Alibaba Cloud DNS:Add DNS records

Domain name resolution maps a domain name to a website server. This allows users to access a service on an IP address with an easy-to-remember domain name. For more information, see Add a DNS record.

Alibaba Cloud DNS supports the following record types:

For more information, see Add a DNS record.

This is not supported. Common DNS record types, such as A, AAAA, and CNAME, only resolve domain names to IP addresses and do not involve ports. This means that a domain name such as api.example.com can only be resolved to an IP address such as 1.1.x.x. When you access a service, you must specify the port in the URL (http://api.example.com:8080/). If you do not want the port number to be displayed in the URL, you can hide the port by using a self-managed Nginx reverse proxy to forward HTTPS requests and hide the port.

Use URL forwarding as a workaround

The URL forwarding feature can redirect a domain request to another URL, which can be in the format of domain:port. This method acts as a reverse proxy but is not covered by a Service Level Agreement (SLA). For production environments, we recommend setting up a reverse proxy with Nginx to forward HTTPS requests and hide the port.

Scenario: You have a domain name cloud-example.com, a service IP address of 1.1.x.x, and a service port of 8888. A DNS record has been configured, and the service can be accessed at http://demo.cloud-example.com:8888. If no DNS record is configured, the service can be accessed only at http://1.1.x.x:8888.

Expected result: Access the service at http://www.cloud-example.com without a port number in the URL.

Solution:

1. If the service can be accessed only by using http://1.1.x.x:8888, you must first configure a DNS record. For detailed steps, see A record.

   Record type	A
   Host	demo.cloud-example.com
   Record value	1.1.x.x

   After the resolution takes effect, you can access the service at http://demo.cloud-example.com:8888.

2. Add an Implicit URL Forwarding record. For detailed steps, see URL forwarding.

   Record type	Implicit URL Forwarding
   Host	www.cloud-example.com
   Record value	http://demo.cloud-example.com:8888 Note Q: Why not use http://1.1.x.x:8888 as the record value? A: URL forwarding does not support a URL that contains an IP address as the record value.

   You can now use http://www.cloud-example.com to access the service at http://demo.cloud-example.com:8888.

Alibaba Cloud DNS provides domain name resolution, which points your domain name to a server's IP address. It does not provide website building services. If you need to build a website, see Build a website on an ECS instance.

Your domain registrar and DNS service provider can be different. Even if your domain is registered with another registrar, you can still use Alibaba Cloud DNS to manage your DNS records.

Scenario 1: Domain with no existing DNS configuration

If your domain is registered with another provider and has no DNS records configured:

1. Log on to the Alibaba Cloud DNS console, add your domain and configure its DNS records. For details, see Add Zone and Add a DNS record.

2. Go to the Publiz Zone page. Click Settings in the Actions column. Check the NS address assigned by the system.

3. Log on to your domain registrar's management console and change the domain's NS address to Alibaba Cloud DNS servers.

4. Wait for the DNS change to take effect globally (typically 24 to 48 hours).

Scenario 2: Migrating from another DNS provider

If your domain's DNS is currently managed by another provider and you want to migrate to Alibaba Cloud DNS, refer to Migrate domain resolution to Alibaba Cloud DNS.

If your domain's DNS servers (NS records) do not point to Alibaba Cloud, you must configure your DNS records with your current DNS provider. Records configured in the Alibaba Cloud DNS console take effect only after you point your domain's name servers to Alibaba Cloud.

First, determine your goal:

1. To redirect users from Domain A to Domain B, use URL forwarding.

2. To make Domain A an alias for Domain B, where both domains show the same content, use a CNAME record.

To add a CNAME or URL forwarding record, see Add a DNS record.

• Host: The host is the prefix that you add to a domain name to create a subdomain. (To add a DNS record for the root domain, set the host to "@".) For example, if the root domain is example.com and you want visitors to access www.example.com, set the host to www.

• Record value: The value associated with the host. The meaning of the record value depends on the record type. The following list provides examples for common record types:

  • A record: The record value is an IPv4 address, such as 192.0.2.0.

  • AAAA record: The record value is an IPv6 address, for example 2001:db8::.

