DHCP options sets and DNS hostnames - Virtual Private Cloud

To reduce the dependency on fixed IP addresses for inter-instance communication, you can use a DHCP options set to configure DNS server IPs and search domains for all ECS instances in a VPC. When an instance communicates by hostname, the system appends the search domain and queries the specified DNS server for the full domain-to-IP mapping.

How it works

A DHCP options set associates with a VPC and uniformly configures parameters such as DNS Server IP and Domain Name for all ECS instances in the VPC. Once configured, instances can reach each other by hostname or FQDN without relying on fixed IPs.

Step	Description
①	The DHCP options set is associated with a VPC. ECS instances in the VPC interact with the DHCP server to obtain network configuration from the DHCP options set (including domain name, DNS server IPs, and other network parameters), which is then written into each instance's system configuration.
②	An ECS instance sends a query to the DNS server to resolve a DNS hostname to an IP address. The DNS server returns the corresponding IP address.
③	The instance connects to the target ECS instance using the resolved IP address.

Domain name configuration: communicate by hostname

A complete private domain name consists of a hostname and a domain name. For example, in host01.host.prvz, the hostname is host01 and the domain name is host.prvz.

After you add DNS resolution records for ECS instances on the DNS server, instances can be reached by their full private domain names. To simplify communication to hostname-only, you can run vim /etc/resolv.conf on each ECS instance to add search host.prvz, which sets host.prvz as the DNS search domain.

However, manually configuring each ECS instance is inefficient and error-prone. By configuring a domain name in the associated DHCP options set, all ECS instances in the VPC automatically receive the domain name via DHCP and write it to /etc/resolv.conf as the DNS search domain. When an instance communicates by hostname, the system appends the search domain and queries the specified DNS server for the full domain-to-IP mapping.

DNS server IP configuration: resolve domain names

The DNS server maintains domain name resolution records. When an ECS instance runs ping host01.host.prvz, it sends a query to the specified DNS server, which returns the corresponding IP address.

When you create an ECS instance from an official image, Alibaba Cloud automatically configures default DNS servers via DHCP. The default DNS server IPs are 100.100.2.136 and 100.100.2.138. These are Alibaba Cloud VPC internal DNS servers that resolve both public domain names and Alibaba Cloud internal domain names.

Comparison	DNS hostnames enabled	Private DNS (Private Zone)	Self-managed DNS service
DHCP options set type	Default DHCP options set	Custom DHCP options set	Custom DHCP options set
Domain name configuration	ECS private domain [regionID].ecs.internal Default DNS servers	Custom domain name Default DNS servers	Custom domain name Self-managed DNS server
Billing	No domain name fees	Fees based on domain name count and DNS query volume. See billing details.	No domain name fees
Cross-VPC and hybrid cloud private domain communication	Not supported	Supported	Supported

DNS query performance depends on the DNS server in use. For performance limits of the Alibaba Cloud default DNS servers, see Private DNS resolution service limits.

Create or delete a DHCP options set

To reduce the dependency on fixed IPs and enable hostname or FQDN-based communication, you can use a DHCP options set to uniformly configure DNS server IPs and search domains for all ECS instances in the associated VPC. When an ECS instance runs ping <hostname>, the system appends the search domain (for example, hostname.example.com) and queries the specified DNS server for the domain-to-IP mapping.

A single DHCP options set can be associated with multiple VPCs in the same region, but each VPC can only be associated with one DHCP options set.

Console

Create a DHCP options set

When you enable DNS hostnames for a VPC in a region for the first time, a default DHCP options set is automatically created and associated with the VPC. The default DHCP options set cannot be modified. To create a custom one, go to VPC console - DHCP Options Sets, click Create DHCP Options Set, and configure the Domain Name and DNS Server IP to match your DNS resolution service.

If the VPC is already associated with another DHCP options set, enabling DNS hostnames does not automatically associate the default DHCP options set. You must update the association manually.

Associate a VPC

You can create, change, or remove the association between a VPC and a DHCP options set from the DHCP Options Sets section on the target VPC details page, or from the Actions column or details page of the target DHCP options set.

