Subdomain recursive resolution proxy

When you configure a domain in a Private Zone, you can enable subdomain recursive resolution proxy. When enabled, if a DNS query within the zone's effective scope matches no record in the zone's namespace, Alibaba Cloud DNS queries the forwarding module. If forwarding also returns no result, Alibaba Cloud DNS performs a public recursive lookup.

Use case 1: No DNS records in the zone

On the Alibaba Cloud DNS - Private Zone page, add the zone aliyun.com and enable the subdomain recursive resolution proxy.
Define the effective scope for the aliyun.com zone without adding any DNS records.
On an ECS instance in a VPC within the effective scope, run dig aliyun.com. The subdomain recursive resolution proxy is triggered, retrieving the DNS record from the public internet.

Use case 2: Adding an @ record on a non-default line

On the Alibaba Cloud DNS - Private Zone page, add the zone aliyun.com and enable the subdomain recursive resolution proxy.
Define the effective scope for the aliyun.com zone and add a DNS record. Set the host record to "@" and the DNS request source to a custom resolution line. Custom lines.

Note
This example uses a custom line, but the same logic applies to Alibaba Cloud-defined lines.
On an ECS instance with a source IP address within the CIDR block of the custom resolution line, run dig aliyun.com. The query matches the DNS record configured in the Private Zone.
On an ECS instance with a source IP address outside the CIDR block of the custom resolution line, run dig aliyun.com. The subdomain recursive resolution proxy is not triggered.

Important
A host record of "@" represents the domain itself. The domain always has an SOA record with its DNS request source set to Default. Because the query matches this record, the subdomain recursive resolution proxy is not triggered.

Use case 3: Adding a non-@ record on a non-default line

On the Alibaba Cloud DNS - Private Zone page, add the zone aliyun.com and enable the subdomain recursive resolution proxy.
Define the effective scope for the aliyun.com zone and add a DNS record. Set the host record to "www" and the DNS request source to a custom resolution line. Custom lines.
On an ECS instance with a source IP address within the CIDR block of the custom resolution line, run dig www.aliyun.com. The query matches the DNS record configured in the Private Zone.
On an ECS instance with a source IP address outside the CIDR block of the custom resolution line, run dig www.aliyun.com. The subdomain recursive resolution proxy is triggered.

Subdomain recursive resolution proxy rules

The proxy is triggered if a zone has no DNS records.
If the host record "@" is configured on a non-default resolution line and a DNS query does not match any record in Private Zone, the proxy is not triggered.
If a host record other than "@" is configured on a non-default line and a DNS query does not match any record in Private Zone, the proxy is triggered.