private dns resolution for ecs instances - Elastic Compute Service

Assign private domain names to ECS instances in a VPC for IP-free access with automatic DNS record management.

Private domain names for ECS instances

A private domain name is an internal domain name assigned to an ECS instance within a VPC for identification and access. The DNS resolution service generates these domain names and resolves them to IP addresses. This feature relies on Alibaba Cloud Private DNS, with system-assigned service addresses 100.100.2.136 and 100.100.2.138.

Use cases

Hostname management: Configure IP address-based or instance ID-based hostnames to access instances by hostname within a VPC, simplifying host management.
Service instantiation in the cloud: Generate an authoritative domain name within the VPC for each cloud service and resolve it to a private IP address, enabling consistent service references instead of changing IP addresses.

Note

For more advanced DNS configurations such as forwarding or recursion, use Private DNS. For public DNS resolution, use Alibaba Cloud DNS.

Private domain name structure

A private domain name is a four-level domain separated by periods (.). Examples: i-8ps2h6dsc74cuktb****.ap-southeast-3.ecs.internal or ip-172-16-0-89.ap-southeast-3.ecs.internal. The structure consists of:

Top-level domain (.internal): The internal domain for ECS private network access.
Second-level domain (.ecs): The product identifier for ECS.
Subdomain (.[regionID]): The region ID of the instance. For example, the Malaysia (Kuala Lumpur) region ID is ap-southeast-3. See Regions and zones.
Host identifier: Identifies a specific ECS instance. Two hostname types are supported:
- IP address-based hostname: Based on the primary private IPv4 address. For example, ip-172-16-0-89 (primary private IPv4 address: 172.16.0.89).
- Instance ID-based hostname: Based on the instance ID. For example, i-8ps2h6dsc74cuktb**** (instance ID: i-8ps2h6dsc74cuktb****). Use this type for IPv6 communication.

Private DNS record types

ECS instance private domain names support four DNS record types:

Type	Description	Generated domain name	Example	Use cases
DNS resolution (A record) from an IP address-based hostname to the primary private IPv4 address	Maps the IP address-based private domain name to the primary private IPv4 address.	`ip-[primary-private-ipv4-string].[regionID].ecs.internal`	`ip-192-168-1-1.region-name.ecs.internal` resolves to `192.168.1.1`	Service access testing: The IP address is visible in the domain name, making this type suitable for testing scenarios.
DNS resolution (A record) from an instance ID-based hostname to the primary private IPv4 address	Maps the instance ID-based private domain name to the primary private IPv4 address.	`[instanceID].[regionID].ecs.internal`	`i-bp1hs9xdprd7xq4p****.region-name.ecs.internal` resolves to `192.168.XX.XX`	Automated deployment and management: IP addresses may change during operations. Instance ID-based hostnames automatically bind the latest IP address, simplifying configuration management.
DNS resolution (AAAA record) from an instance ID-based hostname to the primary private IPv6 address Note: Available only if an IPv6 address is assigned to the instance.	Maps the instance ID-based private domain name to the IPv6 address.	`[instanceID].[regionID].ecs.internal`	`i-bp1hs9xdprd7xq4p****.region-name.ecs.internal` resolves to `2408:XXXX:17:8aff:7833:3724:XXXX:XXXX`	IPv6 network connectivity: AAAA records enable IPv6-capable clients to connect using IPv6 addresses, leveraging the larger address space and improved efficiency of IPv6.
Reverse DNS resolution (PTR record) from a primary private IPv4 address to an IP address-based hostname	Maps the primary private IPv4 address to the IP address-based private domain name.	`ip-[primary-private-ipv4-string].[regionID].ecs.internal`	`192.168.0.1` resolves to `ip-192-168-0-1.cn-hangzhou.ecs.internal`	Spam filtering: Many email servers use reverse DNS to verify sender legitimacy. Without a valid reverse record, emails may be flagged as spam or rejected. Log analysis and tracking: Reverse DNS lookups convert IP addresses to domain names, simplifying source analysis in log files.

Limitations

Private domain names are system-generated. Custom domain names are not supported.
Private domain names work only within a single VPC. Cross-VPC resolution is not supported.
Private domain names resolve only to the primary private IP address of the primary network interface. Secondary private IP addresses are not supported.
Each ECS instance supports up to 5,000 DNS queries per second. Exceeding this limit may trigger throttling, and the 99.99% availability SLA is not guaranteed.