After an association change, new ECS instances automatically use the updated configuration. For existing instances, restart the DHCP process by running sudo dhclient -r eth0 && sudo dhclient eth0 to apply the new configuration. After an association is removed, Alibaba Cloud assigns the default DNS servers to instances via DHCP. You can also restart the instance or its network service to ensure the latest configuration takes effect, provided this does not disrupt your workloads.

Commands to restart network services by operating system

Operating system	Version	Command to restart network service
CentOS	6	service network restart
	7	systemctl restart network
	8	systemctl restart NetworkManager
Debian	8	systemctl restart networking
	9	systemctl restart networking
	10	systemctl restart networking
Ubuntu	14	service networking restart
	16	systemctl restart networking
	18	systemctl restart systemd-networkd
	20	systemctl restart systemd-networkd
Alibaba Cloud Linux 2	2	systemctl restart network
Alibaba Cloud Linux 3	3	systemctl restart NetworkManager

If the VPC associated with the DHCP options set has Shared VPC enabled, the DHCP options set also applies to ECS instances in the shared VPC.

Modify a DHCP options set

The default DHCP options set cannot be modified. You can modify the domain name and DNS server IPs of a custom DHCP options set.

After you modify a DHCP options set, new ECS instances in the associated VPC automatically use the updated configuration. For existing instances, restart the DHCP process to apply the changes. You can also restart the instance or its network service to ensure the latest configuration takes effect, provided this does not disrupt your workloads.

Delete a DHCP options set

Before deleting a DHCP options set, disassociate it from all VPCs. Then, in the Actions column or on the details page of the target DHCP options set, click Delete.

API

When you enable DNS hostnames for a VPC in a region for the first time, a default DHCP options set is automatically created and associated with the VPC.

After you modify a DHCP options set or change an association, new ECS instances automatically use the updated configuration. For existing instances, restart the instance, restart the DHCP process, or restart the network service to apply the changes.

Call CreateDhcpOptionsSet to create a DHCP options set.
Call AttachDhcpOptionsSetToVpc to associate the DHCP options set with a VPC.
Call DetachDhcpOptionsSetFromVpc to disassociate the DHCP options set from a VPC.
Call ReplaceVpcDhcpOptionsSet to change the VPC associated with a DHCP options set.
Call UpdateDhcpOptionsSetAttribute to modify the DHCP options set configuration.
Call DeleteDhcpOptionsSet to delete a DHCP options set.

Terraform

Resource: alicloud_vpc_dhcp_options_set, alicloud_vpc_dhcp_options_set_attachment

# Specify the region of the VPC
provider "alicloud" {
  region = "cn-hangzhou"
}

# Create a DHCP options set
resource "alicloud_vpc_dhcp_options_set" "test_dhcp_options_set" {
  dhcp_options_set_name = "test_dhcp_options_set_name"
  domain_name           = "example.com"                 # Specify the domain name
  domain_name_servers   = "100.100.2.136,100.100.2.138" # Specify the DNS server IPs
}

# Associate the DHCP options set with a VPC
resource "alicloud_vpc_dhcp_options_set_attachment" "test_attachment_vpc" {
  vpc_id              = "vpc-8vbg******"                                       # Specify the VPC instance ID
  dhcp_options_set_id = alicloud_vpc_dhcp_options_set.test_dhcp_options_set.id # Specify the DHCP options set instance ID
}

Enable DNS hostnames

To enable private domain name communication within a VPC, you can enable DNS hostnames for the VPC and configure private DNS resolution on ECS instances. Alibaba Cloud Private DNS automatically maintains the DNS resolution records, reducing maintenance time and cost. The VPC is associated with a default DHCP options set that assigns each instance the ECS built-in authoritative domain [regionID].ecs.internal.

1. When you enable DNS hostnames for a VPC in a region for the first time, a default DHCP options set is automatically created and associated with the VPC. When other VPCs in the same region enable DNS hostnames, the system automatically associates the same default DHCP options set.

