Custom Rules

Add Rule

1. Go to the Private Zone DNS Firewall page.

2. On the Custom Rules tab, which is selected by default, click Add Rule.

3. In the Add Rule dialog box, configure the parameters and submit the form.

   Parameter	Description
   Domain Name	The domain names that the Private Zone DNS Firewall will inspect. Enter each domain name on a new line. A period (.) represents all domain names, which means the rule applies to all domains. Wildcard domain names are supported, for example, *.example.com.
   Record Type	The DNS record type that the rule will inspect. You can apply the rule to a specific record type or all record types. Supported types include Any type, A, CNAME, AAAA, NS, MX, SRV, TXT, CAA, SVCB, and HTTPS.
   Query Source	The source of the DNS queries. The rule applies only to queries from the specified IP addresses or CIDR blocks. 0.0.0.0/0 represents all query sources. CIDR blocks are supported, such as 192.168.1.1/24. Single IP addresses are supported, such as 192.168.2.20. Enter each IP address or CIDR block on a new line. Overlapping IP ranges are allowed.
   Action	The action to perform on DNS queries that match the rule. The following actions are available: Allow: Allows the query to proceed. This action generates an action log and a detailed response log. Drop: Silently drops the query without sending a response. Response NXDOMAIN: Responds with an NXDOMAIN status, indicating that the domain does not exist. Response Address: Responds to the query with a specific address. You can configure multiple addresses and distribute responses using weighted or round-robin methods. The record value type must match the specified Record Type. If Record Type is set to Any type, the record value can be an IPv4 address, an IPv6 address, or a domain name. However, you cannot use both domain names and IP addresses in the same rule. Answer NOERROR (NoData): Responds with a NOERROR status but an empty answer section in the response.
   Rule Priority	The first rule that you add is always assigned a priority of 1, regardless of the value that you enter. If you assign a priority that is already in use, the new rule takes that priority value. The rule that previously had that priority, and all subsequent rules, are shifted down by one (their priority value is incremented by 1). If you assign a priority value that is greater than the total number of rules, the new rule is assigned the lowest priority (the highest number). For example, if there are four existing rules and you add a new rule with a priority of 7, its priority is set to 5.
   Rule Status	Specifies whether the rule is active. This is enabled by default.
   Effective Scope	Specifies the VPCs where the rule is active. For internal DNS, the scope is typically defined by your VPCs. You can also Associate VPCs across accounts.
   Remarks	An optional description to help you identify and manage the rule.

4. After the rule is added, it appears in the rule list.

   On the Custom Rules tab, the rule list displays the following information for each rule: Domain Name/ID, Record Type, Query Source, Action (for example, Response NXDOMAIN, Response Address, or Allow), Rule Status (shown as a toggle switch), Rule Priority, Effective Scope (the number of associated VPCs), Remarks, and Creator. In the Actions column, you can click Edit to modify a rule, click Effective Scope to adjust its associated VPCs, or click Priority Rankings to change the rule's evaluation order. To create more rules, click Add Rule.

Modify a rule

For existing protection rules, you can edit the Domain Name and Block Rule fields.

1. Go to the Private Zone DNS Firewall page.

2. On the Custom Rules tab, find the rule that you want to modify and click Edit in the Actions column.

3. In the Edit Rule dialog box, you can click the Edit button to modify the Domain Name and Block Rule.

Configure effective scope

Specify the VPCs where the rule is active.

1. Go to the Private Zone DNS Firewall page.

2. On the Custom Rules tab, find the target rule and click Effective Scope in the Actions column.

3. In the Effective Scope dialog box, select VPCs from your current Alibaba Cloud account or other associated accounts.

   If the VPC data in the drop-down list is outdated, wait 30 minutes and try again. You can click + Centralized VPC DNS Management (across Alibaba Cloud accounts) to add VPCs from another account.

Priority Rankings

• The first rule that you add is always assigned a priority of 1, regardless of the value that you enter.

• If you assign a priority that is already in use, the new rule takes that priority value. The rule that previously had that priority, and all subsequent rules, are shifted down by one (their priority value is incremented by 1).

• If you assign a priority value that is greater than the total number of rules, the new rule is assigned the lowest priority (the highest number). For example, if there are four existing rules and you add a new rule with a priority of 7, its priority is set to 5.

1. Go to the Private Zone DNS Firewall page.

2. On the Custom Rules tab, click Priority Rankings in the Actions column of any rule.

3. In the Priority Rankings dialog box, select a new priority number for a rule and submit your changes.

Disable or delete a rule

If you no longer need a custom rule, you can disable or delete it.

1. Go to the Private Zone DNS Firewall page.

2. On the Custom Rules tab, find the target rule.

   1. Disable a rule: Temporarily deactivates a rule while preserving its configuration.

      Important

      Disabled rules are not matched against DNS queries. However, you are still charged for them. For more information, see Product Billing.

      1. Click the toggle in the Status column to enable or disable the rule.

   2. Delete a rule: Permanently removes a rule.

      1. In the Actions column, click Delete.

      2. In the confirmation dialog box, confirm the deletion.