  • CNAME record: The record value is a domain name, such as www.example.com.

  • MX record: The record value is the domain name of a mail server, for example, mail.example.com, and typically also includes a priority value, for example, 10 mail.example.com.

  • NS record: The record value is the domain name of an authoritative DNS server, such as ns1.example.com.

  For more record types, see Add a DNS record.

The record value depends on your resolution target. Common scenarios are as follows:

If you cannot obtain the record value, contact your service provider or refer to its official documentation.

Yes. When a domain name resolves to multiple IP addresses, you can use weighted round-robin to assign different weights to each IP address. This distributes traffic proportionally among the servers. You can use this feature to perform A/B testing by sending a small fraction of traffic to a server with a new software version. For instructions, see Configure weights.

Yes. Alibaba Cloud DNS uses a global anycast network of DNS servers to respond to user queries from the server that is geographically closest to them. This provides users with lower query latency and allows DNS record changes to propagate in seconds.

DDNS, or Dynamic Domain Name System, is a service that updates a fixed domain name to point to a dynamically changing public IP address. This allows external users to access your home or office network devices at any time. Alibaba Cloud DNS does not currently support DDNS.

If your IP address does not change frequently, you can manually update the record value of the A record to the latest public IP address. Alternatively, you can use the following method to achieve a similar result to DDNS:

Use the DNS API for automatic updates

To automatically update the A record's value, you can use a router or third-party client that supports DDNS to call the Alibaba Cloud DNS API. To use this solution, create a RAM user, grant it the required API permissions, and then create an AccessKey for the RAM user. Finally, configure the AccessKey and the target domain name in the DDNS client.

The default Time to Live (TTL) for all DNS record types in Alibaba Cloud DNS is 10 minutes (600 seconds). You can change the TTL, but the minimum allowed value depends on your Alibaba Cloud DNS edition:

• Free Edition/Personal Edition: The minimum TTL is 10 minutes (600 seconds).

• Ultimate Edition: The minimum TTL is 1 second.

To change the TTL, see Configure TTL.

Alibaba Cloud DNS does not limit the number of hosted root domains. The following limits apply to DNS records:

• You can add a maximum of 100,000 DNS records for a single root domain, including all records for its subdomains.

• For the same host or subdomain, resolution line, and record type, the Free Edition allows a maximum of 10 DNS records, while paid editions allow a maximum of 100.

• For explicit and implicit URL forwarding, the Free Edition supports 2 records, the Personal Edition supports 5 records, and the Ultimate Edition supports 10 records.

The Premium Edition can exceed these limits. For more information, see Version Comparison.

For information about wildcard DNS support and how it takes effect, see Wildcard DNS.

This error occurs when a high volume of API calls triggers global traffic throttling. We recommend using precise queries instead of wildcard queries to prevent this issue.

IPv6, which stands for Internet Protocol Version 6, is the next-generation IP protocol designed by the Internet Engineering Task Force (IETF) to replace IPv4. Because the supply of IPv4 addresses is limited, it restricts the growth and application of the Internet. IPv6 not only solves address scarcity but also removes barriers for various devices to connect to the Internet.

Alibaba Cloud DNS supports IPv6. You can add an AAAA record in your DNS settings to allow visitors to access your website using an IPv6 address. Additionally, the DNS servers in the Alibaba Cloud DNS cluster fully support IPv6.

For more information, see Add a DNS record.

Yes. You can point a subdomain to multiple IP addresses to distribute DNS query traffic across several servers and reduce server load. Alibaba Cloud DNS allows you to add multiple IP addresses for A and AAAA records. During a DNS query, Alibaba Cloud DNS returns all configured IP addresses to the user's local DNS server. The local DNS server then decides which IP address to return to the visitor. To return addresses based on weights, see Configure weights.

Yes. An ECS instance's IP address can support resolution for multiple domain names, meaning that different root domains or subdomains can all point to the same IP address. For configuration details, see:

• Configure multiple websites on an Nginx server

• Configure multiple websites on an IIS server

There are no restrictions. You can use any public or private IP address. However, in a production environment, private IP addresses are generally not useful because they are inaccessible to public users, even if the domain resolves correctly. They are typically used only for testing.

