All Products
Search
Document Center

Edge Security Acceleration:DNS FAQ

Last Updated:Oct 20, 2026

Can both the root domain and the www domain be accelerated simultaneously?

Yes, both the root domain and the www domain can be accelerated at the same time. You need to add DNS records for both domains in the ESA Console and enable proxy acceleration.

Does ESA support connection to a private network (intranet)?

No, it does not. ESA only supports public network origin-pull. When configuring the origin server, you need to provide an IP address that is accessible over the public internet, or a domain name that resolves to a public IP address.

What should I do if the CNAME resolution has not taken effect?

There are several possible reasons why the CNAME may not be resolving correctly:

  • Check whether the CNAME record value you configured matches the CNAME address obtained from the ESA Console. Any discrepancy will cause the resolution to fail.

  • After completing the CNAME configuration, the TTL of the ISP's DNS may not have been updated yet. The TTL is generally 10 minutes, but the actual duration depends on the TTL value selected when configuring the domain resolution.

  • After completing the CNAME configuration, ESA will perform a global check to verify whether the accelerated domain resolves to ESA. If certain regions have not yet resolved to ESA, an exclamation mark will be displayed. The status will only show as normal once the resolution has taken effect across the entire network.

  • You may have configured resolution routes when setting up your domain resolution, causing traffic from certain regions to bypass ESA acceleration. For example, as shown in the figure below, the resolution route for Mainland China may be configured to resolve to ESA, while the resolution route for regions outside Mainland China uses an A record pointing directly to the server. Since traffic from outside Mainland China does not resolve to ESA, the console will not display a normal resolution status for those regions. However, this will not affect your actual usage.

Effects of switching acceleration regions

Switching the acceleration region for a domain name may cause the following effects:

  • Increased origin traffic.

    For example, if you change the acceleration region from Chinese Mainland to Global, POPs are added in regions outside the Chinese mainland. Because these new POPs have no cached resources from the origin server, they must fetch resources directly from the origin, which temporarily increases origin traffic.

    Although the Level-2 POPs of ESA typically reduce origin traffic, we recommend that you monitor the load on your origin server in real time after switching the acceleration region to ensure it can handle the increased origin traffic.

  • Decreased cache hit ratio.

    The increase in origin traffic from new POPs temporarily lowers the overall cache hit ratio.

Differences Between DNS Record Acceleration Types

In the scenario configuration of DNS records, the business type selection offers flexible adjustability. Selecting a business type that does not exactly match your scenario will not affect basic access functionality; however, an accurate match can significantly improve the scheduling efficiency of security acceleration resources and optimize overall performance. It is recommended to select the scenario type that best aligns with your actual business characteristics, so that the ESA system can dynamically allocate a more suitable security acceleration policy for the domain record. You can edit the record and adjust the business type at any time through the console to achieve continuous optimization of resource configuration.

How do I check the current connection configuration for my domain?

In the ESA console, go to DNS > Records. This page displays the current connection mode, business scenario (for example, API acceleration), and CNAME target for your domain. You can use this information to determine whether advanced features such as smart routing are enabled.

How is precedence determined between a subdomain record and a wildcard domain record?

When a subdomain has its own A/AAAA or CNAME record, that specific record takes precedence over a wildcard (*) CNAME record for the same name space. Requests for that subdomain resolve to the address configured on the specific record and no longer match the wildcard record.

A DNS record that I add is reported as already existing but does not appear in the list. What do I do?

Try the following steps in order:

  1. Check whether you have reached the record quota of your plan. The record list page shows "You have added {current record count}/{quota value} records" above the table. When the quota is exceeded, this message turns red and is appended with "The limit has been exceeded and editing is disabled. Delete records until you are back within the limit, and then try editing again", and the Add record and Edit buttons are disabled. Do not assume a fixed number such as 100 or 150 records. The quota is returned dynamically based on your plan, so always check the message on this page for your actual quota.

  2. Check your origin configuration. If the CNAME record that you add points to the default CNAME address of an OSS bucket, a conflict can occur. Instead, in the record value, select OSS as the origin type and enter the default domain name of the bucket. When you select the OSS or S3 origin type, ESA sets authentication to public read automatically, and if Proxied is enabled, the origin host follows the origin domain name.

  3. Refresh the console page and add the record again.

What is a URI record, and why does ping return Unknown host?

A URI record publishes a service location that specific client applications read. It is not intended for browser access, and the ping command does not resolve it to an IP address. If a hostname has only a URI record configured, Unknown host returned by ping for that hostname is expected behavior, not a sign that the record was added incorrectly. For the number of URI records allowed per hostname, see Record limits.