ESA website connection FAQ - NS, CNAME, DNS, service regions - Edge Security Acceleration

Common questions about connecting websites to ESA, including NS and CNAME setup, service regions, DNS records, and troubleshooting.

Benefits of website connection

Alibaba Cloud ESA uses a website (root domain + all subdomains) as the management unit. Key benefits:

Centralized management and simplified operations
ESA uses a "website" as the management unit, containing a root domain and all its subdomains with their configurations. Unlike traditional providers that require adding subdomains individually, ESA lets you manage all root domains from a single page.
Configure once, apply to all subdomains
Within an ESA website, configuration changes such as DNS records, cache settings, or security rules automatically apply to all subdomains. This eliminates per-subdomain configuration and ensures uniform performance and security policies.
Efficient DNS management
ESA lets you configure and manage DNS records directly within the website, eliminating the need to switch between platforms.
Enhanced security
Connecting a root domain such as example.com centralizes security management. ESA provides DDoS protection and a Web Application Firewall (WAF), and these settings apply to all subdomains automatically.
Improved website performance
ESA routes requests through its globally distributed network to the nearest point of presence (POP), reducing load times. All subdomains within the website benefit from this acceleration automatically.
Easy monitoring and analysis
ESA provides real-time monitoring of access data, traffic, and performance metrics, helping you identify bottlenecks or security threats quickly.

We recommend connecting your website to ESA using a root domain (such as example.com) to manage DNS records, caching, and security from a single location.

Add a subdomain as a website

Note

The Entrance plan does not support adding a subdomain as a website. To use this feature, upgrade to a different plan.

Follow the Quick start guide to add api.example.com as a website to ESA using the NS setup.
After the website is added, go to the Overview page. ESA assigns two NS record values. You must add these two NS records at your domain's DNS provider.
Add two NS records at your domain's DNS provider. The following steps use Alibaba Cloud DNS as an example to show how to add NS records. The configuration process is similar for other DNS providers.
1. Log on to the Alibaba Cloud DNS console.
2. On the Public Zone page, find the root domain example.com and click Settings in the right-side column.
3. Click Add Record, set Record Type to NS, set Hostname to api, and set Record Value to the NS record value assigned by ESA in Step 2. Keep the default values for other parameters.
4. Click OK to complete the process.
After you add the NS records at your DNS provider, return to the ESA console, go to the Overview page, and click Verify Nameserver. Once verified, you can connect the subdomain api.example.com to ESA as a website.

NS and CNAME differences

Service region differences

ESA allocates ESA points of presence (POPs) based on the service region you select. In most cases, you should choose a region based on the distribution of your users. For example, if your users are distributed worldwide, select the Global region. If your users are located only in the Chinese mainland, select the Chinese Mainland region.

Global: ESA provides global acceleration and protection for your website by assigning secure acceleration POPs from around the world. This region requires your website's domain to have an ICP filing for the Chinese mainland.
Chinese Mainland: ESA uses secure acceleration POPs located only in the Chinese mainland to accelerate and protect your services within the region. This is suitable when your online services cater only to users in the Chinese mainland. This region requires your website's domain to have an ICP filing for the Chinese mainland.
Global (Excluding the Chinese Mainland): ESA assigns global secure acceleration POPs outside the Chinese mainland. This region does not require an ICP filing.

Switch acceleration region

When you connect a website, you can select one of the following three acceleration regions: Global, Global (Excluding the Chinese Mainland), and Chinese Mainland. After the website is connected, you can switch the acceleration region if your business scope changes.

In the ESA console, select Websites, and in the Website column, click the target site.
On the website details page, click Overview in the left-side navigation pane.
On the Overview page, in the Basic Information section, click Change.
On the acceleration region selection page, select the region to which you want to switch and click Change to complete the process.

Pause proxy acceleration

If you used the NS setup and want to pause proxy acceleration for the entire website without disabling it per record on the DNS > Records page, enable DNS Passthrough Mode. This does not affect your configurations on the DNS > Records page.

In the ESA console, select Websites, and in the Website column, click the target site.
On the website details page, click Overview in the left-side navigation pane.
On the Overview page, in the Site Actions section, click the switch to enable DNS Passthrough.
In the confirmation dialog box that appears, click OK.

Warning

When DNS Passthrough Mode is enabled, all traffic goes directly to your origin server, bypassing proxy acceleration. This action exposes your origin server's address. Proceed with caution.

Prevent cross-account additions

ESA allows a website to be active in only one account at a time.

In large enterprises, multiple accounts might add the same domain, causing service disruptions when different accounts activate the website sequentially. Use the Site Hold feature to prevent other accounts from adding your website and its subdomains.

Note

This feature is available only with the Enterprise plan.

In the ESA console, select Websites, and in the Website column, click the target site.
On the website details page, click Overview in the left-side navigation pane.
On the Overview page, in the Quick Actions section, click the switch to enable Site Hold.

DNS record import failures

A DNS record import may fail for the following reasons:

The new record conflicts with an existing record with the same name. DNS record conflict rules.
The file contains invalid characters. Use the file template provided on the page to fill in the DNS records.
The number of records to import in a single batch exceeds 100. You can import a maximum of 100 records at a time.

