All Products
Search

This Product

    Alibaba Cloud DNS:Enable cross-environment DNS resolution for hybrid clouds

    Document Center

    Alibaba Cloud DNS:Enable cross-environment DNS resolution for hybrid clouds

    Last Updated:Jun 08, 2026

    When your on-premises and cloud networks are connected through VPN or Express Connect, you can use Private Zone to enable bidirectional DNS resolution between on-premises data centers and the cloud, or across multi-cloud environments.

    Prerequisites

    Your on-premises network is connected to an Alibaba Cloud VPC through a VPN or Express Connect circuit (IPsec-VPN connections).

    Solution architecture

    image

    Expected outcomes

    • DNS queries for app.example.com from an ECS instance in a VPC reach the on-premises DNS server through an outbound endpoint.

    • DNS queries for test.oss-cn-hangzhou-internal.aliyuncs.com from on-premises or external cloud devices are forwarded by the local DNS server to Private Zone through an inbound endpoint.

      Note

      test.oss-cn-hangzhou-internal.aliyuncs.com is an internal OSS endpoint used as an example. Replace it with the actual internal endpoint of your Alibaba Cloud service.

    Procedure

    Scenario 1: Cloud to on-premises resolution

    1. Create outbound endpoints 192.168.100.74 and 192.168.192.219 (Forwarding Management). Verify that both endpoints appear in the Outbound Endpoints list with Outbound Traffic Source IP Address set to the values above and status Normal.

    2. Create a forwarding rule with the domain name set to example.com. Specify your on-premises DNS server IP addresses — in this example, 192.168.100.100 and 192.168.100.200.

      Important

      If example.com is already configured as a Private Zone, you must enable the recursive resolution proxy for subdomains.

    3. Associate the forwarding rule with the VPC that contains your ECS instance (Set the scope for a rule).

    4. On an ECS instance in your VPC, run dig app.example.com to verify the configuration.

    Scenario 2: On-premises to cloud resolution

    1. Use the service address feature of Private Zone to add an inbound endpoint. In this example, the service IP addresses for inbound traffic are 192.168.0.176 and 192.168.100.163.

      Warning

      Ensure that you associate the Private Zone for oss-cn-hangzhou-internal.aliyuncs.com with the inbound VPC. Otherwise, DNS resolution will fail.

      Important

      • Inbound endpoints let you create custom DNS resolver IP addresses within a VPC. Use them when your on-premises CIDR blocks conflict with the default Alibaba Cloud DNS server addresses (100.100.2.136 and 100.100.2.138), or when you need to scope DNS resolution to a specific VPC.

      • If no IP address conflict exists, use the default Alibaba Cloud DNS server addresses directly.

    2. On your on-premises DNS server, add a forwarding rule to forward queries for oss-cn-hangzhou-internal.aliyuncs.com to the inbound endpoint service IP addresses. In Recursive Resolution Service, add a forwarding rule with these settings: Associated Resolution Cluster: your Hybrid DNS cluster; Forwarding Policy: Forward Only; Request Source: Global Default; Destination Server List: the inbound endpoint service IP addresses.

    3. On a device in your on-premises network, run dig test.oss-cn-hangzhou-internal.aliyuncs.com to verify the resolution.