How Do I Configure Nested CNAME Resolution in a Cloud CNAME Scenario?

What Is CNAME Nesting?

A CNAME record maps a domain name (alias) to another. When a cross-domain CNAME record is used in the resolution path of a domain name, CNAME nesting occurs. The resolution path is as follows: domain name A → CNAME of domain name B (configured in WAF) → WAF access IP address.

In the WAF access scenario, CNAME nesting usually refers to the following: A customer points the resolution of service domain name A to the CNAME record allocated by WAF to another protected domain name (domain name B) and attempts to use the CNAME record of domain name B to divert traffic of domain name A to WAF. WAF allocates a unique and independent CNAME record to each protected domain name. Using the CNAME record of another protected domain name is an incorrect nesting configuration and will cause a domain name to be inaccessible.

Correct Configuration Method

1. Each protected domain name is resolved to the CNAME record allocated by WAF.
   • Incorrect configuration: Domain name A → CNAME of domain name B (configured in WAF) When you access domain name A, a 404 error page is displayed.

     Cause: After the request reaches WAF, WAF cannot find the website configuration corresponding to domain name A in its protection configuration. As a result, WAF returns a 404 Not Found error.

   • Correct configuration: Domain name A → CNAME of domain name A (configured in WAF) Change the resolution of domain name A to the CNAME record allocated by WAF to domain name A. Then, the domain name can be accessed.
2. The domain name is resolved to the CNAME record itself, not the IP address corresponding to the CNAME record.
   • The CNAME record provided by WAF may change. That is, the WAF access IP address corresponding to the CNAME record may change with WAF scheduling.
   • You are advised not to query the IP address resolved by the CNAME record and then directly resolve the domain name to this IP address. Otherwise, when the access IP address corresponding to the CNAME record changes, the domain name resolution cannot be automatically updated. As a result, website access may be interrupted or protection may fail.
   • You are advised to resolve the domain name to the CNAME record. The DNS resolution system of WAF automatically returns the current valid access IP address to ensure that the resolution configuration is synchronized with WAF scheduling.

Procedure

1. On the WAF console, add websites to be protected for all domain names, such as domain names A and B, and obtain the CNAME records for each domain name. For details, see Adding Your Domain Name to WAF.
2. Contact the DNS provider of your domain name and point each domain name to the CNAME record allocated by WAF (set the record type to CNAME). For details, see Adding Your Domain Name to WAF.
3. Optional: Run the nslookup command to query the domain name resolution result and check whether the CNAME resolution takes effect.