Help Center/ Domain Name Service/ FAQs/ DNS Overview/ Does a Private Zone Record Set Overwrite a Public Zone Record Set with the Same Name?
Updated on 2026-07-13 GMT+08:00
View PDF
Share

Does a Private Zone Record Set Overwrite a Public Zone Record Set with the Same Name?

If a public zone has a record set with the same name as the record set configured for a private zone, the two record sets remain independent and the private zone record set does not directly overwrite the public zone record set. However, when both are valid, the client preferentially resolves the private zone record set. This behavior is known as private zone hijacking.

The following table describes how a private zone record set with the same name as a public zone record set affects the local resolution result of the client.

Scenario

Private Zone Record Set

Recursive Resolution for Subdomains in the Private Zone

Local Resolution on the Client

Scenario 1

There is a record set with the same name as that of a public zone and the record set is applied.

Enabling or disabling this function does not affect the resolution result.

The private resolution result is returned.

Scenario 2

There is no record set with the same name as that of a public zone or there is such a record set but it is not applied.

Enabled

The public resolution result is returned.

Scenario 3

There is no record set with the same name as that of a public zone or there is such a record set but it is not applied.

Disabled

Resolution fails.

Take domain name example.com as an example. Add the following record set for the public zone:

www.example.com A 60 192.0.2.10
  • The following record set has been configured for the private zone and is applied: 
    www.example.com A 60 192.168.1.1

    In this case, if an ECS in the VPC associated with the private zone accesses www.example.com, 192.168.1.1 is returned, and the public zone resolution result is hijacked. This is scenario 1.

  • If there is no record set for www.example.com in the private zone or there is such a record set but it is not applied, and an ECS in the VPC associated with the private zone accesses www.example.com:
    • If recursive resolution for subdomains in the private zone is enabled, 192.0.2.10 is returned, which is scenario 2.
    • If recursive resolution for subdomains in the private zone is disabled, the resolution fails, which is scenario 3.

To allow the private zone to resolve both its configured record sets and any unconfigured record sets, enable recursive resolution for subdomains in the private zone.

Parent Topic: DNS Overview