Help Center/ Domain Name Service/ Service Overview/ Functions/ Private DNS Resolution
Updated on 2026-07-10 GMT+08:00
View PDF
Share

Private DNS Resolution

What Is Private DNS Resolution?

Private DNS resolution translates domain names like ecs.com and their subdomains used within one or more VPCs to private IP addresses (such as 192.168.1.1). With private DNS resolution, ECSs within a VPC can communicate with each other using private domain names and access cloud services, such as OBS and SMN, over a private network.

Figure 1 shows how a private domain name within a VPC is resolved by a private DNS server.

Figure 1 Process for resolving a private domain name

When an ECS in a VPC requests access to a private domain name, the private DNS server directly returns the private IP address mapped to the domain name.

VPC-based private DNS resolution provided by DNS:

  • Allows you to create custom private domain names in your VPCs.
  • Allows you to associate one or more VPCs with a private zone.
  • Provides private DNS servers within a VPC subnet to respond to DNS queries for private domain names and cloud services such as OBS and SMN. It mitigates the risk of DNS spoofing by preventing queries from being exposed to external networks.

Scenarios

Private DNS resolution is applicable to the scenarios below.

You can plan hostnames based on ECS locations, usages, and account information, use hostnames to create private zones for the ECSs, and add record sets. This helps you manage ECSs more easily.

For example, if you have deployed 20 ECSs in an AZ, 10 for website A and 10 for website B, you can plan their hostnames (private domain names) as follows:

  • ECSs for website A: weba01.region1.az1.com – weba10.region1.az1.com
  • ECSs for website B: webb01.region1.az1.com – webb10.region1.az1.com

After you configure the hostnames, you will be able to quickly determine the locations and usages of ECSs during routine management and maintenance.

For details, see Configuring a Private Zone for an ECS.

As the number of Internet users is continuously increasing, a website or web application deployed on a single server can hardly handle concurrent requests during peak hours. A common practice is to deploy the website or application on multiple servers and distribute the load across the servers.

These servers are in the same VPC and communicate with each other using private IP addresses that are coded into internal APIs called among the servers. If one of these servers is replaced, its private IP address changes. As a result, you need to change this IP address in the APIs and re-publish the website. This poses challenges for system maintenance.

If you create a private zone for each server and configure record sets to map their private domain names to the private IP addresses, the servers can communicate with each other using private domain names. When you replace any of the servers, you only need to change the private IP address in the record set, instead of modifying the code.

Figure 2 illustrates such use of private zones.

Figure 2 Configuring private zones for ECSs

ECSs and RDS instances are in the same VPC.

  • ECS0: primary service node
  • ECS1: public service node
  • RDS1: service database
  • ECS2 and RDS2: backup service node and backup database

When ECS1 becomes faulty, ECS2 must take over. However, if no private zones are configured for the two ECSs, you need to change the private IP addresses in the code for ECS0. This will interrupt services, and you will need to publish the website again.

Now assume that you have configured private domain names for the ECSs and have included their private domain names in the code. If ECS1 becomes faulty, you only need to change the DNS records to direct traffic to ECS2. Services are not interrupted, and you do not need to publish the website again.

For more details, see Configuring Private Domain Names for ECSs for Smooth ECS Switchover.

The comparison between private and public DNS servers is as follows:

  • If a public DNS server is configured for VPC subnets, DNS queries from ECSs in that VPC to cloud resources will be resolved over the Internet.

    The ECSs access Huawei cloud services such as OBS and SMN over the Internet. This increases the network latency and reduces access speed.

    Steps 1 to 10 on the right of Figure 3 show the resolution process.

  • If a Huawei Cloud private DNS server is configured for the subnets, the private DNS server directly resolves the queries.

    When the ECSs access the Huawei cloud services, the private DNS server returns the private IP addresses of these cloud services, instead of routing queries over the Internet. This reduces network latency and improves access speed.

    Steps 1 to 4 on the left of Figure 3 show the resolution process.

    To make your ECSs accessible within the private network, change their default DNS servers to Huawei Cloud private DNS servers. For details, see How Do I Change Default DNS Servers of an ECS to Huawei Cloud Private DNS Servers?

Figure 3 Accessing cloud services

Advantages

  • Easy access to cloud resources

    You can create private zones for your ECSs to allow them to communicate with each other and with other resources within the associated VPCs. Traffic is routed within your internal network. This reduces network latency and improves security.

    For more details, see Configuring a Private Domain Name for an ECS.

  • Secure isolation of core data

    A private DNS server provides domain name resolution for ECSs carrying core data. You do not need to bind EIPs to these ECSs. This enables secure, controlled access to such data.

Functions

Table 1 Functions related to private DNS resolution

Function

Description

Private zone

A private zone hosts a private domain name and record sets for this domain name for domain name resolution. It is applied only to its associated VPCs. DNS allows you to create, modify, delete, and view private zones, associate private zones with VPCs, and disassociate private zones from VPCs.

  • Private zones can be created without registration.
  • Each private zone must be unique in its associated VPC.

For details, see Overview of Private Domain Name Resolution.

Associating a private zone with or disassociating it from a VPC

You can associate a private zone with a VPC or disassociate it from a VPC.

For details, see Associating a VPC with a Private Zone and Disassociating a VPC from a Private Zone.

Record set

A record set is a collection of resource records that belong to the same domain name. A record set defines the record set type and value of a domain name. You can add A, CNAME, MX, AAAA, TXT, PTR, and SRV record sets for your private zones. You can also modify, delete, and view record sets.

For details, see Overview.

Wildcard DNS record set

You can add a wildcard record set with its name set to an asterisk (*) to match one or more levels of undefined subdomains. DNS provides resolution services for the subdomains.

For details, see Configuring a Wildcard DNS Record Set.

TTL

TTL specifies how long a local DNS server can cache record sets. It is measured in seconds. The TTL value ranges from 1 to 2147483647.

Helpful Links

For details about how to configure a private zone for an ECS, see Configuring a Private Zone for an ECS

Parent Topic: Functions