Alibaba Cloud DNS:Inbound endpoint

Overview

An inbound endpoint is the nameserver address for a private zone. You can configure it as the DNS service address for cloud-based clients, such as Elastic Compute Service (ECS) instances or containers. You can also configure it as the target IP address for external clients, such as on-premises hosts or external DNS servers, to access the private zone. There are two types of inbound endpoints: system-assigned and custom. The default system-assigned private zone addresses are 100.100.2.136 and 100.100.2.138. These addresses use anycast to provide DNS resolution services for all VPCs in all regions free of charge.

Available regions

This feature is available in the following regions:

• Public cloud regions: South Korea (Seoul), Singapore, China (Hong Kong), China (Shanghai), China (Beijing), China (Hangzhou), China (Ulanqab), China (Shenzhen), Philippines (Manila), US (Virginia), Malaysia (Kuala Lumpur), Germany (Frankfurt), Indonesia (Jakarta), and Japan (Tokyo).

• Finance Cloud regions: China (Hangzhou), China (Beijing), and China (Shanghai).

Limits

Usage rules

The usage rules for inbound endpoints vary depending on the source of DNS query traffic:

Internal DNS query traffic (from ECS instances and containers)

External DNS query traffic (traffic entering through an inbound VPC)

Create an inbound endpoint

1. Go to Alibaba Cloud DNS - Private DNS.

2. On the Inbound Endpoint tab, click Create Inbound Endpoint. In the Create Inbound Endpoint dialog box, set the Edition, Endpoint Name, Inbound VPC, Security Group, and Inbound Service IP Address.

• Edition: The edition of the inbound endpoint. The only option is Standard Edition.

• Endpoint Name: A custom name for the endpoint.

• Inbound VPC: The VPC that routes all inbound DNS query traffic.

  Important

  • You cannot change the inbound VPC after an inbound endpoint is created. This prevents accidental traffic interruptions.

  • For more information about the regions where this feature is available, see the "Available regions" section. We are collecting feedback to prioritize the release in other regions. To request this feature in a specific region, you can submit a ticket and specify the region.

• Security Group: The rules in the security group control inbound traffic to the VPC. For more information, see Create a security group.

  Important

  • In the security group of the inbound VPC, allow inbound traffic on port 53 from the source CIDR block for DNS queries.

  • If inbound traffic originates from other VPCs within Alibaba Cloud, allow outbound traffic on port 53 in the security groups of those VPCs.

• Inbound Service IP Address: The IP addresses for the service. Select available IP addresses from the vSwitch in the selected zone. Do not use IP addresses that are already assigned to other resources, such as ECS instances. To ensure high availability (HA), add at least two service IP addresses and distribute them across different zones. An inbound endpoint supports a maximum of six service IP addresses.

  Important

  • You cannot add or modify a service IP address if it is the same as the target IP address of a forwarding rule and the outbound endpoint for that rule is in the same VPC as the inbound endpoint. This restriction does not apply if the endpoints are in different VPCs. If a resolution loop occurs because VPCs are connected through CEN, a SERVFAIL error is returned.

  • If you do not specify IP addresses, the system automatically assigns them.

4. Click OK to create the inbound endpoint.

5. The inbound endpoint list displays the newly created endpoint and any existing endpoints. The status of an inbound endpoint can be Normal, Creating, Creation Failed, Modifying, Modification Failed, or Abnormal.

   Important

   • Creating an inbound endpoint takes 5 to 10 minutes. If the status is Creating, wait for the process to complete.

   • You cannot modify or delete endpoints with a status of Creating or Modifying. If an endpoint's status is Abnormal or Modification Failed, submit a ticket to request an investigation.

Modify an inbound endpoint

1. Alibaba Cloud DNS - Private DNS

2. On the Inbound Endpoint tab, find the endpoint that you want to modify and click Modify in the Actions column.

3. In the Modify Inbound Endpoint dialog box, you can modify the Endpoint Name and Inbound Service IP Address.

4. After you click OK, the endpoint status changes to Modifying. While the endpoint is in this state, you cannot perform Modify or Delete operations.

Delete an inbound endpoint