Yes. You can enter an IP address from any region in the Record Value field. Alibaba Cloud DNS does not restrict whether the server IP address is inside or outside the Chinese mainland.

A DNS query returns an IPv6 address only if the visitor's client supports the IPv6 protocol stack.

1. Example DNS record configuration:

Resolution behavior:

• If the client supports both IPv6 and IPv4 (dual-stack): The client sends two DNS queries to its local DNS server, one for the IPv6 address and one for the IPv4 address. The local DNS server then sends two queries to Alibaba Cloud DNS. Alibaba Cloud DNS returns both the IPv6 and IPv4 addresses. The client ultimately decides which address to use, but most modern systems prefer IPv6.

• If the client supports only IPv6: The client requests the IPv6 address from its local DNS server. The local DNS server queries Alibaba Cloud DNS for the IPv6 address and returns it to the client.

• If the client supports only IPv4: The client requests the IPv4 address from its local DNS server. The local DNS server queries Alibaba Cloud DNS, which returns 1.1.x.x. The client then receives the 1.1.x.x address.

2. Example DNS record configuration with different resolution lines:

• If a dual-stack client is located outside the Chinese mainland, it queries for both IPv6 and IPv4 addresses. Alibaba Cloud DNS returns both, and the client generally prefers the IPv6 address.

• If an IPv4-only client is located outside the Chinese mainland, it queries for an IPv4 address. However, because no IPv4 address is configured for the outside the Chinese mainland resolution line, the resolution request fails.

• If an IPv4-only client is located in the Chinese mainland, it queries for an IPv4 address. Alibaba Cloud DNS returns the IPv4 address from the Default resolution line, and the client receives 1.1.x.x.

• If a dual-stack client is located in the Chinese mainland, it queries for both IPv6 and IPv4 addresses. However, because only an IPv4 address is configured for the Default resolution line, Alibaba Cloud DNS can only return the IPv4 address. The client then receives 1.1.x.x.

Yes. When a domain name resolves to multiple server IP addresses, you can configure weighted round-robin to assign different weights to each IP address, which distributes traffic across the servers. To achieve simple DNS load balancing, you can set an equal 1:1 weight ratio. For setup instructions, see Configure weights.

1. Use the addDomainRecord operation to add a DNS record. By default, an A record uses a round-robin policy.

2. Use SetDNSSLBStatus - Enable or disable weight configuration, and set Open=true to enable weight configuration for A or AAAA records.

3. Obtain the RecordId of the DNS record. Call the UpdateDNSSLBWeight - Modify weight operation to modify the weight of the DNS record.

   1. If you just added the DNS record in step 1, you can obtain the RecordId directly from the return value.

   2. For an existing DNS record, you can call the Get DNS Record List operation to obtain the RecordId from the returned list.

A CNAME record is a DNS record type that maps a domain name (alias) to another target domain name. URL forwarding redirects a request for a domain name to another URL. This can be an internal redirect (implicit URL forwarding, often using an iframe) or an external redirect (explicit URL forwarding, often using a 301 or 302 redirect). The key differences are:

• A CNAME record keeps the original domain name in the browser's address bar, while explicit URL forwarding changes the URL to the target address.

• A CNAME record is suitable for permanently mapping one domain to another. URL forwarding is better for temporary redirects, website migrations, or scenarios where you want to hide the actual destination address.

An A record and a CNAME record cannot be added for the same host and resolution line. We recommend using a different host or resolution line when creating the A and CNAME records. For information about other types of record conflicts, see DNS record conflict rules.

In DNS resolution, different record types have different priorities. For the same host and resolution line, certain record types cannot coexist. This restriction prevents configuration risks that could lead to service unavailability. For more information, see DNS record conflict rules.

No. CNAME records are designed to map one domain name to another, not to a specific file path or directory.

No. The dot at the end of a domain name represents the root domain. Alibaba Cloud DNS automatically adds it in the backend, so you do not need to add it yourself.

Most large websites, including Baidu, prevent external domains from pointing to them via CNAME records for security and abuse prevention reasons. If you need to direct traffic to Baidu, we recommend using URL redirection (301 or 302) instead of a CNAME record.

