Private DNS resolution for ECS instances-Elastic Compute Service(ECS)-阿里云帮助中心

Within the same VPC, you can use private domain names to communicate with and access services on ECS instances instead of using IP addresses. This method enhances security and isolation by keeping traffic separate from the public internet. The private domain name feature for ECS instances lets you assign private domain names to instances and automatically manages their DNS records, eliminating manual updates.

Private domain names for ECS instances

A private domain name is an internal domain name assigned to an ECS instance in a VPC for identification and access within that VPC. The DNS resolution service generates these domain names and resolves them to IP addresses. This feature relies on Private DNS, which uses the system-assigned service addresses 100.100.2.136 and 100.100.2.138.

Use cases

Hostname management: Configure hostnames based on IP addresses or instance IDs to access ECS instances by hostname within a VPC, simplifying daily host management.
Cloud service instantiation: Services deployed in the cloud often need to communicate with each other. By using private DNS resolution, you can generate an authoritative domain name within the VPC for each cloud service. This domain name resolves to the private IP address of a specific ECS instance, providing a stable endpoint for inter-service communication.

Note

If you require more advanced DNS configurations, such as DNS forwarding or recursion, you can use Private DNS. For public DNS resolution, Alibaba Cloud provides Alibaba Cloud DNS, a secure, fast, and stable authoritative DNS service.

Private domain name structure

A private domain name for an ECS instance consists of four levels separated by periods (.). Examples include i-8ps2h6dsc74cuktb****.ap-southeast-3.ecs.internal and ip-172-16-0-89.ap-southeast-3.ecs.internal. The components are as follows:

Top-level domain (.internal): The internal domain for the ECS private network.
Second-level domain (.ecs): The product identifier for ECS.
Subdomain (.[regionID]): The ID of the region where the instance is located. For example, if you select the Malaysia (Kuala Lumpur) region, the region ID is ap-southeast-3. For more information about region IDs, see Regions and zones.
Host identifier: Points to a specific ECS instance. ECS supports IP address-based hostnames and instance ID-based hostnames:
- IP address-based hostname: A hostname in the format of the instance's primary private IPv4 address, such as ip-172-16-0-89 (for an instance with the primary private IPv4 address 172.16.0.89).
- Instance ID-based hostname: The ID of the ECS instance serves as the hostname, such as i-8ps2h6dsc74cuktb****. An instance ID-based hostname is required for IPv6 communication.

Private DNS record types

The DNS resolution service stores mappings between domain names and IP addresses. When you access a domain name, the DNS resolution service resolves it to the corresponding IP address. Private DNS resolution for ECS instances supports the following four record types:

Record type	Description	Generated private domain name	Resolution example	Use cases
DNS resolution (A record) from an IP address-based hostname to the primary private IPv4 address	Maps the generated IP address-based private domain name to the primary private IPv4 address of the instance.	`ip-[primary-private-ipv4-string].[regionID].ecs.internal`	`ip-192-168-1-1.region-name.ecs.internal` resolves to `192.168.1.1`	Service access testing: Mapping an IP address-based hostname to its IPv4 address makes the IP address visible in the domain name, which is useful for testing.
DNS resolution (A record) from an instance ID-based hostname to the primary private IPv4 address	Maps the generated instance ID-based private domain name to the primary private IPv4 address of the instance.	`[instanceID].[regionID].ecs.internal`	`i-bp1hs9xdprd7xq4p****.region-name.ecs.internal` resolves to `192.168.XX.XX`	Automated deployment and management: The IP address of an ECS instance can change due to frequent operations. DNS resolution based on an instance ID-based hostname automatically binds the latest IP address to the hostname. This simplifies configuration management and operations.
DNS resolution (AAAA record) from an instance ID-based hostname to the primary private IPv6 address Note: You can select this option only if an IPv6 address is assigned to the instance.	Maps the generated instance ID-based private domain name to the IPv6 address of the instance.	`[instanceID].[regionID].ecs.internal`	`i-bp1hs9xdprd7xq4p****.region-name.ecs.internal` resolves to `2408:XXXX:17:8aff:7833:3724:XXXX:XXXX`	IPv6 network connectivity: When a host or service supports both IPv4 and IPv6, an AAAA record lets IPv6-enabled clients connect by using IPv6 addresses. This takes advantage of the larger address space and improved communication efficiency of the IPv6 network.
Reverse DNS resolution (PTR record) from a primary private IPv4 address to an IP address-based hostname	Maps the primary private IPv4 address of the instance to the generated IP address-based private domain name.	`ip-[primary-private-ipv4-string].[regionID].ecs.internal`	`192.168.0.1` resolves to `ip-192-168-0-1.cn-hangzhou.ecs.internal`	Spam filtering: Many email servers use reverse DNS to verify the legitimacy of the sending server. If a reverse lookup fails to resolve an IP address to a domain name, email servers may mark the email as spam or reject it. Log analysis and tracking: In network security and system administration, reverse DNS lookups can convert IP addresses into more understandable domain names. This facilitates analysis and source tracking in log files.

