How to modify DNS settings for a domain - Web Application Firewall

After you add a domain to Web Application Firewall (WAF), you must modify the domain's DNS record to point to the CNAME address that WAF provides. This routes web traffic from your website to WAF for protection. This topic describes how to modify the DNS settings for your domain.

Background information

You can use only a CNAME record to map a protected domain name to WAF.

If failures such as node failures or data center failures occur, WAF uses a different IP address or forwards requests to the origin server to ensure service continuity and provides high availability and disaster recovery capabilities.

Warning

WAF does not support A records.

By default, WAF enables the virtual IP address (VIP) isolation mechanism for domain names that are added to WAF to improve system stability and security. WAF assigns a VIP to your domain name. If you add an A record to map your domain name to the VIP, service interruptions may occur when the VIP is changed, such as when you enable or disable an exclusive IP address or intelligent load balancing.
If you use an A record, the DNS resolution status of the domain name is abnormal. You must delete the A record and add a CNAME record to map your domain name to the CNAME that is assigned by WAF.

This topic applies to scenarios where you use WAF as a standalone service to protect your website. If your website also uses other proxy services such as CDN or Anti-DDoS Pro/Anti-DDoS Premium, see the following documentation:

Prerequisites

You have manually added the website that you want to protect to WAF in CNAME record mode. For more information, see Add a domain.
You have permissions to modify the DNS records in the system of your DNS service provider.
Requests from back-to-origin CIDR blocks of WAF are allowed on the origin server.
If you use third-party security software or specific access control policies for your origin server, you must add the back-to-origin CIDR blocks of WAF to the whitelist. This way, normal requests are not blocked. For more information, see Allow access from the back-to-origin CIDR blocks of WAF.
The forwarding configurations of your website are correct and in effect.
Before you modify the DNS record, you must verify that the website forwarding configurations are correct to prevent service interruptions that are caused by invalid configurations. For more information, see Local verification.
Warning
If you modify the DNS record before the forwarding configurations take effect, service interruptions may occur.

Obtain the WAF CNAME address

Before you modify your DNS record, you must obtain the WAF CNAME address for your domain. If you already have this address, you can skip these steps.

Log on to the Web Application Firewall console.
In the left navigation pane, choose Asset Center > Website Access.
In the Domain Names list, find the domain that you added. Hover over the domain to view and copy its WAF CNAME address. The list includes the Domain/CNAME, access mode, and origin information columns. Click the copy icon next to the domain to copy the WAF CNAME address.

Use Alibaba Cloud DNS to modify the DNS record

If you use Alibaba Cloud DNS, perform the following steps to modify the DNS record. If you use a third-party DNS service, refer to the following steps to modify the DNS record in the system of your DNS service provider:

Log on to the Alibaba Cloud DNS console.
On the Authoritative DNS Resolution page, find the domain name whose DNS record you want to modify and click DNS Settings in the Actions column.
On the DNS Settings page, find the hostname that you want to manage and click Modify in the Actions column.
In the following example, aliyun.com is used:
- www: matches domain names that start with www, such as www.aliyun.com.
- @: matches the root domain name, such as aliyun.com.
- *: matches wildcard domain names, including all subdomains such as blog.aliyun.com and www.aliyun.com.
In the Modify DNS Record panel, set the Record Type parameter to CNAME and the Record Value parameter to the CNAME that is assigned by WAF. Retain the other parameter settings.

When you modify a DNS record, take note of the following items:
- We recommend that you set the time-to-live (TTL) to 10 minutes. A larger TTL value specifies a longer period of time to synchronize and update DNS records.
- Different types of DNS records conflict with each other.
  - You can specify only one CNAME value for each DNS record. Set the Value parameter to the CNAME that is assigned by WAF.
  - Different types of DNS records conflict with each other. For example, you cannot add a CNAME record and an A, MX, or TXT record for a hostname at the same time. If you cannot change the record type, delete all conflicting DNS records and add a new CNAME record.
    
    Warning
    You must delete all conflicting DNS records and add a CNAME record at the earliest opportunity. Otherwise, your domain name becomes inaccessible.
Click OK and wait for the new DNS record to take effect.
Verify the DNS record. You can ping the domain name of your website or use a DNS detection tool to check whether the DNS record takes effect.

Note
The DNS record does not immediately take effect. If the verification fails, verify the DNS record again after 10 minutes.

Related operations

Enable origin server protection
Origin server protection prevents attackers from bypassing WAF and directly attacking your server's IP address if they discover it. Configure a security group for your origin ECS instance or a whitelist for your origin SLB instance to block direct attacks. For more information, see Set up origin server protection.
Retrieve originating IP addresses
After connecting your website to WAF, your origin server receives all requests from WAF. You can retrieve the originating IP address of a client from the X-Forwarded-For request header. For more information, see Retrieve originating IP addresses.