If the issue persists after you check for the preceding causes, you can submit a ticket for support.

Benefits of using OSS

When you use Alibaba Cloud OSS as the origin server for ESA, traffic from OSS to ESA is automatically discounted compared with standard public data transfer from OSS. Alibaba Cloud OSS data transfer fees.

Reasons for DNS pre-configuration

With the NS setup, you delegate DNS resolution to ESA by changing your nameservers. Once the change takes effect, records at your original DNS provider become invalid. Replicate all necessary DNS records in ESA before modifying nameservers to prevent service interruptions.

Pre-verification for NS setup

To test the service online before switching to ESA, you can test different records:

For DNS-only records, you can run the dig command for your record and specify the nameserver assigned by ESA. This retrieves the DNS resolution from the specified ESA nameserver. Then, check that the resolved record value matches the one you configured in ESA. Example command: dig <DNS_only_record> @<ESA_assigned_NS>. Example:
You can obtain the nameserver assigned to you by ESA from the Overview page in the console.
You cannot pre-test proxied records.

Pre-verification for CNAME setup

You can submit a ticket to obtain the IP address of a test point of presence (POP). Then, modify your local hosts file to force the accelerated domain, such as api.example.com, to point to the IP address of the test POP for verification.

Root vs. subdomain precedence

A website is connected for the root domain example.com, and a record for a.b.example.com is added to the website's records. The hostname is a.b.
A website is connected for the subdomain b.example.com, and a record for a.b.example.com is added to the website's records. The hostname is a.

If both of the preceding situations occur and both websites are active, when a client accesses a.b.example.com, ESA applies the configuration of the second website (b.example.com). This means the subdomain website's configuration takes precedence.

Acceleration type differences

In the business scenario configuration of a DNS record, ESA offers three business scenarios: Web, API, and Image/Video. If your selection does not perfectly match the business scenario, basic access functions are not affected. However, an accurate match improves resource scheduling and performance. Select the scenario that best fits your workload so ESA can assign optimal security and acceleration policies. You can adjust the business type at any time.

ESAWhat should I do if adding a website fails the review?

Cause

All domains added to ESA must undergo content moderation. If your domain fails to be added to ESA, it may be because your domain does not comply with ESA's connection rules. For more information about the standards and limits for adding domains to ESA, see Limitations.

Solution

On the Websites page, confirm that the domain's Status is Review Failed. Click Review Failed to view the reason for the failure.
Select the domain that failed the review, click the icon, and select Delete.
Based on the reason for the review failure, adjust your website content and add the domain again for review.

References

For information about how to add a domain, follow Add a website.

Domain name resolution

What is domain name resolution?
Cloud servers are assigned IP addresses, but domains like example.aliyundoc.com are easier to remember. Domain name resolution maps a domain to its server's IP address, allowing users to access your website through that domain.
Alibaba Cloud DNS is a secure, scalable authoritative DNS service that converts domains into IP addresses, routing users to the appropriate servers. Alibaba Cloud DNS.
Why is domain name resolution necessary?
Domain name resolution is required for external users to access your website. After purchasing a server, deploying your site, registering a domain, and completing ICP filing, configure DNS resolution as the final step.
How do I perform domain name resolution?
Most domain registrars in the Chinese mainland have their own DNS servers.

A record

When you configure domain resolution, you must select a record type.

An A record, also known as an IP pointer, records the IP address that corresponds to a domain. In the following figure, the hostname is a domain prefix, such as www or mail, and the record value is the IP address of your website server.

To point multiple domains to the same server, configure each subdomain (second-level and third-level domains) to resolve to that server.

If you change servers, you must update all domain records individually. Using a CNAME record simplifies this process.

CNAME record

A CNAME record, also known as an alias record, resolves a domain to another domain. It is commonly used for mail resolution and Edge Security Acceleration.

For ESA acceleration, configuring a CNAME is critical. After enabling ESA and adding a domain, Alibaba Cloud ESA assigns a CNAME address. Point your domain to this address to forward requests to ESA POPs. Configure a CNAME record.

The domain to which a CNAME points must also ultimately point to an A record.

A record vs. CNAME record

An A record resolves a domain to an IP address, while a CNAME record resolves a domain to another domain.

For long-term hosting, use a CNAME record. It enables ESA acceleration and hides your origin IP address to reduce attack risk.

Principle of CNAME in ESA acceleration

ESA's main feature is caching origin server content on the POP closest to visitors for faster access. The How it works topic explains CNAME in ESA acceleration.

Handle DNS record conflicts

Conflict between CNAME and A records

You must first delete the A record and then configure the CNAME record. Deleting the A record does not affect website access because after you configure the CNAME record, client requests are sent to ESA, and then ESA accesses the origin server.

Conflict between CNAME and MX records

You can resolve the conflict between CNAME and MX records by using a URL forwarding record. Note that both the source and destination domains for the URL forwarding must have an ICP filing.

The DNS record configuration is as follows:

Type	Hostname	Resolution line	Value	TTL
URL	@	Default	example.com	10 minutes
MX	@	Default	demo.aliyundoc.com	10 minutes