Website connection FAQ

Common questions about connecting websites to ESA, including NS and CNAME setup, service regions, DNS records, and troubleshooting.

Benefits of website connection

Alibaba Cloud ESA uses a website (root domain + all subdomains) as the management unit. Key benefits:

Centralized management and simplified operations
ESA uses a "website" as the management unit, containing a root domain and all its subdomains with their configurations. Unlike traditional providers that require adding subdomains individually, ESA lets you manage all root domains from a single page.
Configure once, apply to all subdomains
Within an ESA website, configuration changes such as DNS records, cache settings, or security rules automatically apply to all subdomains. This eliminates per-subdomain configuration and ensures uniform performance and security policies.
Efficient DNS management
ESA lets you configure and manage DNS records directly within the website, eliminating the need to switch between platforms.
Enhanced security
Connecting a root domain such as example.com centralizes security management. ESA provides DDoS protection and a Web Application Firewall (WAF), and these settings apply to all subdomains automatically.
Improved website performance
ESA routes requests through its globally distributed network to the nearest point of presence (POP), reducing load times. All subdomains within the website benefit from this acceleration automatically.
Easy monitoring and analysis
ESA provides real-time monitoring of access data, traffic, and performance metrics, helping you identify bottlenecks or security threats quickly.

We recommend connecting your website to ESA using a root domain (such as example.com) to manage DNS records, caching, and security from a single location.

Add a subdomain as a website

Note

The Entrance plan does not support adding a subdomain as a website. To use this feature, upgrade to a different plan.

Follow the Quick start guide to add api.example.com as a website to ESA using the NS setup.
After the website is added, go to the Overview page. ESA assigns two NS record values. You must add these two NS records at your domain's DNS provider.
Add two NS records at your domain's DNS provider. The following steps use Alibaba Cloud DNS as an example to show how to add NS records. The configuration process is similar for other DNS providers.
1. Log on to the Alibaba Cloud DNS console.
2. On the Public Zone page, find the root domain example.com and click Settings in the right-side column.
3. Click Add Record, set Record Type to NS, set Hostname to api, and set Record Value to the NS record value assigned by ESA in Step 2. Keep the default values for other parameters.
4. Click OK to complete the process.
After you add the NS records at your DNS provider, return to the ESA console, go to the Overview page, and click Verify Nameserver. Once verified, you can connect the subdomain api.example.com to ESA as a website.

Can I change the domain name if I entered it incorrectly when adding a website?

ESA does not support changing a website's domain name after it is added. If you entered the domain name incorrectly (for example, by adding an extra www prefix), delete the current website and add it again with the correct domain name:

On the Websites page, find the target website and click Delete to remove the current website.
Deleting a website does not affect your purchased plans. The plan is automatically unbound from the website.
Click Add Website and enter the correct domain name.
In the plan selection step, switch to the Purchased Plans tab and select the previously unbound plan.

NS and CNAME differences

Service region differences

ESA allocates ESA points of presence (POPs) based on the service region you select. In most cases, you should choose a region based on the distribution of your users. For example, if your users are distributed worldwide, select the Global region. If your users are located only in the Chinese mainland, select the Chinese Mainland region.

Global: ESA provides global acceleration and protection for your website by assigning secure acceleration POPs from around the world. This region requires your website's domain to have an ICP filing for the Chinese mainland.
Chinese Mainland: ESA uses secure acceleration POPs located only in the Chinese mainland to accelerate and protect your services within the region. This is suitable when your online services cater only to users in the Chinese mainland. This region requires your website's domain to have an ICP filing for the Chinese mainland.
Global (Excluding the Chinese Mainland): ESA assigns global secure acceleration POPs outside the Chinese mainland. This region does not require an ICP filing.

Switch acceleration region

When you connect a website, you can select one of the following three acceleration regions: Global, Global (Excluding the Chinese Mainland), and Chinese Mainland. After the website is connected, you can switch the acceleration region if your business scope changes.

In the ESA console, select Websites, and in the Website column, click the target site.
On the website details page, click Overview in the left-side navigation pane.
On the Overview page, in the Basic Information section, click Change.
On the acceleration region selection page, select the region to which you want to switch and click Change to complete the process.

How do I block access from outside the Chinese mainland on ESA Free Edition?

ESA Free Edition does not support the Country/Region match condition in WAF custom rules. To use this match condition, upgrade to Basic Edition or higher.

As an alternative, you can switch the acceleration region to Chinese Mainland. After the switch, ESA deploys acceleration nodes only in the Chinese mainland, and requests from outside the Chinese mainland do not pass through ESA nodes. This blocks access from outside the Chinese mainland.

To select Chinese Mainland, make sure that your domain name has completed ICP filing. For the switching procedure, see the "Switch acceleration region" section in this topic.

Pause proxy acceleration

If you used the NS setup and want to pause proxy acceleration for the entire website without disabling it per record on the DNS > Records page, enable DNS Passthrough Mode. This does not affect your configurations on the DNS > Records page.

