DNS Longest Match Rule for Root Domain & Subdomain Resolution - Alibaba Cloud DNS - Alibaba Cloud - Alibaba Cloud DNS

When DNS records for a domain name such as www.api.test.com are configured in both the root domain test.com and the subdomain api.test.com, the longest zone match rule determines which record takes effect.

Effective Rules

If a root domain and a subdomain have the same effective scope, DNS resolution requests follow the longest domain (zone) match rule. If the longest domain (zone) is hit, the DNS record in that domain (zone) is used. If no corresponding DNS record is configured in the longest domain (zone), the system returns NXDOMAIN. If subdomain recursion is enabled, the system continues to query based on forwarding and public network recursion rules.

Important

When the longest domain (zone) is hit, the system does not query the DNS records of the parent domain, even if no corresponding DNS record is configured in the hit domain (zone).
The longest domain (zone) match rule applies only to domains within the same logical module, such as Authoritative Zone or the forwarding module. If the domains (zones) are in different logical modules, they are resolved based on resolution priority rules. For more information, see Resolution rule priorities.

Scenario 1: Both the root domain and subdomain have a matching DNS record

Scenario

In Authoritative Zone, you add the root domain test.com and the subdomain api.test.com. You also add the following DNS records and associate both domains with the same VPC.

Add a DNS record for test.com. The Hostname is www.api, the Record Type is A , the Resolution Line is Default, and the Record Value is 192.168.100.100.
Add a DNS record for api.test.com. Set Hostname to www, Record Type to A, Resolution Line to Default, and Record Value to 192.168.200.200.

Validation

On an ECS instance in the associated VPC, run dig www.api.test.com. The following output is returned:

[root@iZm5edhllqvfr02faxxxxxxxx ~]# dig www.api.test.com

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.16 <<>> www.api.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63641
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1436
;; QUESTION SECTION:
;www.api.test.com.		IN	A

;; ANSWER SECTION:
www.api.test.com.	60	IN	A	192.168.200.200

;; Query time: 0 msec
;; SERVER: 100.100.2.136#53(100.100.2.136)
;; WHEN: Tue Jul 23 17:36:07 CST 2024
;; MSG SIZE  rcvd: 61

Note

The response returns the DNS record from the api.test.com subdomain. This result is consistent with the longest domain match rule.

Scenario 2: The subdomain has no matching DNS record but the root domain does

Scenario

In Authoritative Zone, you add the root domain test.com and the subdomain api.test.com. You also add the following DNS records and associate both domains with the same VPC.

Add a DNS record for test.com. Set Hostname to www.api, Record Type to A , Resolution Line to Default, and Record Value to 192.168.10.10.
Add a DNS record for api.test.com with a Hostname of abc, a Record Type of A , a Resolution Line of Default, and a Record Value of 192.168.20.20.

Validation

On an ECS instance in the associated VPC, run dig www.api.test.com. The following output is returned:

[root@iZm5edhllqvfr02faxxx ~]# dig www.api.test.com

; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.el7_9.16 <<>> www.api.test.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 7139
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1436
;; QUESTION SECTION:
;www.api.test.com.		IN	A

;; AUTHORITY SECTION:
api.test.com.		20	IN	SOA	ns00.alidns.com. hostmaster.hichina.com. 2024072316 3600 1200 86400 20

;; Query time: 0 msec
;; SERVER: 100.100.2.136#53(100.100.2.136)
;; WHEN: Tue Jul 23 17:54:22 CST 2024
;; MSG SIZE  rcvd: 118

Note

The DNS resolution request hits the subdomain. However, because no corresponding DNS record is configured in the subdomain, the system does not query the records of the parent domain and returns NXDOMAIN.