Getting Started with DNS-Edge Security Acceleration(ESA)-阿里云帮助中心

When your website is connected to ESA by using the NS or CNAME method, you must add DNS records to ensure that your domain name resolves correctly and to accelerate access.ESA provides two methods to add DNS records: batch import and manual input. This topic describes how to quickly add DNS records.

Prerequisites

Before adding DNS records, ensure you meet the following requirements:

You have connected your website to ESA using the NS or CNAME method.
You have permission from your DNS provider to add or modify DNS records.
You understand the basic concepts and uses of common DNS record types, such as A, CNAME, MX, and TXT.

Usage notes

When you add or modify a DNS record, check the values for the hostname and the origin:

The hostname cannot match the hostname or origin of an existing DNS record, and it cannot be an origin in an origin pool.
The origin cannot match the hostname of an existing DNS record.
CNAME record value specification — The Record Value field for a CNAME record must contain the actual origin address, for example, an OSS external domain name or an ECS public IP address. Do not enter the acceleration domain name itself or a value that is the same as the hostname. Entering an incorrect value causes a configuration error or a DNS resolution loop.
Record type conflicts — If an A record already exists for the same hostname, adding a CNAME record for that hostname results in a conflict error. You must delete the existing A record before adding the CNAME record. The same rule applies when you point a hostname to a Global Accelerator (GA) instance domain name: delete the existing A record for that hostname before you add the CNAME record that points to the GA domain name.
Note
ESA proxy acceleration operates at the hostname level. You cannot configure direct access or traffic splitting for specific URLs, IP addresses, or clients (such as mobile apps) under the same domain name. If you need some traffic to bypass the proxy and connect directly to the origin, configure a separate domain name and point it to the origin IP address by using an A record.
Origin configuration save failure — If you cannot save the origin configuration in the ESA console, verify that you selected the correct Record Type. For example, if your origin is an IP address, select the A record type instead of CNAME.
Traffic differentiation by request origin is not supported at the DNS record level — The forms for adding and editing a record provide no field for a line, resolution route, region, or geography. A DNS record always returns its configured value regardless of where the request originates. As a result, you cannot use an ESA DNS record alone to accelerate overseas traffic only while mainland China traffic goes directly to the origin. To achieve that result, use one of the following methods:
- For a site connected by using the CNAME method, configure geography-based resolution at your original DNS provider. For example, resolve the mainland China route to the origin IP address and the overseas route to the CNAME address provided by ESA. This configuration is performed outside the ESA console.
- For a site connected by using the NS method, use Origin Rules to schedule origin requests by region. Go to the site and choose Rules > Origin Rules. Rule conditions support matching by continent, country or region, and province or state. A matched rule can rewrite the origin HOST, DNS record, SNI, origin protocol, and port. If you use DNS resolution only and Proxy Status is turned off, requests do not pass through ESA nodes and origin rules do not take effect. Turn on proxy acceleration first, and then configure an origin rule to schedule traffic by region.
Note
An Origin Pool distributes traffic across multiple origins by weight only. It provides no geographic match condition and cannot split traffic by region, so do not treat it as a substitute for origin rules.
Proxy acceleration is not available for verification records — The Proxy Status switch is displayed only for A, AAAA, and CNAME records. MX, TXT, NS, SRV, and CAA records do not display the switch and always resolve in DNS-only mode. When you add an MX or TXT record to verify a domain name for a service such as enterprise email, submit the record with its default settings. Proxy acceleration cannot be enabled for these record types, so no switch needs to be turned off.

Method 1: Bulk import DNS records

To add multiple records, you can import them in bulk by using a template. This method is ideal if you are migrating existing DNS records from another DNS provider to ESA. If you need to add a single record, see Manually add a DNS record.

In the ESA console, select Websites, and in the Website column, click the target site.
Select DNS > Records and click Import.

Select Import From Template and click Download Template. Edit the DNS record information in the template and save the file. Then, click Select File and choose the saved template.

DNS file import template

;hostname TTL IN record type record value

$ORIGIN example.com.

; A record
1.example.com.   600 IN  A   8.8.8.8

; AAAA record
2.example.com.   600 IN  AAAA		2400:cb00:2049:1::a29f:f9

; CNAME record
2.example.com.   600 IN  CNAME     example.com.

; MX record
4.example.com.    600 IN  MX	15 mailhost.example.com.

; TXT record
4.example.com.   600 IN  TXT	xxxxxxxxxxxxxxxxxxx

; NS record
4.example.com.    600 IN  NS	ns.example.com.

; SRV record
_sip._tcp.example.com.   600 IN  SRV	1 5 7001 srvhostname.example.com.

