Alibaba Cloud DNS:Troubleshooting inaccurate intelligent DNS resolution

1. Check the egress IP of the local DNS

Alibaba Cloud DNS performs intelligent DNS resolution based on the egress IP of the client's local DNS, not the client's own IP address.

• Contact your network administrator to obtain the detailed DNS egress IPs.

• Run the following command several times to obtain the IP address: dig +short TXT whoami.ds.akahelp.net (for Linux) or nslookup -q=txt whoami.ds.akahelp.net (for Windows).

$ dig +short TXT whoami.ds.akahelp.net ok at 11:20:47# Command for Linux.
"ns" "123.126.xx.xx" # ns is the egress IP of the local DNS, which can be an IPv4 or IPv6 address.
"ecs" "120.52.xx.xx/32/24" # ecs (EDNS-client-subnet) is the client subnet included in the query request.
"ip" "123.126.xx.xx" # ip is the client's representative IP address selected by the authoritative name server from ecs. The local DNS does not carry the actual client IP to protect user privacy.

Windows command output

C:\Users\xxx>nslookup -q=txt whoami.ds.akahelp.net
Server:  Unknown
Address:  172.20.10.1
Non-authoritative answer:
whoami.ds.akahelp.net   text =
        "ns"
        "197.234.xxx.29"
whoami.ds.akahelp.net   text =
        "ip"
        "197.239.xxx.163"
whoami.ds.akahelp.net   text =
        "ecs"
        "197.239.xxx.xxx/24/24"

Linux command output

[root@iZbp1igkb78js3gsxxx ~]# dig +short TXT whoami.ds.akahelp.net
"ns" "2404:6800:4005:c08::xxx"
"ecs" "112.124.xxx.0/24/24"
"ip" "112.124.xxx.5"

After obtaining the local DNS egress IP, run dig <domain_name> @vip4.alidns.com +subnet=<local_DNS_egress_IP> and verify that the result is correct.

2. DNS records on a custom line do not take effect

A custom line defines an IP address range for the request source. You must specify the egress IP range of the clients' local DNS, not the clients' own IP addresses. Otherwise, the custom line will not match, and Alibaba Cloud DNS will return the DNS record for the default line.

3. How default line CNAME caching causes inaccurate routing

Use case

1. A CNAME record is configured on the default line.

2. You configure a non-CNAME DNS record (such as an A, AAAA, TXT, or MX record) on a non-default line.

Cause analysis

When a request is made for a DNS record on a non-default line:

1. If the requested record type is A, but the corresponding line has an AAAA record and no A record, the system returns an empty response. This does not cause inaccurate routing.

2. If the requested record type is AAAA, but the corresponding line has an A record and no AAAA record, the system returns an empty response. This does not cause inaccurate routing.

3. If the requested record type is A, but the corresponding line has no A or AAAA records (only records like TXT or MX), the system returns the default line's CNAME record. The local DNS then caches this record, leading to inaccurate routing.

4. If the requested record type is AAAA, but the corresponding line has no A or AAAA records (only records like TXT or MX), the system returns the default line's CNAME record. The local DNS then caches this record, leading to inaccurate routing.

5. If the request is for a record type like MX or TXT, and no record of that type is configured on the corresponding line, the system returns the default line's CNAME record, which the local DNS then caches. Because CNAME records have the highest priority, subsequent A or AAAA queries (even if they are configured on the non-default line) will mistakenly resolve to the cached CNAME record until its TTL expires. This causes inaccurate routing.

Solution

To fix this, use an intermediate CNAME record for the A and AAAA records on the non-default line. For example, for the domain dns-example.top, first, create A and AAAA records for test.dns-example.top that point to your IPv4 and IPv6 addresses. Then, for your service domain on the China Mobile line, create a CNAME record that points to test.dns-example.top.

Before the change:

After the change:

Both the default and non-default lines now use CNAME records, which share the same priority. When a client requests a record type (such as MX or TXT) that is not configured on a line, the system returns an empty response instead of the default CNAME. This prevents cache pollution.