Alibaba Cloud DNS is a managed domain name resolution platform with three core capabilities: authoritative DNS for the public Internet, private DNS for corporate networks, and intelligent traffic management across environments. A unified console and cloud-edge architecture cover resolution from internal VPCs and IDCs to mobile apps and IoT devices, with no need to deploy or maintain your own DNS infrastructure.
Architecture
Alibaba Cloud DNS consists of two components: a cloud platform and an edge component.
Cloud platform — Delivers domain name resolution as a Software as a Service (SaaS) offering for public Internet users and cloud-based enterprises.
Edge component — Uses self-hosted DNS software and a mobile software development kit (SDK) to handle resolution in IDC, multicloud, and application-specific environments.
Together, these form a cloud-edge architecture with centralized management and unified scheduling. This architecture supports end-to-end resolution from the central cloud to edge nodes and from public clouds to private networks. Configure and monitor all resolution settings from a single Alibaba Cloud DNS console.
Sub-products
Alibaba Cloud DNS provides five sub-products that address different resolution needs:
Public Zone — Public authoritative DNS for the Internet. Routes user traffic to the correct websites or application servers.
Private Zone — Internal DNS for corporate intranet environments, including Alibaba Cloud VPCs, self-hosted IDCs, and other cloud VPCs. Provides private domain name resolution for ECS instances, containers, and office terminals.
Global Traffic Manager — A DNS-based traffic management service with health checks and load balancing policies: polling, proximity-based routing, weighted, and sequential. Enables fault isolation and failover to support zone-redundancy and disaster recovery architectures.
Recursive Gateway — Throttling protection for enterprises that use Alibaba Cloud Public DNS (223.5.5.5 / 223.6.6.6). Prevents internal crawlers or malicious requests from exhausting query quotas and disrupting normal resolution.
HTTPDNS — Mobile DNS for mobile apps and IoT devices. Supports HTTP/HTTPS, DNS over HTTPS (DoH), and DNS over TLS (DoT) to replace traditional local DNS, preventing DNS hijacking, reducing resolution latency, and eliminating update failures.
Benefits
End-to-end resolution across all environments
The cloud-edge architecture covers all domain name resolution needs, from internal networks to the public Internet and from PCs to mobile devices.
Internal application access — Private Zone or self-hosted DNS provides authoritative resolution for custom domain names, supporting service discovery and interconnection for ECS instances, containers, and office terminals.
Outbound Internet access — Enterprise Recursive Gateway provides a unified recursive resolution entry point for public domain names, accelerating Internet access for SaaS applications and web browsing.
External service access — Globally distributed authoritative DNS nodes deliver high availability (HA), low latency, and high success rates for external-facing services such as websites, e-commerce platforms, and API operations.
Application and IoT terminal access — HTTPDNS uses HTTP/HTTPS protocols to replace traditional local DNS, preventing DNS hijacking and providing precise scheduling and low-latency resolution for mobile services.
Centralized management with lower O&M costs
A unified console manages domain name resolution configurations across all environments.
Single-console configuration — Configure and adjust resolution rules for Public Authoritative DNS, Internal DNS, Enterprise Recursive Gateway, and HTTPDNS without switching between systems.
Monitoring and alerting — Real-time monitoring, alerting, log analysis, and data visualization help detect anomalies and locate problems quickly.
Scalable architecture — Add resolution policies and customize scheduling rules as your business grows, without architectural changes.
Access at the control plane and service plane
Alibaba Cloud DNS supports access at both the control plane and the service plane.
Control plane access — Manage DNS configurations through the web console, OpenAPI, Terraform, or SDKs in multiple languages to fit different operational workflows and automation requirements.
-
Service plane access — Connect to DNS resolution through multiple paths:
Local terminal access — Deploy self-hosted DNS software for private resolution services on internal terminals.
Cloud terminal access — ECS applications in a VPC connect to Private Zone through dedicated IP addresses (100.100.2.136 and 100.100.2.138) for automatic private domain name resolution.
Mobile terminal access — Integrate the SDK to access HTTPDNS, avoiding resolution issues common with traditional local DNS and improving application performance.