Use private domain names for communication

Step 1: Enable the DNS hostname feature

The DNS hostname feature is the primary control for private DNS resolution. Enabling it creates a built-in authoritative zone in the format [regionID].ecs.internal (for example, ap-southeast-3.ecs.internal for the Malaysia (Kuala Lumpur) region). This zone is effective only within that VPC. See Private domain names in VPCs.

Important

Private DNS resolution settings take effect only after you enable the DNS hostname feature for the VPC.

Log on to the VPC console.
In the top navigation bar, select the region of the target VPC.
On the VPC page, click the ID of the target VPC. In the Basic Information section, enable DNS hostname.

Step 2: Configure private DNS resolution

Configure DNS record mappings between private domain names and IP addresses when you create an instance or modify an existing one.

On instance creation

Note

You can also specify PrivateDnsNameOptions parameters when calling the RunInstances API operation to create instances with private DNS resolution configured.

Procedure

Go to the instance buy page.
Click the Custom Launch tab.
Configure settings such as the billing method, region, instance type, and image.
For a detailed explanation of each parameter, see Parameters.
Expand advanced settings (Optional) at the bottom of the page and configure Private DNS Records.
Select the desired domain-to-IP mappings. You can select multiple options. See Private DNS record types.
Private DNS resolution settings take effect only when DNS hostname is enabled in the VPC to which the instance belongs. Click Manage VPC to configure. Available resolution records:
- Enable DNS resolution (A record) from IP-format hostname to primary private IPv4
- Enable DNS resolution (A record) from instance ID-format hostname to primary private IPv4
- Enable DNS resolution (AAAA record) from instance ID-format hostname to primary private IPv6
- Enable reverse DNS resolution (PTR record) from primary private IPv4 to IP-format hostname

On instance modification

Note

You can also specify PrivateDnsNameOptions parameters when calling the ModifyInstanceAttribute API operation.

Procedure

Go to ECS console - Instances.
In the upper-left corner of the page, select a region and resource group.
Find the target ECS instance and click its ID. In the All Operations column, choose ... Instance Properties > Modify Instance Properties.
Select the desired domain-to-IP mappings. You can select multiple options. See Private DNS record types.
Available mapping relationships:
- Enable DNS resolution (A record) from IP-format hostname to primary private IPv4, e.g. ip-172-16-0-91.ap-southeast-3.ecs.internal resolves to 172.16.0.91
- Enable DNS resolution (A record) from instance ID-format hostname to primary private IPv4
- Enable DNS resolution (AAAA record) from instance ID-format hostname to primary private IPv6
- Enable reverse DNS resolution (PTR record) from primary private IPv4 to IP-format hostname, e.g. 172.16.0.91 resolves to ip-172-16-0-91.ap-southeast-3.ecs.internal
Click OK.

Step 3: Verify configuration

Verify private DNS resolution by running commands on the instance or another instance in the same VPC. The commands vary by operating system.

Linux instances

The host command is a Linux utility for querying DNS information, including domain-to-IP mappings and reverse lookups.

Install the host command: The sudo yum install bind-utils package is required. Install it if not present.

Query example:

Note

Replace the IP addresses and instance ID with your actual values.

Instance ID: i-8psi44j4o4yqoh2b****

Region ID: ap-southeast-3

IPv4 address: 172.16.0.89

IPv6 address: 240b:XXXX:41:b200:1ca9:f9bb:ae4:1ea0

Connect to the Linux instance. See Connect to a Linux instance by using a password or key.

Run the host command to query the enabled DNS records.

Look up the IP address for the IP address-based domain name (A record):

host ip-172-16-0-89.ap-southeast-3.ecs.internal

[root@i-xxx ~]# host ip-172-16-0-89.ap-southeast-3.ecs.internal
ip-172-16-0-89.ap-southeast-3.ecs.internal has address 172.16.0.89

Look up the IP address for the instance ID-based domain name (A record):

host i-8psi44j4o4yqoh2b****.ap-southeast-3.ecs.internal

[root@i-xxx ~]# host i-8xxx59.ap-southeast-3.ecs.internal
i-8psxxxa59.ap-southeast-3.ecs.internal has address 172.16.0.89

Look up the IPv6 address for the domain name (AAAA record):

host -t AAAA i-8psi44j4o4yqoh2b****.ap-southeast-3.ecs.internal

[root@xxx ~]# host -t AAAA i-8pxxx.ap-southeast-3.ecs.internal
i-8xxx9.ap-southeast-3.ecs.internal has IPv6 address 240b:xxx:9bb:ae4:1ea0

Perform a reverse DNS lookup (PTR record):

host 172.16.0.89

[root@i-xxx ~]# host 172.16.0.89
89.0.16.172.in-addr.arpa domain name pointer ip-172-16-0-89.ap-southeast-3.ecs.internal.

