Expedited declares what DNS should be: an A record for www and for the root pointing at the firewall, and no AAAA records at the root ("remove": true with value "*"). The widget derives each step from that entry's own lookups: if www is still a CNAME (to Heroku), it shows "Delete the CNAME record" above "Add an A record"; if the root already holds another A, that row reads "Change the A record" with the current address.

A TXT add whose value starts v=spf1 is an SPF policy: a name holds one, so if an SPF record already exists the row reads "Change the TXT record" with the current policy, and other TXT records are left alone. The verification token is any other TXT, so it reads "Add a TXT record" and sits beside whatever is there. The DKIM key is a CNAME to the sender's selector; a TXT or MX entry at a name that is a CNAME (DKIM, _acme-challenge) is checked through it, and if the target lacks the value the row explains that the CNAME is in the way instead of asking to delete it.

A CNAME at @ is a root alias: DNSimple shows "Add an ALIAS record". Existing root A or AAAA records that aren't the target's addresses get generated "Delete the A record" rows, which show the record to find with no Copy buttons; the blank root name reads "blank (wafdemo.com)". Pick Route 53 in the provider list to see the fallback address row instead.

A name of * (or *.wafdemo.com) is the zone's wildcard record, so every subdomain without its own record reaches the firewall. The host field shows *.

Waiting for events…