Alibaba Cloud DNS:Access policies

Geo-based access policy

Configuration parameters

1. Policy name

   Enter a descriptive name for the access policy.

2. Resolution request source

   Determines which users the policy applies to. Select a region to route requests from that region to the configured address pool collection, or select Global to apply the policy to all users.

   Rules:

   • A single access policy must use Global as its resolution request source.

   • With multiple access policies, one must use Global as its resolution request source. Otherwise, users in some regions cannot access your application.

   • A source region selected in one access policy is grayed out in others.

     • An exception is when the primary address pool collection contains separate address pools for IPv4 and IPv6.

       • For example, if a Global policy uses IPv4, you can create another Global policy only if it uses IPv6.

   • Multiple access policies must use a consistent resolution request source method: either ISP lines or region lines, not both.

   • Currently, the CNAME access domain can only be a custom access domain. The resolution request source must match the resolution line mode of the access domain. For example, if the resolution line mode is ISP line, the resolution request source must be an ISP line or Global.

     Note

     Granular line-based routing requires GTM Ultimate Edition and an Alibaba Cloud DNS instance of Enterprise Standard Edition or higher.

3. Primary and secondary address pool collections

   The primary address pool collection serves traffic by default. If it becomes unavailable, GTM fails over to the secondary collection based on the switching policy.

   Address pool type: Supported types include IPv4, IPv6, and domain name.

   Select address pool: Select from your existing address pools.

   Add new address pool: Navigate to the Address Pool Configuration page to create an address pool.

   Load balancing policy: Supported policies: Return all addresses and Return addresses by weight. The access policy setting takes precedence over the address pool setting. The effective policy is determined as follows:

   Address pool policy	Access policy	Final policy
   Return all addresses	Return all addresses	Return all addresses
   Return addresses by weight	Return addresses by weight	Return addresses by weight. Final address weight = Address weight in the address pool × Address pool weight in the access policy
   Return all addresses	Return addresses by weight	Return addresses by weight. Final address weight = Address pool weight in the access policy
   Return addresses by weight	Return all addresses	Return all addresses

   Minimum number of available addresses: The minimum healthy addresses required for a collection to remain available. Below this threshold, the collection becomes unavailable.

4. Effective address pool collection switching policy

   Two modes are available: Automatic Mode and Manual Mode.

   Note

   Automatic Mode: Automatically switches between primary and secondary collections based on availability. If both are available, the primary collection is used.

   • If both collections are unavailable, the one with more healthy addresses is used.

   • If both are unavailable with the same number of healthy addresses (non-zero), the primary collection is used.

   • If both are unavailable and have zero healthy addresses, the behavior is as follows:

     (1) If the resolution request source is a specific line (not Global) and both collections fail, traffic falls back to the Global access policy.

     (2) If the resolution request source is Global and both collections fail, all addresses from the primary collection are returned.

   Mode	Condition	Primary address pool collection	Secondary address pool collection
   Manual Mode	Manually set to Primary	✅ (Returns addresses from the primary collection based on its load balancing policy)
   	Manually set to Secondary		✅ (Returns addresses from the secondary collection based on its load balancing policy)
   Automatic Mode	Primary collection is configured; Secondary is not.	✅ (Returns addresses from the primary collection based on its load balancing policy)
   	Both collections are configured; Primary is available.	✅ (Returns addresses from the primary collection based on its load balancing policy)
   	Both collections are configured; Primary is unavailable, but Secondary is available.		✅ (Returns addresses from the secondary collection based on its load balancing policy)
   	Both collections are unavailable; Primary has more healthy addresses than Secondary.	✅ (Returns all addresses from the primary collection, including unhealthy ones) Important For a latency-based access policy, unhealthy addresses are not returned.
   	Both collections are unavailable; Primary has fewer healthy addresses than Secondary.		✅ (Returns all addresses from the secondary collection, including unhealthy ones) Important For a latency-based access policy, unhealthy addresses are not returned.
   	Both collections are unavailable; Primary and Secondary have the same number of healthy addresses.	✅ (Returns all addresses from the primary collection, including unhealthy ones) Important For a latency-based access policy, unhealthy addresses are not returned.

Procedure

1. Go to the Global Traffic Management page in the Alibaba Cloud DNS console.

2. Click the target instance ID to open the Basic Configuration page. In the Access Policy Type section, select Geo-based Access Policy, and then click Configure.

3. On the access policy page, click Add Access Policy and configure Policy name, Resolution request source, Primary address pool collection, and Secondary address pool collection.

   Note

   If Select Address Pool is empty, click Add Address Pool to go to the Address Pool Configuration tab and click Add Address Pool.

   Set Policy name to Global and Resolution request source to Global. Available sources include Global, ISP, Chinese mainland, regions outside the Chinese mainland, and Alibaba Cloud regions. Use either ISP lines or region lines consistently. Sources already used in other policies are unavailable.

   In the Primary address pool collection section, set Address pool type to IPv4. In the Select address pool list, select an existing address pool, for example, test1. Set Load balancing policy to Return all addresses and set Minimum number of available addresses to 1.

   In the Secondary address pool collection section, set Address pool type to IPv4. In the Select address pool list, select the target address pool, for example, test2. Set Load balancing policy to Return all addresses and set Minimum number of available addresses to 1.

Latency-based access policy

Configuration parameters

1. Policy name

   Enter a descriptive name for the access policy.

2. Primary and secondary address pool collections

   The primary address pool collection serves traffic by default. If it becomes unavailable, GTM fails over to the secondary collection based on the switching policy.

   Address pool type: Supported types include IPv4, IPv6, and domain name.

   Select address pool: Select from your existing address pools.

   Add new address pool: Navigate to the Address Pool Configuration page to create one.

   Address pool type: A latency-based access policy currently supports the following address pool types: IPv4, IPv6, and domain name.

   Minimum number of available addresses: The minimum healthy addresses required for a collection to remain available. Below this threshold, the collection becomes unavailable.​

   Maximum number of returned addresses:

   • Defaults to 1. GTM returns the single address with the lowest access latency.

   • Set to 2-8 to return multiple addresses with the lowest access latency.

     Latency Resolution Scheduling Optimization:

   • Available only when the maximum number of returned addresses is greater than 1.

   • When enabled, GTM intelligently selects and returns optimal addresses up to the specified maximum.

Procedure

1. Go to the Global Traffic Management page in the Alibaba Cloud DNS console.

2. Click the target instance ID to open the Basic Configuration page. In the Access Policy Type section, select Latency-based Access Policy, and then click Configure.

3. On the access policy page, click Add Access Policy. The primary/secondary address pool collections configuration is similar to geo-based policies. Example: Set Policy name to Global, Address pool type to IPv4, and select South China from the Select address pool list. Set Minimum number of available addresses to 1 and Maximum number of returned addresses to 1. A value of 1 returns the single lowest-latency address; 2-8 returns multiple addresses. Latency Resolution Scheduling Optimization is available only when Maximum number of returned addresses exceeds 1. For this example, keep it disabled.

   Important

   Only one latency-based access policy is allowed per address pool type. For example, after creating a policy for IPv4 pools, you cannot create a second one for IPv4.