2. If the VPC is already associated with another DHCP options set, enabling DNS hostnames does not associate the default DHCP options set. You must update the association manually.

3. Cross-VPC and hybrid cloud private domain name communication is not currently supported.

Console

Enable DNS hostnames

Go to the VPC console. On the target VPC's Basic Information page, click Enable DNS Hostnames.
Go to the ECS instance console and configure private DNS resolution for the ECS instance. The configured instance can then be accessed by hostname from other ECS instances in the same VPC.
When Create Instance, expand Advanced Options and configure Private DNS Resolution. Select either the IP-formatted hostname to primary private IPv4 address mapping or the instance ID-formatted hostname to primary private IPv4 address mapping.
Instance IDs cannot be changed. If an instance's IP address changes, the DNS record automatically updates to map the new IP-formatted hostname to the new IP.
After an IPv6 address is assigned, you can also select the instance ID-formatted hostname to primary private IPv6 address mapping.
For existing ECS instances, in the Actions column, choose > Instance Properties > Edit Instance Properties, and select the mapping between the private domain name and IP address.

Disable DNS hostnames

On the target VPC's Basic Information page, click Disable DNS Hostnames. The Alibaba Cloud-assigned domain name is disabled and ECS private domain names can no longer be resolved to their corresponding IPs.

The system automatically disassociates the VPC from the default DHCP options set but does not delete it. To delete the DHCP options set, ensure it is disassociated from all VPCs first.

API

Unlike the console workflow, you can set the EnableDnsHostname parameter when calling CreateVpc to enable or disable DNS hostnames at VPC creation time.

Set the EnableDnsHostname parameter in ModifyVpcAttribute to enable or disable DNS hostnames.
When calling RunInstances to create an instance, specify the PrivateDnsNameOptions parameters to configure private DNS resolution.
Set the PrivateDnsNameOptions parameters in ModifyInstanceAttribute to configure private DNS resolution for an existing ECS instance.

Terraform

ECS private DNS resolution cannot be configured through Terraform. This example only enables DNS hostnames for a VPC.

Resources: alicloud_vpc, alicloud_vswitch

Data Sources: alicloud_zones

# Specify the region for the VPC
provider "alicloud" {
  region = "cn-hangzhou"
}

# Create a VPC with DNS hostnames enabled
resource "alicloud_vpc" "test_vpc" {
  vpc_name            = "test_vpc_name"
  cidr_block          = "10.0.0.0/16"
  dns_hostname_status = "ENABLED" # Enable DNS hostnames
}

Use custom domain names

The ECS private domain names generated by DNS hostnames cannot be modified. To use custom domain names, you can use Alibaba Cloud Private DNS or a self-managed DNS service.

Use Private DNS

To add DNS resolution records for ECS instances in bulk, you can use Private DNS. This service charges fees based on the number of domain names and DNS query volume.

Console

Go to the Private DNS console, click Add Zone, configure a custom Authoritative Zone, and set the Effective Scope to the target VPC.
Click the target zone ID. On the ECS Hostname tab, click Add ECS Hostname. The system automatically adds DNS resolution records mapping ECS hostnames to IPs in the selected region, but changes to hostnames are not synced automatically. You can enable Automatic Synchronization Settings to have the system automatically add and sync DNS records every minute. To use a custom domain prefix, go to the Settings tab and add a custom Hostname.
Go to VPC console - DHCP Options Sets, click Create DHCP Options Set, and set the Domain Name to the corresponding built-in authoritative domain name.
In the Actions column of the target DHCP options set, select Associate VPC. ECS instances with configured DNS records can then be accessed by hostname or host record from other instances in the associated VPC.

API

Call the following APIs in sequence to use Alibaba Cloud Private DNS:

Terraform

Automatic addition of ECS hostname resolution records is not supported. You need to add custom DNS resolution records individually.