Yes, you can configure multiple CNAME records. Alibaba Cloud DNS returns responses based on their assigned weights. For more information, see Configure weights.

Some Alibaba Cloud products may add a TXT record to verify domain ownership. For example, if you purchase an SSL certificate from Alibaba Cloud and select Automatic DNS Validation as the Domain Validation Method under Certificate Association Information, the system automatically adds a TXT record. For more information, see How do I select a domain authorization and verification method?

Automatic DNS Validation removes any existing duplicate or conflicting DNS records in your DNS service when it adds the validation record.

DMARC, SPF, and DKIM are three email authentication mechanisms used to prevent email spoofing and improve email deliverability. All three are configured as TXT records.

1. SPF record (Sender Policy Framework)

SPF declares which mail servers are authorized to send email on behalf of your domain.

• Hostname: @

• Record type: TXT

• Record value: Starts with v=spf1, followed by authorization mechanisms

• Example: v=spf1 include:spf.qiye.aliyun.com -all

2. DKIM record (DomainKeys Identified Mail)

DKIM adds a digital signature to outbound emails to verify that content has not been altered in transit.

• Hostname: selector._domainkey (specified by your email provider, such as default._domainkey)

• Record type: TXT

• Record value: Public key string provided by your email provider

3. DMARC record (Domain-based Message Authentication, Reporting, and Conformance)

DMARC tells receiving servers how to handle emails that fail SPF or DKIM authentication.

• Hostname: _dmarc

• Record type: TXT

• Record value: Starts with v=DMARC1, followed by policy parameters

• Example: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

• Policy options:

  • p=none: Monitor only, take no action

  • p=quarantine: Mark failed emails as suspicious (usually delivered to the spam folder)

  • p=reject: Reject emails that fail authentication

The record value is case-sensitive. Copy and paste the value directly from your service provider. If validation fails, check the record value for extra spaces or hidden characters.

1. Incomplete or incorrect record value

• Copy the TXT record value in full without any manual modifications.

• Check whether the record value contains extra spaces, hidden characters, or line breaks.

• The record value is case-sensitive. Copy and paste the value exactly as provided by the platform.

2. Incorrect host record

• Different platforms may require different host records. Fill in the host record exactly as instructed by the platform.

3. Record conflict

• If you receive a "DNS record conflict" error, a record of another type (such as CNAME) already exists for the same hostname.

• Solution: Refer to DNS record conflict rules, delete the conflicting record, or add the TXT record using a different hostname.

4. DNS cache not refreshed

• After you add a TXT record, the change can take some time to take effect globally (typically 10 minutes to 48 hours).

• If you verify immediately after adding the record, wait 10 to 30 minutes and then try again.

5. Inconsistent DNS server

• Confirm that the domain's DNS servers have been changed to Alibaba Cloud DNS (such as dns1.hichina.com or vip1.alidns.com).

• If the DNS servers are pointed to another provider, add the TXT record at the current DNS provider instead.

If you have only one MX record, its priority value is meaningless. When you have multiple MX records, sending mail servers try to deliver email to the server with the lowest priority number first. If that server is unavailable, the sending server automatically tries the next server in order of priority until the email is delivered successfully or all servers have failed.

Yes. For more information, see Configure mailbox resolution.

In DNS resolution, different record types have different priorities. For the same host and resolution line, certain record types cannot coexist. This restriction prevents configuration risks that could lead to service unavailability. For more information, see DNS record conflict rules.

The configuration process depends on your setup:

• Domain registered with Alibaba Cloud, DNS with Alibaba Cloud DNS, email with a third-party provider.

  Contact your email provider to obtain the required DNS records, then add them by following the instructions in Configure mailbox resolution.

• Domain registered with Alibaba Cloud, DNS with a third-party provider, email with a third-party provider.

  Contact your email provider to obtain the required DNS records, then add them at your current DNS provider.

• Domain registered with a third-party provider, DNS with Alibaba Cloud DNS, email with a third-party provider.

  Contact your email provider to obtain the required DNS records, then add them by following the instructions in Configure mailbox resolution.