; CAA record
hostname.example.com.    600 IN  CAA	0 issue example.com

; CERT record
cert.example.com.	1	IN	CERT	0 0 0 VEVwQk5GWXlUR3RXVVZwc1RIcGFhMGh0UVhWUMQweHJFZENNM0JSVFROV2JVd3lWbFJOTkVSS1dnPT0=

; SMIMEA record
smimea.example.com.	1	IN	SMIMEA	12 12 12 436c6f7564666c61726520444e53

; SSHFP record
sshfp.example.com.	1	IN	SSHFP	12 12 436C6F7564666C61726520444E53

; TLSA record
tlsa.example.com.	1	IN	TLSA	12 12 12 436c6f7564666c61726520444e53

; URI record
uri.example.com.	1	IN	URI	12 12 "http://www.example.com/service"

On the Import page, review and adjust the record configurations.
By default, ESA provides only DNS resolution services. To enable ESA acceleration, turn on the proxy switch in the Proxy Status column.
Note
- For websites connected using the CNAME method, the proxy is enabled by default and the Proxy Status cannot be changed.
- For websites connected using the NS method, proxying can only be enabled or disabled for A, AAAA, and CNAME records.
For information about different use cases, see Use case descriptions.
After adjusting the DNS records, click OK.
(Optional) For websites connected using the CNAME method, follow the on-screen instructions to configure the CNAME record with your DNS provider after adding the record.

Method 2: Manually add a DNS record

To add a single record, enter its details manually. This method is ideal for new setups or for adding only a few records.

Example scenario

Assume your origin domain is example.com, and you want to accelerate web pages for the subdomain www.example.com by using a CNAME record. This example shows how to add the DNS record for this scenario.

Procedure

In the ESA console, go to Websites and click the target website in the Website column.
Select DNS > Records and click Add Record.

Enter the required parameters and click Next. For more information about record types and parameters, see Parameter descriptions for adding records.

Parameter	Description	Example value
Record Type	Select the record type.	`CNAME`
Hostname	The prefix of the subdomain. Supports lowercase letters, numbers, wildcards `*` (for wildcard domain records only), hyphens `-` (cannot be the first or last character), `@` (for root domain records only), and underscores `_` (supported at the start of TXT, CAA, CNAME, NS, and SRV records only when proxy acceleration is disabled). The maximum length is 63 characters.	`www`
Proxy Status	Turn on the toggle switch to enable proxy acceleration.	Enabled
Record Value	Select the type of record value.	Domain Name
Domain Name	Enter the origin domain name.	`example.com`
Origin Host	The default setting is Match Requested Domain Name, which is typically sufficient. If no origin rule is configured, ESA applies the following defaults: the origin host is determined by the HOST policy in the DNS record, the origin SNI matches the origin host value, and the origin protocol and port match the client's request. Origin Host is available only when the record type is CNAME and proxy acceleration is enabled. Its default value depends on the record value type: Match Requested Domain Name when the record value type is Domain, and Match Origin's Domain Name when the record value type is OSS or S3-compatible. When the record value type is Load Balancer or Origin Pool, this setting cannot be changed in this form and must be adjusted on the corresponding feature page. If your origin is an external domain name such as a Global Accelerator (GA) domain name and you encounter a `525` error or a similar SSL handshake error, try changing Origin Host from Match Requested Domain Name to Match Origin's Domain Name so that the origin request carries the origin domain name as its HOST. For finer-grained control over the HOST or SNI, configure Origin Rules instead.	Match Requested Domain Name
HTTP/HTTPS Ports	When proxy acceleration is enabled for the DNS record, the port configuration takes effect and ESA acceleration nodes only allow requests on the ports you configure. `HTTP` protocol supports ports `80`, `8080`, `8880`, `2052`, `2082`, `2086`, and `2095` by default. `HTTPS` protocol supports ports `443`, `8443`, `2053`, `2083`, `2096`, and `2087` by default. Except for ports `80` and `443`, you can disable the remaining default ports. If you need other ports, please upgrade to the Enterprise edition to enable the custom ports feature (note: the custom ports feature is mutually exclusive with mainland China network optimization and fixed IP features, and cannot be enabled simultaneously).	`8080`

ESA requires only that a hyphen (-) is not the first or last character of any label in a hostname. Hyphens elsewhere in a label are allowed, and ESA does not block CNAME verification records that contain hyphens. If your own infrastructure policy or your domain registrar prevents you from adding such a verification record, connect the site by using the NS method instead to bypass that verification step.

Select the Web use case and click OK. For information about different use cases, see Use case descriptions.
(Optional) For websites connected using the CNAME method, follow the on-screen instructions to configure the CNAME record with your DNS provider after adding the record.

Connection verification and activation

After adding DNS records, verify that your connection is active and understand the expected propagation time.