Resource: alicloud_pvtz_zone, alicloud_pvtz_zone_attachment, alicloud_pvtz_zone_record, alicloud_vpc_dhcp_options_set, alicloud_vpc_dhcp_options_set_attachment

# Specify the region of the target VPC
provider "alicloud" {
  region = "cn-hangzhou"
}

# Configure a built-in authoritative domain
resource "alicloud_pvtz_zone" "test_pvtz_zone" {
  zone_name = "example.com"
}

# Set the domain name scope
resource "alicloud_pvtz_zone_attachment" "test_pvtz_zone_attachment" {
  zone_id = alicloud_pvtz_zone.test_pvtz_zone.id
  vpc_ids = ["vpc-8vba******"] # Specify the VPC instance ID where the domain takes effect
}

# Add a DNS resolution record
resource "alicloud_pvtz_zone_record" "test_pvtz_zone_record" {
  zone_id = alicloud_pvtz_zone.test_pvtz_zone.id
  rr      = "abc"         # Specify the host record
  type    = "A"           # Specify the DNS record type
  value   = "192.168.0.4" # Specify the DNS record value
}

# Create a DHCP options set
resource "alicloud_vpc_dhcp_options_set" "test_dhcp_options_set" {
  dhcp_options_set_name = "test_dhcp_options_set_name"
  domain_name           = "example.com"                 # Specify the domain name
  domain_name_servers   = "100.100.2.136,100.100.2.138" # Specify the Alibaba Cloud default DNS server IPs
}

# Associate the DHCP options set with a VPC
resource "alicloud_vpc_dhcp_options_set_attachment" "test_attachment_vpc" {
  vpc_id              = "vpc-8vba******"                                       # Specify the VPC instance ID
  dhcp_options_set_id = alicloud_vpc_dhcp_options_set.test_dhcp_options_set.id # Specify the DHCP options set instance ID
}

Use a self-managed DNS service

If your workloads require flexible DNS routing policies, for example, dynamically returning optimal IPs based on geographic location, network quality, or server load, you can deploy a self-managed DNS server. However, you are responsible for maintaining DNS records and ensuring service reliability. The following example shows how to deploy a self-managed DNS service using BIND, then use a DHCP options set to point ECS instances to your DNS server IP and custom domain name.

Deploy a self-managed DNS service using BIND

Run yum install -y bind bind-utils to install BIND.

Run vim /etc/named.conf to edit the main configuration file.

listen-on port 53 { any; };  # Listen on all network interfaces on port 53
allow-query     { any; };    # Allow DNS queries from any IP address

Run vim /etc/named.rfc1912.zones to configure the zone file.

// Custom domain name
zone "example.com" IN {
      type master;
      file "example.com.zone";
};

zone "0.168.192.in-addr.arpa" IN {
      type master;
      file "0.168.192.zone";
};

Run cp -p /var/named/named.localhost /var/named/example.com.zone and vim /var/named/example.com.zone to configure the forward DNS lookup file.

$TTL 1D
@       IN      SOA     example.com.  admin.example.com. (
                                                           1       ; serial
                                                           1D      ; refresh
                                                           1H      ; retry
                                                           1W      ; expire
                                                           3H )    ; minimum

              NS      dns.example.com.
Web01         A       192.168.0.2; 
Web02         A       192.168.0.3;

Run cp -p /var/named/named.empty /var/named/0.168.192.zone and vim /var/named/0.168.192.zone to configure the reverse DNS lookup file.

$TTL 3H
@       IN      SOA     0.168.192.in-addr.arpa. admin.zjq.com. (
                                                           1       ; serial
                                                           1D      ; refresh
                                                           1H      ; retry
                                                           1W      ; expire
                                                           3H )    ; minimum

              NS      dns.example.com.
2            PTR     Web01.example.com.
3            PTR     Web02.example.com.

Run systemctl restart named to restart the BIND service.

To use both your self-managed DNS service and the Alibaba Cloud DNS service, configure global forwarding rules on your self-managed DNS server to forward queries for non-custom domains to the Alibaba Cloud default DNS servers.

Configure global forwarding rules for the self-managed DNS server

Run vim /etc/named.conf to edit the configuration file.

