After you add a website to Edge Security Acceleration (ESA), configure its DNS records to route traffic to your origin server. You can add, edit, and delete DNS records for each website.
Add DNS records
Add DNS records by batch import or manual entry:
Batch import: Upload multiple records from a zone file. See Batch import DNS records.
Manual entry: Create records one at a time in the console. See Manually enter DNS records.
Common configuration examples
Recover email delivery after switching to NS access
When you add a website to ESA by using NS access, the DNS records that were configured at your previous DNS provider are not migrated automatically. If you do not re-add the email-related records (MX, TXT, and CNAME) in the console, outgoing mail delivery fails and messages sent to your domain name are bounced back.
After you add a website, the console reminds you to configure the DNS records that you previously set up with your DNS provider. Otherwise, your services can be interrupted, because no DNS records exist after the NS is switched.
To restore email delivery, add the following records under DNS > DNS Records:
An MX record for the root domain name (
@) so that mail can reach@{your domain}.The TXT records that your mail provider requires for domain name verification, such as SPF, DKIM, and DMARC records. If you use Microsoft 365 or a similar service, also add the CNAME records that the provider requires.
The record list also shows a setup reminder that checks whether an A/AAAA or CNAME record exists for www and for the root domain name (@), and whether an MX record exists for the root domain name (@). Use this reminder as a checklist when you re-add records after NS access.
The Proxied toggle appears only for the A/AAAA and CNAME record types. For MX, TXT, and other email-related record types, this field is not displayed in the add or edit record form. You neither need to nor can select DNS only for them: this traffic never passes through the ESA proxy and always reaches the mail server directly.
For your website acceleration records (A/AAAA and CNAME), you can enable Proxied to apply acceleration and security capabilities. Proxied website records and non-proxied email records can coexist on the same website.
DNS Settings > Change access type is unavailable while any record on the website is not proxied (DNS only).
Edit DNS records
Edit a DNS record when its value changes, for example, when the origin server IP for your website changes.
In the ESA console, go to Websites. In the Website column, click the target website.
In the left navigation pane, choose .
Find the record and click Edit.
Update the Record Value field, click Next, and then click OK to save your changes.
Delete DNS records
Delete a DNS record when it is no longer needed, for example, when a service is taken offline and no longer requires acceleration.
After you deactivate or delete your ESA site, you can safely delete the _esaauth verification TXT record without affecting domain name resolution or website access. When you re-add the site to ESA, a new verification value is generated. You must add the new _esaauth TXT record to complete verification again. The old record value cannot be reused.
In the ESA console, go to Websites. In the Website column, click the target website.
In the left navigation pane, choose .
Find the record and click Delete.
Confirm the deletion.
Deleting a DNS record takes effect immediately. Make sure the record is no longer in use before you delete it.
Record limits
ESA limits the number of records per hostname by record type.
DNS record type | Description | Limit per hostname |
A/AAAA | Maps a hostname to an IP address (IPv4 or IPv6). | IPv4: 8, IPv6: 4 |
CAA | Specifies which certificate authorities can issue certificates for the hostname. | 8 |
CERT | Stores certificate data associated with the hostname. | 8 |
CNAME | Creates an alias that points the hostname to another domain name. | 1 |
MX | Directs email to the correct mail server. | 8 |
NS | Delegates a subdomain to specific name servers. | 8 |
SSHFP | Publishes SSH server fingerprints for host verification. | 8 |
SMIMEA | Associates S/MIME certificates with the hostname for email security. | 8 |
SRV | Defines the location (host and port) of specific services. | 8 |
TLSA | Associates TLS certificates with the hostname for DANE validation. | 8 |
TXT | Holds arbitrary text data, commonly used for domain verification and SPF records. | 8 |
URI | Maps a hostname to one or more URIs. | 8 |
Format and feature limits
CNAME record format: A CNAME record value can contain a single leading underscore (for example, _dmarc.example.com) only when the record is not proxied (DNS only). An underscore in any other position in the record value fails validation with "Invalid domain name". If Proxied is enabled for the CNAME record, no underscore is allowed anywhere in the value. The record value must be shorter than 253 characters and cannot be the same as the record name.
FAQ
Why do I get a CompileRuleError error when I add or edit a DNS record?
Only one CNAME record is allowed per hostname. If a CNAME record already exists for a hostname, adding another CNAME record with the same name causes a conflict. For the limits on all record types, see Record limits.
How is precedence determined between a subdomain record and a wildcard domain record?
When a subdomain has its own A/AAAA or CNAME record, that specific record takes precedence over a wildcard (*) CNAME record for the same name space. Requests for that subdomain resolve to the address configured on the specific record and no longer match the wildcard record. This follows standard DNS resolution behavior, in which a more specific exact match takes precedence over a wildcard match. It is not a mechanism specific to ESA.
In the Record name field, ESA accepts both the * form, which is a whole-site wildcard domain, and the *.subdomain form. For the *.subdomain form, the suffix after *. must be a valid domain name.
A DNS record that I add is reported as already existing but does not appear in the list. What do I do?
Try the following steps in order:
Check whether you have reached the record quota of your plan. The record list page shows "You have added {current record count}/{quota value} records" above the table. When the quota is exceeded, this message turns red and is appended with "The limit has been exceeded and editing is disabled. Delete records until you are back within the limit, and then try editing again", and the Add record and Edit buttons are disabled. Do not assume a fixed number such as 100 or 150 records. The quota is returned dynamically based on your plan, so always check the message on this page for your actual quota.
Check your origin configuration. If the CNAME record that you add points to the default CNAME address of an OSS bucket, a conflict can occur. Instead, in the record value, select OSS as the origin type and enter the default domain name of the bucket. When you select the OSS or S3 origin type, ESA sets authentication to public read automatically, and if Proxied is enabled, the origin host follows the origin domain name.
Refresh the console page and add the record again.
What is a URI record, and why does ping return Unknown host?
A URI record publishes a service location that specific client applications read. It is not intended for browser access, and the ping command does not resolve it to an IP address. If a hostname has only a URI record configured, Unknown host returned by ping for that hostname is expected behavior, not a sign that the record was added incorrectly. For the number of URI records allowed per hostname, see Record limits.
To implement a 301 redirect, use a redirect rule instead of a URI record. In the left-side navigation pane, choose Rules > Redirect Rules, create a request redirect rule, and set the status code to 301. The 302, 303, 307, and 308 status codes are also supported.