ESA Edge Integration
Integrate your website into the Website AI Suite through Edge Security Acceleration (ESA) by configuring three DNS records at your DNS provider. You make no changes to your website source code. ESA then injects AI features into your pages automatically at the edge, issues and renews HTTPS certificates for your domain, and accelerates access from global nodes.
Integration methods
The Website AI Suite supports two integration methods:
ESA Edge Integration: DNS configuration points the CNAME record of your domain to ESA edge nodes. When traffic passes through an ESA edge node, Edge Routine automatically injects feature code into the HTML response. No changes to your website source code are required.
JS Embed: You manually add a
<script>tag to your website HTML. This method is suitable when you can modify the source code and want to integrate quickly. For JS Embed, see Embed JavaScript code in your website.
After you complete the procedure in this topic, your website is integrated with the Website AI Suite through the ESA edge. AI features, such as smart customer service and lead management, are injected automatically without source code changes. You also receive ESA edge HTTPS certificate management with automatic issuance and renewal, global node acceleration, and a complete page rendering experience without visual layout shifts.
Prerequisites
Purchase a Website AI Suite instance and bind your website domain to it.
Have permission to manage DNS records for the domain. You must be able to add and modify DNS records at the domain name registrar or DNS provider.
Have a publicly accessible origin address for your website, such as a server IP address, a cloud function, or a Vercel deployment.
If the domain you integrate is a root domain, such as
example.comwithoutwww, confirm that your DNS provider supports CNAME records for root domains. If not supported or you are unsure, use awwwsubdomain instead.
Estimated total time: about 15 to 30 minutes, including the wait for DNS records to take effect. The actual duration depends on how fast your DNS provider applies the records.
Integration process overview
ESA Edge Integration has three steps. During the procedure, the system automatically detects the current stage and displays the corresponding instructions:
Domain verification: Add a TXT record to verify domain ownership.
Certificate issuance: Add a DCV CNAME record to issue an HTTPS certificate. The system probes origin reachability at the same time.
Service integration: Point the CNAME record of the domain to the ESA integration address to complete edge integration.
During integration, configure the following three records at your DNS provider in sequence:
Step | Record type | Host record example | Purpose | After integration |
Step 1 | TXT |
| Verify domain ownership | Recommended to keep |
Step 2 | CNAME |
| Certificate DCV validation | Recommended to keep as a renewal fallback |
Step 3 | CNAME |
| Integrate with the ESA edge | Must keep |
Follow the steps below and use the values shown on the guide page.
Step 1: Domain verification
After the system creates a dedicated ESA site for your domain, it must verify that you own the domain.
Procedure
Go to the Deploy & Preview page of your instance and switch to the ESA Embed tab.
The system displays a TXT verification record in the following format:
Field
Value
Description
Record type
TXT
—
Host record
_esaauth.your-domainIf the domain to verify is
www.example.com, enter_esaauth.www.example.com. You can click the copy button to copy the value.Record value
verify_xxxxxxxxxxxxxxxxUse the value displayed on the page. You can click the copy button to copy the value.
Log on to your DNS provider and add the TXT record.
NoteSome DNS providers automatically append the domain suffix. Verify the value that you enter in the host record field.
After you configure the record, click Verify and Continue.
The system checks whether the TXT record has taken effect. After verification succeeds, the system automatically proceeds to the next step. A TXT record usually takes 1 to 10 minutes to take effect, depending on the TTL setting at your DNS provider.
If verification fails, confirm that the host record and record value exactly match the values shown on the page.
Expected results
Verification succeeds: The page automatically proceeds to the Step 2 guide.
Verification fails: The page indicates that verification did not pass. Check whether the TXT record is configured correctly.
Step 2: Certificate issuance and origin probing
After domain verification succeeds, the system applies for an ESA edge HTTPS certificate for your domain. In this step, configure a DCV (Domain Control Validation) CNAME record so that the certificate authority (CA) can verify control of the domain.
Configure the DCV CNAME record
The ESA Embed page displays the DCV CNAME record in the following format:
Field
Value
Description
Record type
CNAME
—
Host record
_acme-challenge.your-domainIf the domain is
www.example.com, enter_acme-challenge.www.example.com.Record value
your-domain.xxxxxxxx.dcv.aliyun-esa.comUse the value displayed on the page.
Log on to your DNS provider and add the CNAME record.
After you configure the record, click Verify and Continue.