Windows instances

nslookup is a pre-installed Windows tool for querying DNS records.

Query example:

Note

Replace the IP addresses and instance ID with your actual values.

Instance ID: i-8ps2h6dsc74cfy02****

Region ID: ap-southeast-3

IPv4 address: 172.16.0.91

IPv6 address: 240b:XXXX:41:b200:1ca9:f9bb:ae4:1e9a

Connect to the Windows instance. See Connect to a Windows instance by using a password or key.

Run the appropriate nslookup command based on the enabled DNS record type.

Look up the IP address for the IP address-based domain name (A record):

nslookup ip-172-16-0-91.ap-southeast-3.ecs.internal

C:\Users\Administrator>nslookup ip-172-16-0-91.ap-southeast-3.ecs.internal
服务器:  UnKnown
Address:  100.100.2.136

非权威应答:
名称:    ip-172-16-0-91.ap-southeast-3.ecs.internal
Address:  172.16.0.91

Look up the IP address for the instance ID-based domain name (A record):

nslookup i-8ps2h6dsc74cfy02****.ap-southeast-3.ecs.internal

C:\Users\Administrator>nslookup i-8pxxx z.ap-southeast-3.ecs.internal
服务器:  UnKnown
Address:  100.100.2.136

非权威应答:
名称:    i-8psxxxthz.ap-southeast-3.ecs.internal
Addresses:  240b:xxx:41:b200:1ca9:f9bb:ae4:1e9a
          172.16.0.91

Look up the IPv6 address for the domain name (AAAA record):

nslookup -type=AAAA i-8ps2h6dsc74cfy02****.ap-southeast-3.ecs.internal

C:\Users\Administrator>nslookup -type=AAAA i-8xxx.ap-southeast-3.ecs.internal
服务器:  UnKnown
Address:  100.100.2.136

非权威应答:
名称:    i-8pxxxnz.ap-southeast-3.ecs.internal
Address:  240b:xxx:a9:f9bb:ae4:1e9a

Perform a reverse DNS lookup (PTR record):

nslookup 172.16.0.91

C:\Users\Administrator>nslookup 172.16.0.91
服务器:  UnKnown
Address:  100.100.2.136

名称:    ip-172-16-0-91.ap-southeast-3.ecs.internal
Address:  172.16.0.91

After verification, the configured instance can be accessed by other instances in the same VPC. Run ping <private domain name> to test connectivity. For example, run ping ip-172-16-0-91.ap-southeast-3.ecs.internal.

Important

To test IPv6 connectivity, assign an IPv6 address to both the source and destination instances. See IPv6 communication.

Other operations

Impact of operations

Change the VPC for an instance
If private DNS resolution is enabled for the instance, ensure that the DNS hostname feature is also enabled for the destination VPC. See Change the VPC of an ECS instance.
Change the primary private IP address of an instance
Automatic remapping: When the primary private IPv4 or IPv6 address changes (for example, when you change the primary private IPv4 address), the DNS service automatically deletes the old record and creates a new one mapping to the updated address.
Release an instance
After an instance is released, all related DNS records in the VPC's built-in authoritative zone are deleted. The instance can no longer be accessed by private domain name.

View private DNS settings

View the private DNS resolution settings of an ECS instance in the console:

Note

You can also call the DescribeInstances API operation. The PrivateDnsNameOptions parameter in the response contains the private DNS settings.

Go to ECS console - Instances.
In the upper-left corner of the page, select a region and resource group.
Find the target ECS instance and click its ID. The Private DNS Records field shows the number of configured records.
Hover over the number to view the domain-to-IP mappings.
Private domain names include ip-{IP address}.{region}.ecs.internal and {instance ID}.{region}.ecs.internal formats, corresponding to IPv4 and IPv6 addresses.

Disable private DNS resolution

To disable private DNS resolution for a specific instance, deselect the configured options in the ECS console. See Step 2: Configure private DNS resolution.

To disable private DNS resolution for all instances in a VPC, disable the DNS hostname feature. This deletes the built-in authoritative zone, and all private domain names in the VPC become invalid. See Private domain names in VPCs.

Important

If your applications use private domain names instead of IP addresses, disabling the DNS hostname feature may cause access errors.