:Recursive resolution proxy

Recursive resolution proxy

PrivateZone supports the recursive resolution proxy feature. With this feature enabled, if a query for an unconfigured subdomain originates from an associated VPC, PrivateZone performs public recursive resolution and returns the response to the VPC.

For example, a zone is named aliyun.com, and three private records are configured in aliyun.com as shown in the following table:

• When you query host01.aliyun.com, host02.aliyun.com, or host03.aliyun.com in a VPC, the private records 10.0.0.1, 10.0.0.2, and 10.0.0.3 are returned respectively.

• When you query public domain names such as www.aliyun.com, api.aliyun.com ,rds.aliyun.com within a VPC, a recursive query is performed, and the final DNS response is the actual resolution result from the public internet.

Enable recursive resolution proxy

You can enable the recursive resolution proxy when adding a zone. For an existing zone, click its ID and enable the feature in the details section.

• Enable this feature when adding a zone.

• For an existing zone, enable the recursive resolution proxy in the details section. This does not affect existing domain name resolution.

Disable recursive resolution proxy

• Disable this feature in the details section.

  Internal domain name resolution

• When a client in an associated VPC sends a DNS query, PrivateZone is queried first. If a matching record is found, PrivateZone returns the result. If the result is a CNAME record, the client proceeds to resolve the target domain. Otherwise, the client uses the returned result.

• If no matching record is found in PrivateZone, the resolver checks if the query matches a domain name forwarding rule. If a rule is matched, the resolver forwards the request to an external DNS for resolution. If the response is a CNAME record, the client proceeds to resolve the target domain. Otherwise, the client uses the returned result.

• If the query does not match any domain name forwarding rule, the resolver sends the request for public recursive resolution. If the response is a CNAME record, the client proceeds to resolve the target domain. Otherwise, the client uses the returned result.

  

  Note

  If a domain's CNAME record value points to the domain name itself, this creates a CNAME loop. The system terminates the resolution and returns the CNAME record.