Wait for certificate issuance
After you configure the record, the system starts issuing the certificate asynchronously and displays the Issuing certificate progress indicator. Keep the page open and wait for the system to automatically proceed to the next step.
The certificate is a Let's Encrypt DV certificate that is valid for three months. It renews automatically afterward, so you do not need to repeat the procedure.
Certificate issuance usually takes 30 seconds to 2 minutes.
Do not close the page during issuance. After issuance completes, the system automatically stops checking and proceeds to the next step.
Origin probing
After certificate issuance succeeds, the system automatically probes your website origin address.
If the system cannot detect the origin address, the page displays a message that the origin address of your website cannot be detected and provides a Re-detect button. Confirm that the website for the domain is accessible, and then click Re-detect.
Origin probing can fail because the domain has not resolved to the origin, the origin firewall blocks probe requests, or the origin is temporarily unavailable. Confirm that the website is accessible before probing again.
Expected results
After certificate issuance succeeds and origin probing passes, the page automatically proceeds to the Step 3 guide.
Step 3: Switch the CNAME record
After domain verification succeeds and certificate issuance completes, the system unlocks the final CNAME switch guide. At this point, the ESA edge already has your domain certificate, and the TLS handshake succeeds immediately after you switch the CNAME record.
Procedure
The ESA Embed page displays the final integration CNAME record in the following format:
Field
Value
Description
Record type
CNAME
—
Host record
your-domainIf the domain you integrate is
www.example.com, enterwww.example.com.Record value
{ESA-assigned site integration address}Use the value displayed on the page.
Log on to your DNS provider and change the domain DNS record to the CNAME record shown above.
If the original record is an A record that points to the origin IP address, change it to a CNAME record.
If the original record is already a CNAME record, such as one pointing to a CDN, change it to the ESA integration address.
NoteIf the domain already has an A record or CNAME record with the same name, delete the old record before adding the new one. Otherwise, a DNS resolution conflict occurs.
Some DNS providers do not allow CNAME records directly on root domains, such as
example.comwithoutwww. If your DNS provider has this restriction, contact technical support for assistance.
After you configure the record, click Complete Integration.
The system verifies that the CNAME record points to the ESA edge. Integration is complete after verification succeeds.
Expected results
After CNAME verification succeeds, the page displays the Integration Successful status, and the domain is formally integrated with the ESA edge.
Integration complete
After CNAME verification succeeds, the ESA Embed page displays the Integration Successful status. When visitors access your website, traffic passes through ESA edge nodes, which automatically inject AI components such as smart customer service before returning the response. The traffic path is as follows:
Verify the integration
Open your website in a private browser window.
Confirm that the smart customer service floating icon appears in the lower-right corner of the page.
Click the icon to verify that the conversation feature works.
If the smart customer service icon does not appear, wait 2 to 5 minutes and then refresh the page. Edge caches require time to take effect.
After integration is complete, you can enable features in the console:
Feature | Description |
Provides visitors with 24/7 AI question-and-answer services based on website content and the knowledge base. | |
Collects contact information for potential customers from customer service conversations and web pages. |
How integration works
Zero-interruption switching
Before integration: visitors access your origin directly.
After integration: ESA proxies your traffic and automatically injects the Website AI Suite.
After integration, visitor requests first pass through ESA edge nodes, which provide HTTPS certificates and global acceleration. ESA retrieves the original web page content from your origin, injects components such as smart customer service, and returns the response to visitors. Your origin requires no changes.
Why is access unaffected throughout?
Period | Website status | Reason |
During Steps 1 and 2 | Normal access | The domain CNAME record has not been switched, so visitors still access the origin directly. |
After the CNAME switch | Normal access | The edge certificate is ready, so visitors access the website through ESA nodes and HTTPS works normally. |
Why the process has three steps
If you point a domain CNAME record to ESA before the edge certificate is ready, your HTTPS website is downgraded to HTTP and visitors see a "Not secure" warning in their browsers. The three-step process verifies domain ownership first, completes certificate issuance second, and guides you to switch the CNAME record last. The edge certificate is ready at the moment of the switch, so the website remains on HTTPS and the service does not degrade.
FAQ
Will my website be interrupted during integration?
No. The three-step guide ensures that domain verification and certificate issuance finish before you switch the CNAME record. At the moment of the CNAME switch, the ESA edge already has the certificate and the TLS handshake succeeds immediately, so visitors are not affected. For more information, see Quick start: add a domain name to ESA.
What happens when the certificate expires?