// Global forwarding: forward other requests to the default DNS servers
options {
    forwarders { 100.100.2.136; 100.100.2.138; };  # Alibaba Cloud VPC default DNS servers
    forward only;
};
// Configure authoritative DNS resolution for the self-managed DNS server. Replace "example.com" with your custom domain name.
zone "example.com" {
    type master;
    file "example.com.zone";  # DNS record configuration file
};

When specifying DNS server IPs in a custom DHCP options set, note the following:

1. We recommend that you deploy at least two custom DNS servers to prevent DNS resolution failures caused by a single point of failure.

2. In the DHCP option set, enter only the IP addresses of your custom DNS servers. Remove the Alibaba Cloud default DNS server IP addresses (100.100.2.136 and 100.100.2.138) that the console automatically populates. Configure global forwarders on your custom DNS servers, specifying 100.100.2.136 and 100.100.2.138 as upstream DNS servers. This ensures that public domain names and Alibaba Cloud internal services can be resolved.

3. Add inbound rules to the security group and network ACL (if configured) of the associated VPC to allow traffic to the self-managed DNS server IP. Otherwise, DNS queries may fail.

4. IPv6 addresses are not supported for custom DNS server IPs.

Console

Go to VPC console - DHCP Options Sets, click Create DHCP Options Set, set the Domain Name to the domain name used in your self-managed DNS service, click customize DNS server IP addresses, and place your self-managed DNS server IP first in the list.
In the Actions column of the target DHCP options set, select Associate VPC. ECS instances with configured DNS records can then be accessed by hostname from other instances in the associated VPC.

API

Call the following APIs in sequence to create a custom DHCP options set with your domain name and self-managed DNS server IP, and associate it with a VPC.

Terraform

Resource: alicloud_vpc_dhcp_options_set, alicloud_vpc_dhcp_options_set_attachment

# Specify the region of the VPC
provider "alicloud" {
  region = "cn-hangzhou"
}

# Create a DHCP options set
resource "alicloud_vpc_dhcp_options_set" "test_dhcp_options_set" {
  dhcp_options_set_name = "test_dhcp_options_set_name"
  domain_name           = "example.com"                              # Specify the domain name
  domain_name_servers   = "192.168.0.10,192.168.0.11" # Specify self-managed DNS server IP only. Two servers are recommended to avoid SPOF
}

# Associate the DHCP options set with a VPC
resource "alicloud_vpc_dhcp_options_set_attachment" "test_attachment_vpc" {
  vpc_id              = "vpc-8vbg******"                                       # Specify the VPC instance ID
  dhcp_options_set_id = alicloud_vpc_dhcp_options_set.test_dhcp_options_set.id # Specify the DHCP options set instance ID
}

More information

Billing

The DHCP options set feature is free of charge.

Supported regions

Area	Region
Asia Pacific - China	China (Hangzhou), China (Shanghai), China (Qingdao), China (Beijing), China (Zhangjiakou), China (Hohhot), China (Ulanqab), China (Shenzhen), China (Guangzhou), China (Zhongwei), China (Chengdu), and China (Hong Kong)
Asia Pacific - Others	Japan (Tokyo), South Korea (Seoul), Singapore, Malaysia (Kuala Lumpur), Indonesia (Jakarta), Philippines (Manila), Thailand (Bangkok), and Malaysia (Johor)
Europe & Americas	Germany (Frankfurt), UK (London), France (Paris), US (Silicon Valley), US (Virginia), Mexico, and Brazil (São Paulo)
Middle East	UAE (Dubai) and Saudi Arabia (Riyadh - Partner Region)

Quotas

Quota name	Description	Default limit	Adjustable
N/A	Maximum number of DHCP options sets per account Default DHCP options sets do not count toward this quota.	10	Not adjustable
	Maximum number of VPCs that can be associated with a single DHCP options set	10
	Maximum number of DHCP options sets that can be associated with a single VPC	1
	Maximum number of domain names per DHCP options set	1
	Maximum number of DNS server IPs per DHCP options set	4