains, site publishing, and CMS collection items.
• Webflow webhooks: Registered webhooks push real-time events such as site_publish to an endpoint you control, using a token from a Data Client App.

One trap sits on the NS1 side: the legacy /v1 API inverts the usual REST semantics, so PUT creates a resource and POST updates one.

Create Webflow's DNS records via the API

The NS1 record endpoint pattern is /v1/zones/{zone}/{domain}/{type}, and a single NS1 record can carry multiple answers.

To point a zone at Webflow programmatically:

1. Create the apex A record with a PUT against the zone's own name.
2. Create the www CNAME the same way, answering cdn.webflow.com.
3. List the site's connected domains with GET https://api.webflow.com/v2/sites/{site_id}/custom_domains to get each domain ID.
4. Send POST https://api.webflow.com/v2/sites/{site_id}/publish with a customDomains array of those IDs in the request body.

The two record calls look like this:

curl -X PUT -H "X-NSONE-Key: $NSONE_API_KEY" \
  https://api.nsone.net/v1/zones/example.com/example.com/A \
  -d '{"answers": [{"answer": ["198.202.211.1"]}]}'

curl -X PUT -H "X-NSONE-Key: $NSONE_API_KEY" \
  https://api.nsone.net/v1/zones/example.com/www.example.com/CNAME \
  -d '{"answers": [{"answer": ["cdn.webflow.com"]}]}'

The publish call needs either customDomains or publishToWebflowSubdomain in the body, returns HTTP 202 on success, and is rate limited to one successful publish per minute.

React to Webflow events with webhooks

Outbound webhooks fire on publish and CMS events, so a middleware endpoint can receive one and call NS1 Connect in response. Supported trigger types include site_publish, collection_item_created, collection_item_changed, collection_item_published, and page_created.

To wire a publish event to a DNS update:

1. Register a webhook with POST https://api.webflow.com/v2/sites/{site_id}/webhooks and a body like { "triggerType": "site_publish", "url": "https://your-middleware.example.com/handler" }.
2. In your handler, read siteId, publishedOn, and the domains array from the event payload.
3. Call the matching NS1 Connect record endpoint to update records as needed.

The reverse direction is narrower. NS1 Connect sends outbound notifications only on monitoring alert conditions, not on DNS record or zone changes, so any NS1-to-Webflow sync needs an intermediary polling the activity log at GET /v1/account/activity.

Monitor your Webflow domain with NS1 alerts

NS1 monitoring jobs check endpoints over PING, TCP, HTTP or HTTPS, and DNS, and they raise an alert when a check fails. Point a job at your custom domain and you get availability alerts on the domain itself rather than on the origin behind it.

To route those alerts into your incident tooling:

1. Create a monitoring job of the HTTP or HTTPS type targeting your Webflow-hosted domain.
2. Create a notifier list, choose the Webhook type, and enter your webhook URL and any headers.
3. Attach the notifier list to the monitoring job.

Notifier lists also cover email, Slack, and PagerDuty destinations, so the same job can page a human and call a service. The whole arrangement works as code through the ns1_notifylist resource, and the NS1 Terraform toolkit manages zones and records for DNS as code alongside your Webflow deploys.

What you can build with the NS1 and Webflow integration

Integrating NS1 with Webflow puts managed, API-driven DNS in front of your Webflow-hosted domains while Webflow keeps the hosting, so nobody on your team runs a nameserver.

• High-availability marketing sites: A SaaS company's Webflow-hosted marketing and docs pages keep resolving during volumetric DNS DDoS attacks, because the domain answers from NS1's anycast network.
• Multi-client DNS operations: An agency runs zones for dozens of Webflow client sites from one NS1 account, provisioning the A, CNAME, and TXT records at each launch with Terraform instead of by hand.
• DNSSEC-protected domains: A financial services team turns on DNSSEC online signing for its primary zone, so resolvers can validate the answers that point at its Webflow site.
• DNS traffic observability: An ecommerce team uses the DNS Insights add-on to spot malicious probing and misconfigured TTLs on its storefront domain before either one costs it traffic.

Governance lands on the same records: NS1 API keys carry scoped permissions and every change is attributed in the account activity log, which matters once several people can repoint a live domain. Once DNS is settled, the same Data API can drive the site itself, so apply custom code to pages programmatically.