An ESA edge certificate is a Let's Encrypt DV certificate that is valid for three months. The system automatically starts renewal 30 days before expiration. No action is required, and renewal does not affect normal website access.
Automatic renewal mechanism: After the domain completes the CNAME switchover (Step 3), the ESA edge node directly responds to the CA's HTTP-01 validation requests, so you do not need to configure DNS records again. We recommend that you keep the _acme-challenge CNAME record configured in Step 2 as a fallback. Even if it is accidentally deleted, renewal does not fail, because ESA edge HTTP validation can complete independently.
For more information, see DCV hosting (automatic issuance and renewal of free certificates).
About the DCV CNAME record and automatic certificate renewal
The _acme-challenge CNAME record has two roles in the integration process:
Initial issuance: When you configure the record in Step 2, the domain has not been switched to ESA. The CA completes DNS-01 domain control validation through this CNAME record.
Subsequent renewal: After Step 3 is complete and the domain CNAME record points to the ESA edge, ESA edge nodes can intercept HTTP-01 validation requests from the CA and complete renewal automatically. At this point, the
_acme-challengerecord is no longer required for renewal.
(Recommended) After Step 3 is complete, keep the _acme-challenge CNAME record. Keeping it provides a fallback DNS-01 validation path in extreme scenarios, such as when ESA edge HTTP validation is temporarily unavailable. Renewal does not fail if the record is accidentally deleted, because ESA edge HTTP validation can complete independently, and the record does not affect normal website access.
For more information, see DCV hosting (automatic issuance and renewal of free certificates).
Do not configure the Step 3 integration CNAME before certificate issuance completes. If traffic reaches the ESA edge before the certificate is deployed, the TLS handshake fails and your website becomes unreachable. The system displays the Step 3 guide only after the certificate is ready, so follow what the page actually shows.
Can I change the origin address after integration?
Yes. Change the origin address in the instance settings in the console. The ESA edge uses the new origin address to retrieve web page content after the change. This does not affect the end-user experience.
What happens if I disable ESA integration?
After you disable or remove ESA integration, the website remains accessible, but Website AI Suite features no longer take effect. To exit ESA integration, follow these steps:
Disable ESA integration in the console.
Change the domain CNAME record back to the origin IP address as an A record, or back to the original CDN address.
(Optional) Delete the TXT verification record (
_esaauth) and the DCV CNAME record (_acme-challenge). Deleting them does not affect website access.
Can I integrate a website that uses HTTP?
Yes. After ESA Edge Integration, visitors access the domain over HTTPS, which ESA provides, and ESA retrieves content from the origin over HTTP. The website automatically upgrades to HTTPS after integration.
What do I need to do if my origin is upgraded to HTTPS after integration?
If you deploy an HTTPS certificate on the origin after integration, contact technical support to switch the ESA origin-fetch protocol to HTTPS for end-to-end encryption. If you do not switch the protocol, ESA continues to retrieve content over HTTP and the website remains accessible.
If the origin closes HTTP port 80 after it is upgraded to HTTPS, ESA receives a connection refused error (502) when retrieving content over HTTP. Keep HTTP port 80 available on the origin, or contact technical support to switch the origin-fetch protocol.
Can one domain be integrated with multiple WAIS instances?
No. A domain can be integrated with only one WAIS instance. To switch instances, first remove the domain binding from the original instance, and then integrate it with the new instance.
Can I integrate a domain that already uses CDN acceleration with ESA?
Yes. ESA Edge Integration includes global node acceleration. After integration, the domain is accelerated through ESA edge nodes, providing the same effect as the original CDN and additional capabilities such as AI smart customer service.
In Step 3, change the domain CNAME record value from the original CDN address to the ESA integration address shown on the guide page. After the change, the original CDN service stops accelerating traffic, which is then routed through ESA edge nodes.
After integration, the system automatically probes the origin address for origin fetches. If the probe identifies the original CDN address, the website remains accessible and usage is not affected.
To change the origin address to the actual origin for faster access, contact technical support for assistance.
What should I do if CNAME verification keeps failing?
Confirm that the CNAME record value exactly matches the value shown on the guide page. The value is case-sensitive.
Use an online DNS lookup tool, such as the Alibaba Cloud Website O&M Detection Platform, to check whether the CNAME record has taken effect. You can also use the
nslookupordigcommand.Wait for the DNS cache to expire based on the TTL, clear the local DNS cache, and try again.
If verification still does not pass after 30 minutes, contact technical support.