In the ESA console, select Websites, and in the Website column, click the target site.
On the website details page, click Overview in the left-side navigation pane.
On the Overview page, in the Site Actions section, click the switch to enable DNS Passthrough.
In the confirmation dialog box that appears, click OK.

Warning

When DNS Passthrough Mode is enabled, all traffic goes directly to your origin server, bypassing proxy acceleration. This action exposes your origin server's address. Proceed with caution.

Prevent cross-account additions

ESA allows a website to be active in only one account at a time.

In large enterprises, multiple accounts might add the same domain, causing service disruptions when different accounts activate the website sequentially. Use the Site Hold feature to prevent other accounts from adding your website and its subdomains.

Note

This feature is available only with the Enterprise plan.

In the ESA console, select Websites, and in the Website column, click the target site.
On the website details page, click Overview in the left-side navigation pane.
On the Overview page, in the Quick Actions section, click the switch to enable Site Hold.

DNS record import failures

A DNS record import may fail for the following reasons:

The new record conflicts with an existing record with the same name. DNS record conflict rules.
The file contains invalid characters. Use the file template provided on the page to fill in the DNS records.
The number of records to import in a single batch exceeds 100. You can import a maximum of 100 records at a time.

Benefits of using OSS

When you use Alibaba Cloud OSS as the origin server for ESA, traffic from OSS to ESA is automatically discounted compared with standard public data transfer from OSS. Alibaba Cloud OSS data transfer fees.

Reasons for DNS pre-configuration

With the NS setup, you delegate DNS resolution to ESA by changing your nameservers. Once the change takes effect, records at your original DNS provider become invalid. Replicate all necessary DNS records in ESA before modifying nameservers to prevent service interruptions.

Pre-verification for NS setup

To test the service online before switching to ESA, you can test different records:

For DNS-only records, you can run the dig command for your record and specify the nameserver assigned by ESA. This retrieves the DNS resolution from the specified ESA nameserver. Then, check that the resolved record value matches the one you configured in ESA. Example command: dig <DNS_only_record> @<ESA_assigned_NS>.
You can obtain the nameserver assigned to you by ESA from the Overview page in the console.
You cannot pre-test proxied records.

Pre-verification for CNAME setup

You can submit a ticket to obtain the IP address of a test point of presence (POP). Then, modify your local hosts file to force the accelerated domain, such as api.example.com, to point to the IP address of the test POP for verification.

Does ESA support resolving a domain directly to a node IP?

No. ESA is a domain-based acceleration service that supports only CNAME and NS connection methods. ESA uses an intelligent DNS scheduling system to automatically assign optimal acceleration nodes, and node IPs change dynamically based on network conditions. Resolving a domain directly to a specific node IP causes acceleration to stop working, and when the node changes, access failures will occur.

If you need a fixed IP, the provides a fixed IP feature based on Anycast.

Root vs. subdomain precedence

A website is connected for the root domain example.com, and a record for a.b.example.com is added to the website's records. The hostname is a.b.
A website is connected for the subdomain b.example.com, and a record for a.b.example.com is added to the website's records. The hostname is a.

If both of the preceding situations occur and both websites are active, when a client accesses a.b.example.com, ESA applies the configuration of the second website (b.example.com). This means the subdomain website's configuration takes precedence.

Acceleration type differences

In the business scenario configuration of a DNS record, ESA offers three business scenarios: Web, API, and Image/Video. If your selection does not perfectly match the business scenario, basic access functions are not affected. However, an accurate match improves resource scheduling and performance. Select the scenario that best fits your workload so ESA can assign optimal security and acceleration policies. You can adjust the business type at any time.

ESAWhat should I do if adding a website fails the review?

Cause

All domains added to ESA must undergo content moderation. If your domain fails to be added to ESA, it may be because your domain does not comply with ESA's connection rules. For more information about the standards and limits for adding domains to ESA, see Limitations.

Solution

On the Websites page, confirm that the domain's Status is Review Failed. Click Review Failed to view the reason for the failure.
Select the domain that failed the review, click the icon, and select Delete.
Based on the reason for the review failure, adjust your website content and add the domain again for review.

References

For information about how to add a domain, follow Add a website.

Domain name resolution

What is domain name resolution?
Cloud servers are assigned IP addresses, but domains like example.aliyundoc.com are easier to remember. Domain name resolution maps a domain to its server's IP address, allowing users to access your website through that domain.
Alibaba Cloud DNS is a secure, scalable authoritative DNS service that converts domains into IP addresses, routing users to the appropriate servers.
Why is domain name resolution necessary?
Domain name resolution is required for external users to access your website. After purchasing a server, deploying your site, registering a domain, and completing ICP filing, configure DNS resolution as the final step.
How do I perform domain name resolution?
Most domain registrars in the Chinese mainland have their own DNS servers. To get started, follow Quick start for Alibaba Cloud DNS.

A record

When you configure domain resolution, you must select a record type.

An A record, also known as an IP pointer, records the IP address that corresponds to a domain. In the following figure, the hostname is a domain prefix, such as www or mail, and the record value is the IP address of your website server.

