Edge Security Acceleration:Website connection FAQ

Alibaba Cloud ESA uses a website (root domain + all subdomains) as the management unit. Key benefits:

1. Centralized management and simplified operations

   ESA uses a "website" as the management unit, containing a root domain and all its subdomains with their configurations. Unlike traditional providers that require adding subdomains individually, ESA lets you manage all root domains from a single page.

2. Configure once, apply to all subdomains

   Within an ESA website, configuration changes such as DNS records, cache settings, or security rules automatically apply to all subdomains. This eliminates per-subdomain configuration and ensures uniform performance and security policies.

3. Efficient DNS management

   ESA lets you configure and manage DNS records directly within the website, eliminating the need to switch between platforms.

4. Enhanced security

   Connecting a root domain such as example.com centralizes security management. ESA provides DDoS protection and a Web Application Firewall (WAF), and these settings apply to all subdomains automatically.

5. Improved website performance

   ESA routes requests through its globally distributed network to the nearest point of presence (POP), reducing load times. All subdomains within the website benefit from this acceleration automatically.

6. Easy monitoring and analysis

   ESA provides real-time monitoring of access data, traffic, and performance metrics, helping you identify bottlenecks or security threats quickly.

We recommend connecting your website to ESA using a root domain (such as example.com) to manage DNS records, caching, and security from a single location.

ESA does not support changing a website's domain name after it is added. If you entered the domain name incorrectly (for example, by adding an extra www prefix), delete the current website and add it again with the correct domain name:

1. On the Websites page, find the target website and click Delete to remove the current website.

2. Deleting a website does not affect your purchased plans. The plan is automatically unbound from the website.

3. Click Add Website and enter the correct domain name.

4. In the plan selection step, switch to the Purchased Plans tab and select the previously unbound plan.

ESA allocates ESA points of presence (POPs) based on the service region you select. In most cases, you should choose a region based on the distribution of your users. For example, if your users are distributed worldwide, select the Global region. If your users are located only in the Chinese mainland, select the Chinese Mainland region.

• Global: ESA provides global acceleration and protection for your website by assigning secure acceleration POPs from around the world. This region requires your website's domain to have an ICP filing for the Chinese mainland.

• Chinese Mainland: ESA uses secure acceleration POPs located only in the Chinese mainland to accelerate and protect your services within the region. This is suitable when your online services cater only to users in the Chinese mainland. This region requires your website's domain to have an ICP filing for the Chinese mainland.

• Global (Excluding the Chinese Mainland): ESA assigns global secure acceleration POPs outside the Chinese mainland. This region does not require an ICP filing.

When you connect a website, you can select one of the following three acceleration regions: Global, Global (Excluding the Chinese Mainland), and Chinese Mainland. After the website is connected, you can switch the acceleration region if your business scope changes.

ESA Free Edition does not support the Country/Region match condition in WAF custom rules. To use this match condition, upgrade to Basic Edition or higher.

As an alternative, you can switch the acceleration region to Chinese Mainland. After the switch, ESA deploys acceleration nodes only in the Chinese mainland, and requests from outside the Chinese mainland do not pass through ESA nodes. This blocks access from outside the Chinese mainland.

To select Chinese Mainland, make sure that your domain name has completed ICP filing. For the switching procedure, see the "Switch acceleration region" section in this topic.

If you used the NS setup and want to pause proxy acceleration for the entire website without disabling it per record on the DNS > Records page, enable DNS Passthrough Mode. This does not affect your configurations on the DNS > Records page.

ESA allows a website to be active in only one account at a time.

In large enterprises, multiple accounts might add the same domain, causing service disruptions when different accounts activate the website sequentially. Use the Site Hold feature to prevent other accounts from adding your website and its subdomains.

1. In the ESA console, select Websites, and in the Website column, click the target site.

2. On the website details page, click Overview in the left-side navigation pane.

3. On the Overview page, in the Quick Actions section, click the switch to enable Site Hold.

A DNS record import may fail for the following reasons:

• The new record conflicts with an existing record with the same name. DNS record conflict rules.

• The file contains invalid characters. Use the file template provided on the page to fill in the DNS records.

• The number of records to import in a single batch exceeds 100. You can import a maximum of 100 records at a time.

When you use Alibaba Cloud OSS as the origin server for ESA, traffic from OSS to ESA is automatically discounted compared with standard public data transfer from OSS. Alibaba Cloud OSS data transfer fees.

With the NS setup, you delegate DNS resolution to ESA by changing your nameservers. Once the change takes effect, records at your original DNS provider become invalid. Replicate all necessary DNS records in ESA before modifying nameservers to prevent service interruptions.

To test the service online before switching to ESA, you can test different records:

1. For DNS-only records, you can run the dig command for your record and specify the nameserver assigned by ESA. This retrieves the DNS resolution from the specified ESA nameserver. Then, check that the resolved record value matches the one you configured in ESA. Example command: dig <DNS_only_record> @<ESA_assigned_NS>.

   You can obtain the nameserver assigned to you by ESA from the Overview page in the console.

2. You cannot pre-test proxied records.

You can submit a ticket to obtain the IP address of a test point of presence (POP). Then, modify your local hosts file to force the accelerated domain, such as api.example.com, to point to the IP address of the test POP for verification.