Limitations

Private domain names for ECS instances are system-generated. Custom domain names are not supported.
Private domain names are effective only within a single VPC. Cross-VPC communication using private domain names is not supported.
Private domain names resolve only to the primary private IP address of the primary network interface, not to secondary private IP addresses.
Each ECS instance in a VPC has a DNS query threshold of 5,000 queries per second (QPS). If an instance's peak QPS exceeds this limit, throttling may occur, and the 99.99% availability SLA is not guaranteed.

Private domain name communication

Step 1: Enable the DNS hostname feature

Enabling the DNS hostname feature for a VPC controls the private DNS resolution feature for ECS instances. After you enable this feature for a VPC, the private domain names of its ECS instances become effective. The DNS resolution service then creates a built-in authoritative zone in the format [regionID].ecs.internal. For example, if you create a VPC in the Malaysia (Kuala Lumpur) region and enable the DNS hostname feature, a built-in authoritative zone named ap-southeast-3.ecs.internal is created by the service. This domain name is effective only within this VPC. For more information, see Private domain names in VPCs.

Important

Private DNS resolution settings for an ECS instance take effect only after you enable the DNS hostname feature for the VPC.

Log on to the VPC console.
In the top navigation bar, select the region where the target VPC is located.
On the VPC page, click the ID of the target VPC. In the Basic Information section, enable DNS hostname.

Step 2: Configure private DNS resolution

You must configure the private DNS resolution records (mappings between private domain names and IP addresses) for each ECS instance. You can configure these mappings when you create an instance or modify an existing one based on your requirements. The following sections provide example procedures.

For new instances

Note

You can also specify parameters related to PrivateDnsNameOptions when you call the RunInstances operation to create multiple instances at a time and configure private DNS resolution for the instances.

Procedure

Go to the instance buy page.
Click the Custom Launch tab.
Configure settings such as the billing method, region, instance type, and image.

For a detailed explanation of each parameter, see Parameters.
At the bottom of the page, expand Advanced Options (Optional) and configure Private DNS Records.

Based on your business scenario, select the checkboxes of the required mappings between private domain names and IP addresses. You can select multiple checkboxes. For more information about the resolution records, see Private DNS record types.

For existing instances

Note

You can call the ModifyInstanceAttribute operation to modify instance attributes and specify parameters related to PrivateDnsNameOptions to configure private DNS resolution for an instance.

Procedure

Go to ECS console - Instances.
In the upper-left corner of the page, select a region and resource group.
Find the target ECS instance and click the instance ID to go to the instance details page. In the All Operations column, choose > Instance Properties > Modify Instance Properties. The Modify Instance Properties dialog box appears.
Based on your business scenario, select the checkboxes of the required mappings between private domain names and IP addresses. You can select multiple checkboxes. For more information about the resolution records, see Private DNS record types.
Click OK to complete the configuration of private DNS resolution for the ECS instance.

Step 3: Verify the configuration

You can verify that private DNS resolution is working by running commands on the configured ECS instance or on another instance within the same VPC. The commands vary by operating system, as shown in the following examples:

Linux instances

The host command is a utility in Linux for querying Domain Name System (DNS) information. This command lets you find the IP address for a domain name and, through a reverse lookup, find the domain name for an IP address.

Install the host command: The host command is not included by default on Linux instances. You must run the sudo yum install bind-utils command to install it.
Query example:

Note
The following instance information is used in this example. You must replace the IP addresses and instance ID with your actual values.

Instance ID: i-8psi44j4o4yqoh2b****

Region ID: ap-southeast-3

IPv4 address: 172.16.0.89

IPv6 address: 240b:XXXX:41:b200:1ca9:f9bb:ae4:1ea0
1. Connect to the Linux instance.
  