To point multiple domains to the same server, configure each subdomain (second-level and third-level domains) to resolve to that server.

If you change servers, you must update all domain records individually. Using a CNAME record simplifies this process.

CNAME record

A CNAME record, also known as an alias record, resolves a domain to another domain. It is commonly used for mail resolution and Edge Security Acceleration.

For ESA acceleration, configuring a CNAME is critical. After enabling ESA and adding a domain, Alibaba Cloud ESA assigns a CNAME address. Point your domain to this address to forward requests to ESA POPs. Configure a CNAME record.

The domain to which a CNAME points must also ultimately point to an A record.

A record vs. CNAME record

An A record resolves a domain to an IP address, while a CNAME record resolves a domain to another domain.

For long-term hosting, use a CNAME record. It enables ESA acceleration and hides your origin IP address to reduce attack risk.

Principle of CNAME in ESA acceleration

ESA's main feature is caching origin server content on the POP closest to visitors for faster access. The How it works topic explains CNAME in ESA acceleration.

Handle DNS record conflicts

Conflict between CNAME and A records

You must first delete the A record and then configure the CNAME record. Deleting the A record does not affect website access because after you configure the CNAME record, client requests are sent to ESA, and then ESA accesses the origin server.

Conflict between CNAME and MX records

You can resolve the conflict between CNAME and MX records by using a URL forwarding record. Note that both the source and destination domains for the URL forwarding must have an ICP filing.

The DNS record configuration is as follows:

Type	Hostname	Resolution line	Value	TTL
URL	@	Default	example.com	10 minutes
MX	@	Default	demo.aliyundoc.com	10 minutes

What do I do if adding a website fails because the record name is on a blacklist?

Cause

The domain name or account was automatically added to a blacklist by the system due to suspected fraudulent activity. When you attempt to add a website, a message appears indicating that the record name is on a blacklist and the website cannot be added. After a domain or account is placed on the blacklist, other domain names under the same account may also be unable to be added as websites.

Solution

To request blacklist removal, submit the following materials:

A business description of the affected domain name, explaining its actual purpose and usage.

Valid compliance proof materials. The required materials differ based on your identity as the domain registrant:

Identity	Required materials
Registrant of the root domain	Business license or ICP filing documents
Non-registrant (using a subdomain only)	Compliance documents or credentials related to the services deployed on the subdomain

After you submit the materials and they pass verification, your request will enter the blacklist removal review process.

Why does an accelerated domain name return "Site not found" with HTTP status code 200?

Cause

The HTTP status code 200 indicates that the request successfully reached the origin server, meaning that the DNS resolution and ESA acceleration pipeline are working correctly. However, the web service on the origin server (such as aaPanel or Nginx) does not have the accelerated domain name configured as a site. As a result, the origin server cannot identify the domain name and returns a default page or the "Site not found" error page.

Solution

On the web hosting control panel of the origin server, add the accelerated domain name as a site configuration.
After the origin server site configuration is correct, purge the ESA cache and then verify access again.

How does changing DNS servers in NS setup mode affect subdomain resolution?

After you change the DNS servers for a primary domain name to the NS addresses assigned by ESA, note the following:

Original DNS records become invalid. The DNS records configured at your original DNS provider (such as Alibaba Cloud DNS) no longer take effect. The authoritative DNS for the domain is transferred entirely to ESA.
You must configure all necessary DNS records in ESA. All DNS records required by the domain must be recreated in the ESA console, including records for frontend pages, backend APIs, and all other subdomains. Any missing record causes the corresponding subdomain to fail resolution and become inaccessible.
NS setup mode does not require separating frontend and backend services to different domain names. However, make sure that all DNS records on the ESA side are complete and that SSL certificates are correctly configured.

For instructions on how to configure DNS records in ESA before modifying NS, see the "Reasons for DNS pre-configuration" section in this topic.

How do I verify that DNS records have taken effect in different regions?

To verify that DNS records have taken effect globally, use the Alibaba Cloud network diagnostic tool to test DNS resolution results from various locations worldwide.

If you find that local access is abnormal or the origin IP address changes frequently, the issue may be caused by the client's local DNS cache. Run the following command to flush the local DNS cache and then test again:

ipconfig /flushdns

For the complete list of flush commands for different operating systems, and for troubleshooting intermittent access failures caused by Local DNS caching, see the "Troubleshoot intermittent access failures for subdomains" subsection under "How do I check whether ESA acceleration has taken effect?" in this topic.

Do I need to upgrade the plan if DNS queries for the ESA domain or the origin domain exceed the quota?

Yes. If both the ESA accelerated domain name and the origin domain name experience DNS query volume exceeding the quota, you need to upgrade the DNS plan for both.

If the DNS query volume from clients to ESA exceeds the quota, it directly affects end-user access.
If the DNS query volume from ESA to the origin server exceeds the quota, it affects the establishment of origin fetch connections.

The two sides operate independently, but both require sufficient DNS query quota to ensure service availability. Upgrade the plan for each side separately as needed.