Enterprise user onboarding-Alibaba Cloud DNS(DNS)-阿里云帮助中心

Alibaba Cloud on-premises DNS

If you privately deploy DNS services on Alibaba Cloud using Alibaba Cloud DNS software, configure forwarding as follows. For more information, see What is an on-premises DNS server?.

Go to Alibaba Cloud DNS – Internal Domain Name Resolution.
Switch to the Forward Zone tab.
Click Add Forward Rule.

Fill in the form fields in the pop-up panel and submit the form. The configuration items are described below:

Configuration Item	Description
Forward Zone Name	Enter the domain name (zone) for which you want to forward DNS queries. Important To forward queries for all domains (the root domain), enter a period (`.`). Top-level domain (TLD) forwarding is supported. For example, you can enter `com`, `cn`, or `top`. If a query matches multiple forwarding domains, such as `example.com`, `com`, and `.`, the rule for the most specific domain (`example.com`) takes precedence based on the longest-match principle.
Rule Name	Name the rule based on your business needs and meaning.
IP Address of External DNS	Enter the public IP address and port of your Enterprise Recursive Gateway. IP: 223.5.5.5, port: 53 IP: 223.6.6.6, port: 53
	Effective in VPCs: Leave blank. Outbound Endpoint: Leave blank. Effective in on-premises DNS clusters: Select your on-premises DNS resolution cluster from the drop-down list.

(Optional) If you did not set the rule’s effective scope when creating it, go to the Forward Rule tab. Find the rule and click Effective Scope.

In the pop-up panel, select and associate your deployed on-premises DNS cluster.

Note

Bind a public network egress IP address to prioritize DNS queries from that source IP and avoid rate limiting. For more information, see Bind a Public Network Egress IP Address.

Windows configuration

To connect a Windows-based on-premises DNS server, configure conditional forwarding as follows:

Open the Windows DNS Manager.
When creating a conditional forwarder, enter the target domain name, such as aliyun.com, in the DNS Domain field. Enter 223.5.5.5 and 223.6.6.6 in the Master Server IP Address field. Click OK to complete the configuration.

Note

Bind a public network egress IP address to prioritize DNS queries from that source IP and avoid rate limiting. For more information, see Bind a Public Network Egress IP Address.

BIND configuration

To connect a self-managed BIND DNS server, configure forwarding as follows:

To set a global default forwarder, edit the named.conf configuration file. Add the forwarders directive under the options block. Specify the required DNS forwarder addresses.

options {
        listen-on port 53 { 127.0.0.1; };
        listen-on-v6 port 53 { ::1; };
        directory       "/var/named";
        dump-file       "/var/named/data/cache_dump.db";
        statistics-file "/var/named/data/named_stats.txt";
        memstatistics-file "/var/named/data/named_mem_stats.txt";
        recursing-file  "/var/named/data/named.recursing";
        secroots-file   "/var/named/data/named.secroots";
        allow-query     { localhost; };

        /*
         - If you are building an AUTHORITATIVE DNS server, do NOT enable recursion.
         - If you are building a RECURSIVE (caching) DNS server, you need to enable
           recursion.
         - If your recursive DNS server has a public IP address, you MUST enable access
           control to limit queries to your legitimate users. Failing to do so will
           cause your server to become part of large scale DNS amplification
           attacks. Implementing BCP38 within your network would greatly
           reduce such attack surface
        */
        recursion yes;
        forward first;
        forwarders {
        223.5.5.5;
        223.6.6.6;
        };
        dnssec-enable no;
        dnssec-validation no;

Restart the BIND service by running sudo systemctl restart named. This ensures the new configuration loads and takes effect.
To forward queries for a specific domain, edit the named.conf configuration file. Add a forwarding zone. For example, to forward queries for example.com, configure as follows:
```
zone "example.com" IN {
    type forward;
    forwarders {
        223.5.5.5;
        223.6.6.6;
    };
    forward first;
};
```
Restart the BIND service by running sudo systemctl restart named. This ensures the new configuration loads and takes effect.

Note

Bind a public network egress IP address to prioritize DNS queries from that source IP and avoid rate limiting. For more information, see Bind a Public Network Egress IP Address.