  For more information, see Connect to a Linux instance by using Workbench.
2. Based on the enabled private DNS record type, run the corresponding host command to query DNS information.
  - Look up the IP address that corresponds to the IP address-based domain name (DNS resolution (A record) from an IP address-based hostname to the primary private IPv4 address):
```
host ip-172-16-0-89.ap-southeast-3.ecs.internal
```
  - Look up the IP address that corresponds to the instance ID-based domain name (DNS resolution (A record) from an instance ID-based hostname to the primary private IPv4 address):
```
host i-8psi44j4o4yqoh2b****.ap-southeast-3.ecs.internal
```
  - Look up the IPv6 address that corresponds to the domain name (DNS resolution (AAAA record) from an instance ID-based hostname to the primary private IPv6 address):
```
host -t AAAA i-8psi44j4o4yqoh2b****.ap-southeast-3.ecs.internal
```
  - Perform a reverse DNS lookup to query the domain name generated from the IP address-based hostname associated with the IP address (Reverse DNS resolution (PTR record) from a primary private IPv4 address to an IP address-based hostname):
```
host 172.16.0.89
```

Windows instances

The nslookup command is a pre-installed Windows tool for querying DNS records.

Query example:

Note
The following instance information is used in this example. You must replace the IP addresses and instance ID with your actual values.

Instance ID: i-8ps2h6dsc74cfy02****

Region ID: ap-southeast-3

IPv4 address: 172.16.0.91

IPv6 address: 240b:XXXX:41:b200:1ca9:f9bb:ae4:1e9a
1. Connect to the Windows instance.
  
  For more information, see Connect to a Windows instance by using Workbench.
2. Run the corresponding nslookup command based on the enabled private DNS resolution record to query DNS information.
  - Look up the IP address that corresponds to the IP address-based domain name (DNS resolution (A record) from an IP address-based hostname to the primary private IPv4 address):
```
nslookup ip-172-16-0-91.ap-southeast-3.ecs.internal
```
  - Look up the IP address that corresponds to the instance ID-based domain name (DNS resolution (A record) from an instance ID-based hostname to the primary private IPv4 address):
```
nslookup i-8ps2h6dsc74cfy02****.ap-southeast-3.ecs.internal
```
  - Look up the IPv6 address that corresponds to the domain name (DNS resolution (AAAA record) from an instance ID-based hostname to the primary private IPv6 address):
```
nslookup -type=AAAA i-8ps2h6dsc74cfy02****.ap-southeast-3.ecs.internal
```
  - Perform a reverse DNS lookup to query the domain name generated from the IP address-based hostname associated with the IP address (Reverse DNS resolution (PTR record) from a primary private IPv4 address to an IP address-based hostname):
```
nslookup 172.16.0.91
```

A successful verification means that other ECS instances in the same VPC can access the configured instance by its private domain name. You can run the ping <private-domain-name> command on these instances to test connectivity, for example, ping ip-172-16-0-91.ap-southeast-3.ecs.internal.

Important

To test IPv6 access, you must assign IPv6 addresses to both the test instance and the destination instance. For more information, see IPv6 communication.

More operations

Impact of operations on DNS resolution

Change the VPC for an instance

When moving an ECS instance that has private DNS resolution enabled, you must verify that the DNS hostname feature is also enabled for the destination VPC. For more information, see Change the VPC of an ECS instance.
Change the primary private IP address of an instance

Automatic remapping: If an instance's primary private IP address changes (for example, when you change the primary private IPv4 address of an instance), the private DNS resolution service automatically deletes the old DNS records and creates new ones mapping the IP-based hostname to the new address.
Release an instance

When you release an instance, the service deletes all of its DNS records from the VPC's built-in authoritative zone. You can no longer access the instance or its services by using a private domain name.

View DNS resolution settings

You can view the private DNS resolution settings of an instance on the instance details page. The following section provides an example procedure.

Note

You can also call the DescribeInstances operation to query the detailed information of an instance. The PrivateDnsNameOptions parameter in the response contains the private DNS resolution settings for the instance.

Go to ECS console - Instances.
In the upper-left corner of the page, select a region and resource group.
In the instance list, find the target ECS instance and click the instance ID to go to the instance details page. The Private DNS Records field displays the number of currently configured private DNS resolution records.
Hover over the number in the Private DNS Records field to view the instance's configured private domain name mappings.

Disable private DNS resolution

To disable private DNS resolution for an ECS instance, clear the corresponding checkboxes in the ECS console. For more information, see Step 2: Configure private DNS resolution.

To disable private DNS resolution for all ECS instances in a VPC, disable the DNS hostname for that VPC. After you do this, the service deletes the associated authoritative zone, all private domain names in the VPC become invalid, and requests using these names will no longer resolve. For more information, see Private domain names in VPCs.

Important

If your application uses private domain names instead of instance IP addresses to access resources, disabling the DNS hostname feature may prevent your application from accessing resources.