DomainRecordConflict error: The DNS record conflicts with an existing record. Please suspend or delete the conflicting record and try again.

This error occurs because multiple DNS records of different types exist at the same level. To fix this, carefully inspect your existing DNS records, delete the conflicting ones, and then add the NS record. However, this action may affect other DNS records for the subdomain. For more information, see DNS record conflict rules.

301 redirect: A 301 status code means "Permanently Moved."

302 redirect: A 302 status code means "Temporarily Moved."

Both 301 and 302 status codes tell a browser to redirect to a new URL, which is specified in the Location header of the server's response. From a user's perspective, the address they entered (URL A) instantly changes to another address (URL B).

The main difference is how search engines treat them. A 301 redirect tells search engines that the old URL is obsolete and to replace it with the new URL in their index. A 302 redirect indicates the redirect is temporary and the old URL is still valid. Search engines will crawl the new content but keep the original URL indexed.

When you add a URL forwarding record, Alibaba Cloud DNS automatically creates an underlying A record that points to an Alibaba Cloud DNS forwarding server. Therefore, if you set a URL as the record value in the console but a dig command returns an A record with an IP address in the 203.107.XX.XX range, this is normal behavior.

• If you see a message that an ICP filing is required when adding the record, ensure that both the source and target domains have a valid ICP filing. Complete the filing process if they do not.

• If a previously working URL forwarding record starts returning a 502 error, the ICP filing may have expired or become invalid.

URL forwarding works by resolving the source domain to an Alibaba Cloud forwarding server, which then proxies the request. Because Alibaba Cloud's URL forwarding servers are deployed in the Chinese mainland, the source domain must have a valid ICP filing. The filing does not have to be completed through Alibaba Cloud.

You may see a browser console error if the target website sets the X-Frame-Options header. This setting prevents the site from being embedded in a frame. Contact your website administrator to remove the X-Frame-Options configuration from the target site.

Refused to display 'http://www.gztianhui.com/home.html' in a frame because it set 'X-Frame-Options' to 'sameorigin'.

Check the JavaScript code on the target URL's page. If it contains the following code snippet, remove it.

<script>
    if(window.top!=window.self){window.top.location=window.location};
</script>

This issue often occurs if the target page (the forwarded URL) contains JavaScript code that performs a redirect. Contact your website administrator to investigate.

If a dig command on the source domain does not return an IP address in the 203.107.XX.XX range, submit a ticket to Alibaba Cloud DNS support for assistance.

This error typically occurs during a CC attack. A high rate of queries per second (QPS) for the domain can cause the URL forwarding server to stop the service. We recommend using an alternative method for forwarding.

Symptom: No interception information is displayed in the console.

Cause: The connection is blocked by a same-origin policy. Check the network trace for the last 200 OK response in the chain. Its headers may contain a same-origin restriction.

Solution: This issue is usually caused by your website's security policy. We recommend checking your configuration or using only explicit URL forwarding.

set-cookie: SERVERID=e05f0b8d54ec48e7851015e7188bfb45|1612682415|1612681708;Path=
strict-transport-security: max-age=31536000
vary: User-Agent
x-anodeid: jira-wiki-1
x-arequestid: 920x2795968x3
x-ausername: anonymous
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

The number of URL forwarding records you can add depends on your Alibaba Cloud DNS edition:

• Free Edition: 2

• Personal Edition: 5

• Ultimate Edition: 10

• Premium Edition: Unlimited

To learn more about the differences between editions, see the URL Forwarding (Single Domain) section in Version Comparison.

The source domain for URL forwarding supports HTTP but not HTTPS. The target address can be HTTP or HTTPS. Redirecting HTTPS traffic requires installing an SSL certificate on the intermediary forwarding server. Alibaba Cloud does not support this due to security and certificate management considerations. If you want to forward HTTPS requests, configure an HTTPS redirect on your origin server. The following is an example Nginx configuration:

server {    
  listen 443 ssl;    
  server_name yourdomain.com;    
  ssl_certificate     /path/to/cert.pem;    
  ssl_certificate_key /path/to/cert.key;    
  return 301 https://targetsite.com$request_uri;
}

Explicit and implicit URL forwarding do not support configuration with path parameters.