CNAME connection verification

Adding a DNS record in the ESA console alone does not affect access to your original domain. For a CNAME connection to take effect, you must also configure your DNS provider to resolve the domain to the dedicated CNAME address provided by ESA. Use an exact-match record, not a wildcard record. You can use the dig or ping command to verify that the domain resolves to an ESA node. If the resolution is not correctly configured, you may encounter the following issues:

530 errors when accessing the domain
Missing certificate binding entry in the ESA console
No traffic data displayed in the ESA console

NS connection propagation time

If you connected your website to ESA by using the NS method, you must update the NS records at your domain registrar to point to the name servers provided by ESA. Global propagation can take up to 48 hours. During this period, the console may temporarily show no traffic data, which is expected.

Configuration status anomaly troubleshooting

If your DNS records were previously configured correctly but the ESA console now shows a Pending status, the domain resolution has likely been modified to point to another service, such as WAF, preventing ESA from detecting your configuration. If you have configured DNS resolution only for overseas regions and the console shows Pending, but the resolution correctly points to an ESA overseas node, acceleration is working normally and performance is not affected.

Use cases

In the scenario configuration for DNS records, ESA provides 5 business scenarios. By selecting the scenario type that corresponds to your business scenario, you can dynamically assign a more suitable security acceleration policy to your domain name. You can edit records and adjust business types at any time in the console.

Use case	Description
Web	Suitable for accelerating websites with a mix of static content (small files) and dynamic content (API requests). Examples: personal blogs, small user-generated content (UGC) communities, and small independent e-commerce sites.
Large File Download	Ideal for large file distribution scenarios. Examples: software installation packages (apps, games, clients), patch updates, and firmware upgrades. Caching large files at the edge reduces origin load and improves download speeds.
Audio/Video On-Demand	Suitable for accelerating the distribution of on-demand audio and video content. Examples: short video playback and live stream replays.
API Acceleration	Designed for accelerating purely dynamic, API-based services that generally do not require caching. Examples: account password verification, order payment processing, log uploads, and real-time data synchronization.
AI Tokens	Optimized for AI model inference scenarios, accelerating high-frequency, small requests at the token level. Examples: streaming inference APIs for Large Language Models (LLMs), real-time token-level translation, and intelligent chatbot conversations. Edge acceleration reduces end-to-end latency for token requests.

Important

When using the Audio/Video On-Demand or Large File Download use cases, we recommend enabling resource abuse protection to prevent malicious resource consumption and avoid unnecessary costs.
When using the API Acceleration or AI Tokens use cases, the system automatically creates optimized configuration rule templates, which you can manually disable. These templates configure cache eligibility and enable smart routing. Note that smart routing is a separately billed feature.

FAQ

Can I import DNS records exported from another CDN?

No. ESA does not support importing CSV files exported from other CDN services because the record value formats differ. You must manually add records and update the CNAME values to the addresses provided by ESA.

Do I need to manually re-add DNS records that are already managed by ESA?

No. DNS records managed by ESA are automatically synchronized. You do not need to manually add these records again in your ESA DNS configuration.

How do I check the current connection configuration for my domain?

In the ESA console, go to DNS > Records. This page displays the current connection mode, business scenario (for example, API acceleration), and CNAME target for your domain. You can use this information to determine whether advanced features such as smart routing are enabled.

Why does my domain return a DNS_PROBE_FINISHED_NXDOMAIN error?

This error indicates a DNS resolution failure. Take the following steps:

Check that the domain name is spelled correctly.
Use the ping command to test network connectivity.

Which advanced architectures and third-party products can ESA work with?

Plan for the following scenarios:

DDoS protection: ESA already includes DDoS protection, so you usually do not need to configure it separately. If your business requires an Anti-DDoS service outside mainland China, resolve the domain name to the CNAME address provided by ESA, or to the CNAME address or IP address of the Anti-DDoS instance as your architecture requires.
Authoritative DNS high availability: Do not configure ESA and another DNS provider as the authoritative DNS for the same domain name at the same time. Two authoritative DNS services can return inconsistent resolution results. If you need high availability at the DNS layer, use a dedicated DNS hosting service as the single authoritative DNS and point its records to your ESA connection address.
Load Balancer: When you add a CNAME record, the record value type can be Domain, OSS, S3-compatible, Load Balancer, or Origin Pool. Load Balancer refers to the load balancer provided by ESA. The drop-down list dynamically pulls only the ESA load balancers that are configured under the current site, so Alibaba Cloud ALB instances never appear there. To send traffic to an Alibaba Cloud ALB, select the Domain type and enter the domain name provided by the ALB, or use an A or AAAA record with the IP address of the ALB.