Configuring Recursive Resolution for Subdomains

Scenarios

When creating a private zone, you can enable Recursive resolution proxy for subdomains. If this function is enabled and the requested subdomain has no record set configured, the DNS service does not directly return nxdomain (the resolution record does not exist). Instead, the DNS service forwards the request to the Internet for resolution, starting with root servers and progressively querying top-level domains (TLDs) and authoritative servers until the IP address mapped to the subdomain is found.

With this function enabled, the client sends only one request and then the DNS server can handle all the steps on behalf of the client. This improves resolution efficiency and user experience.

Constraints

• Recursive resolution for subdomains does not support querying DNS Resolver endpoint rules.
• A private zone with recursive resolution proxy for subdomains enabled cannot be associated with a VPC that contains CloudDCN or CloudPond subnets. Otherwise, resolution will fail.
• Recursive resolution for subdomains is only available in the following regions: CN North-Beijing4, CN North-Ulanqab1, CN North3, CN East-Shanghai1, CN East2, CN South-Guangzhou, CN Southwest-Guiyang1, CN-Hong Kong, AP-Bangkok, AP-Singapore, AP-Jakarta, AP-Manila, AF-Cairo, ME-Riyadh, AF-Johannesburg, TR-Istanbul, LA-Mexico City2, and LA-Sao Paulo1.

Resolution Process

The following uses example.com as an example to describe the resolution process after Recursive resolution proxy for subdomains is enabled.

1. Local query on an ECS client
   1. The ECS process first queries the local hosts file and the DNS cache of the operating system. If a matching record is found, the corresponding IP address is returned, and the process ends.
   2. If the cache is not hit, the DNS request is sent to the Huawei Cloud VPC's recursive DNS server based on the subnet's DNS configuration.

2. Private domain name resolution matching (authoritative resolution and core path)

   After receiving a request, the private DNS preferentially matches the private zones associated with the current VPC.

   • Scenario A: There is a record set configured for the subdomain www.example.com of the private zone.
     1. The private DNS matches the record set (ECS private IP address) and returns the result.
     2. The result is cached in the private DNS cluster and returned to the ECS. The entire process stays inside the VPC, ensuring that no public network traffic is involved.
   • Scenario B: There are no record sets configured for the subdomain of the private zone (recursive resolution proxy for subdomains triggered).

     Recursive resolution proxy for subdomains disabled: NXDOMAIN (domain name does not exist) is returned, and the resolution fails.

     Recursive resolution proxy for subdomains enabled: A recursive query on the Internet is automatically initiated. The complete process is as follows:

     1. Local cache query of the private DNS: The global public cache pool is queried. If a match is found within the TTL validity period, the corresponding public IP address is returned.
     2. Level-by-level iterative public DNS hierarchy (recursive resolution proxy for subdomains)
        1. A request is sent to the global root DNS server to obtain the address of the top-level domain server with the suffix .com.
        2. The top-level domain server is accessed to obtain the public authoritative DNS server address for example.com.
        3. The public authoritative DNS server is queried for www.example.com to obtain its public IP address.
     3. Result write-back and response

        The public IP address is returned level by level to the Huawei Cloud private DNS server. The private DNS server then caches the result and sends the public IP address back to the ECS client in the VPC, completing the resolution process.

3. Result return and caching mechanism
   • Local cache on the client (TTL)
   • The Huawei Cloud private DNS cluster in a geographic region caches the public DNS resolution result. Subsequent requests from the same VPC can reuse the cache, reducing the number of recursive queries.

   The priority of private zone record sets is always higher than the results returned through public recursive DNS resolution. As long as the corresponding subdomain record exists in the private zone, the private zone resolution is always preferred.

Recursive Resolution Example of a Subdomain in a Private Zone

For example.com, the following record sets have been added for the private zone:

When a1.example.com is accessed, the DNS server returns 1.2.3.4 based on the configured private zone record set.

When www.example.com is accessed, no record sets are configured in the private zone. In this case, the authoritative DNS server resolves the domain name and returns the result.

Enabling Recursive Resolution for Subdomains

You can enable or disable recursive resolution for subdomains when creating or modifying a private zone.

• Enabling recursive resolution for subdomains when creating a private zone

  When creating a private zone, you can select Recursive resolution proxy for subdomains to enable recursive resolution for subdomains.

  For details about how to create a private zone, see Creating a Private Zone.

  Figure 1 Enabling recursive resolution proxy for subdomains when creating a private zone
  
• Enabling or disabling recursive resolution for subdomains when modifying a private zone

  When modifying a private zone, you can enable or disable recursive resolution for subdomains, as shown in Figure 2.

  For details about how to modify a private zone, see Managing Private Zones.

  Figure 2 Enabling recursive resolution proxy for subdomains when modifying a private zone