DNS resolution issues and website access FAQ

A: Check whether local and authoritative DNS results match your settings. If they match, resolution is working. If local results differ, wait 10 minutes for the DNS cache to expire and retest. If authoritative results differ, contact after-sales support. Methods to test resolution effectiveness.

A: The following are common reasons why domain name resolution does not take effect:

A: DNS resolution failure means query results do not match your Cloud DNS settings, or queries cannot retrieve the target server IP. Troubleshooting approach for resolution not taking effect.

A: This is usually caused by stale local DNS cache. Your local DNS server (cache DNS server) is outside Cloud DNS control and caches records based on the TTL you set. Typical propagation times:

• Adding records: Immediate

• Deleting or modifying records: Depends on the local DNS cache TTL (default: 10 minutes).

Resolution effective time FAQ.

A: Your local DNS server (cache DNS server) is outside Cloud DNS control and caches records based on your TTL setting. Wait for the TTL to expire before retesting. TTL value setting method.

If you need to flush the local DNS cache on the client side, you can use the following commands:

• Windows:

  ipconfig /flushdns

• macOS:

  sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

• Linux:

  sudo systemd-resolve --flush-caches
  # or new version:
  sudo resolvectl flush-caches

  If using nscd cache service:

  sudo /etc/init.d/nscd restart

We also recommend using the browser's incognito/private mode or clearing the browser cache to rule out browser-level cache interference (especially for URL forwarding or HTTPS certificate error scenarios).

A: Two common causes:

• Local DNS server cache: After you modify a record, propagation speed depends on each region's local DNS cache refresh rate. Regions with slower cache refresh may still serve stale records.

  Solution: Cloud DNS cannot control local DNS caches. Contact your ISP.

• Resolution line settings: Missing a default line can cause resolution failures in some regions.

  Solution: Add a record with Resolution Request Source set to "default", keeping other settings consistent with the failing record. Adding resolution records.

Packet capture for troubleshooting: If access fails in a specific region or ISP, capture packets during the failure using Wireshark (Windows) or tcpdump (Linux), and save the .cap file to analyze whether the failure occurs at the DNS resolution stage or the TCP connection stage.

# Linux packet capture example
tcpdump -i eth0 -w dns_capture.cap port 53

A: No. Cloud DNS is an authoritative DNS server and cannot control cache refresh on local DNS servers nationwide.

A: For scenarios such as email verification, SSL certificate verification, or CDN/CNAME integration, troubleshoot as follows:

1. Verify record type and value: Strictly check whether the host record (such as _acme-challenge, _dmarc, @, www) and record value exactly match the third-party platform requirements. Pay attention to trailing dots, extra spaces, and other formatting details.

2. Verify resolution results:

   • Use dig or nslookup to query with the specific record type:

     dig TXT example.com
     nslookup -type=CNAME www.example.com

   • Use the Alibaba Cloud DNS diagnostic tool to check whether the records have propagated across all national nodes.

3. Cache and propagation time: Global DNS propagation and cache refresh may take 10 minutes to 48 hours. If the diagnostic tool shows correct results but the third-party still reports errors, wait and retry, or contact the third-party platform to check its detection node cache.

4. Conflict check: Ensure there are no conflicts with other records. For example, a CNAME record and an A record cannot coexist on the same host record.

A: DNS resolution is only one part of website hosting. First verify resolution using Methods to test resolution effectiveness. If resolution is normal but the website is still inaccessible, check the following:

• Domain names that resolve to mainland China servers require ICP filing. Verify your ICP filing status. How to troubleshoot website access issues caused by ICP filing?

• Verify that ports 80 and 443 (required for HTTPS) are open in the server security group.

  telnet your-server-ip 80
  telnet your-server-ip 443

  For Alibaba Cloud ECS, Check ECS instance security group rules.

• Verify that the web service is running and listening on the expected port. Check service status and port listening status.

• Verify that the server firewall allows traffic on the required ports. Check ECS firewall settings.

• If the browser displays "Connection Reset" or "Not Secure", check whether the SSL certificate is correctly deployed on the server. The DNS layer cannot resolve HTTPS certificate issues.

• Redirection/forwarding settings:

  • If URL forwarding is configured, please note that Alibaba Cloud's explicit/implicit URL forwarding only supports access via the HTTP protocol and does not support HTTPS source domains. Accessing via HTTPS may result in connection failures or redirect loops.

  • Check whether the web server (such as Nginx or Apache) is configured with incorrect redirect rules (e.g., redirecting to private IPs or unresolved domains).

If all checks pass, contact your server or hosting provider for further troubleshooting.

A: An active resolution means that the domain name resolution service is working correctly. The ping command relies on the Internet Control Message Protocol (ICMP) and can only probe the IP addresses of A records (IPv4) or AAAA records (IPv6). A failed ping command usually indicates a problem with the network link.

For example, pinging a canonical name (CNAME) or MX record might fail if the target domain name does not have an A record or AAAA record, or if the resolution chain is broken. Ping commands will also fail if a server has disabled the ICMP protocol.

If your server's IP address is from Alibaba Cloud, submit a ticket for server troubleshooting. If your server's IP address is not from Alibaba Cloud, contact your server provider for troubleshooting.

A: First determine whether the issue is website instability, slow access, or actual DNS resolution instability.

• Website instability or slow access: These are not DNS issues. If the domain resolves to the correct IP, DNS is working. Troubleshoot server configuration, web application, and network environment instead.

• Unstable resolution: DNS queries go from Local DNS to root DNS, top-level domain DNS, and then Cloud DNS (authoritative DNS). If the Local DNS is unstable, resolution anomalies can occur. Capture a screenshot from the Alibaba query tool and submit a ticket.

A: No. When an ECS instance expires or is released, DNS records in Alibaba Cloud DNS are not automatically deleted. The records still point to the original IP, but the service is unavailable. If the IP is reassigned to another user, your domain may resolve to someone else's server - a security risk. Delete unused DNS records promptly.

A: Some third-party tools may not properly handle internationalized domain names. Use the Punycode encoding for queries and configuration. For example, the Punycode for a Chinese domain is in the format xn--fiq228c.com. Use an online Punycode converter tool.

A: If a GTM instance is configured, GTM has the highest priority, and regular DNS records in the DNS console will no longer take effect. If the GTM service is disabled or deleted, regular DNS records will resume after the cache expires.

A: If you can send and receive email using the webmail and a DNS network probe confirms that your MX and TXT records are active, your DNS configuration is correct. The client-side error is likely caused by a local cache or a delay in server-side data synchronization.

1. Delete any unnecessary DNS records that do not belong to your current mailbox provider.

2. Wait 24 to 48 hours to allow for full synchronization of global DNS data and the mailbox provider's internal data.

3. Restart the mail client or re-add the account to test the configuration.

A: Domain renewal does not affect configured DNS records. As long as the domain is in a normal status (not expired or frozen), DNS records continue to be effective. If a brief anomaly occurs after renewal, it is typically caused by a delay in domain status synchronization. Wait a moment and the records will resume.