Private DNS Resolution

What Is Private DNS Resolution?

Private DNS resolution translates domain names like ecs.com and their subdomains used within one or more VPCs to private IP addresses (such as 192.168.1.1). With private DNS resolution, ECSs within a VPC can communicate with each other using private domain names and access cloud services, such as OBS and SMN, over a private network.

Figure 1 shows how a private domain name is resolved by a private DNS server.

Figure 1 Process for resolving a private domain name
Click to enlarge

When an ECS in the VPC requests to access a private domain name, the private DNS server directly returns a private IP address mapped to the domain name.

Private zones allow you to:

Create custom private domain names in your VPCs.
Associate one or more VPCs with a private zone.
Use private domain names to access ECSs as well as OBS and SMN resources in the VPCs more quickly, preventing DNS spoofing.

Scenarios

Private zones are applicable to the following scenarios:

Managing ECS Host Names

You can plan host names based on the locations, usages, and account information of ECSs, and map the host names to private IP addresses, helping you manage ECSs more easily.

For example, if you have deployed 20 ECSs in an AZ, 10 for website A and 10 for website B, you can plan their host names (private domain names) as follows:

ECSs for website A: weba01.region1.az1.com – weba10.region1.az1.com
ECSs for website B: webb01.region1.az1.com – webb10.region1.az1.com

After you configure the host names, you will be able to quickly determine the locations and usages of ECSs during routine management and maintenance.

For detailed operations, see Configuring Private Domain Name Resolution for ECSs.

Keeping Your Website Up and Running Even While Your Server Is Being Replaced

As the number of Internet users is continuously increasing, a website or web application deployed on a single server can hardly handle concurrent requests during peak hours. A common practice is to deploy the website or application on multiple servers and distribute the load across the servers.

These servers are in the same VPC and communicate with each other using private IP addresses that are coded into internal APIs called among the servers. If one of these servers is replaced, its private IP address changes. As a result, you need to change this IP address in the APIs and re-publish the website. This poses challenges for system maintenance.

If you create a private zone for each server and configure record sets to map their private domain names to the private IP addresses, they will be able to communicate using private domain names. When you replace any of the servers, you only need to change the private IP address in the record set, instead of modifying the code.

Figure 2 illustrates such use of private domain name resolution.

Figure 2 Configuring private DNS for cloud servers
Click to enlarge

The ECSs and RDS instances are in the same VPC.

ECS0: primary service node
ECS1: public service node
RDS1: service database
ECS2 and RDS2: backup service node and backup database

When ECS1 becomes faulty, ECS2 must take over. However, if no private zones are configured for the two ECSs, you need to change the private IP addresses in the code for ECS0. This will interrupt services, and you will need to publish the website again.

Now assume that you have configured private zones for the ECSs and have included their private names in the code. If ECS1 becomes faulty, you only need to change the DNS records to direct traffic to ECS2. Services are not interrupted, and you do not need to publish the website again.

For more details, see Configuring a Private Domain Name for an ECS.

Accessing Cloud Resources

The comparison between private DNS and public DNS servers is as follows:

If a public DNS server is configured for subnets of the VPC associated with a private zone, domain name requests to access cloud resources from ECSs in the VPC will be directed to the Internet.
The ECSs access Huawei cloud services such as OBS and SMN over the Internet. This increases the network latency and reduces access speed.

Steps 1 to 10 on the right of Figure 3 show the resolution process.
If a Huawei Cloud private DNS server is configured for the subnet, the private DNS server directly processes the requests to access cloud services.
When the ECS accesses the Huawei cloud services, the private DNS server returns their private IP addresses, instead of routing requests over the Internet. This reduces network latency and improves access speed.

Steps 1 to 4 on the left of Figure 3 show the resolution process.

To make your ECS accessible within the private network, change the default DNS servers of the ECS to private DNS servers. For detailed operations, see How Do I Change Default DNS Servers of an ECS to Private DNS Servers Provided by the DNS Service?

Figure 3 Accessing cloud services
Click to enlarge

Product Advantages

Easy access to cloud resources
Your ECSs can communicate with each other and with other resources within VPCs using private domain names. Traffic is kept within your internal network, which reduces network latency and improves security.

For more details, see Configuring Private Domain Names for ECSs.
Isolation of core data
A private DNS server provides domain name resolution for ECSs carrying core data, enabling secure, controlled access to such data. You do not need to bind EIPs to these ECSs.

Functions

**Table 1** Private zone operations
Function	Description
Private zone	A private zone contains records that specify how you want the DNS service to respond DNS queries for a domain name and its subdomains within one or more VPCs. DNS allows you to create, modify, delete, and view private zones, associate private zones with VPCs, and disassociate private zones from VPCs. Private zones can be created without the need to register domain names. Each private zone must be unique in an associated VPC. For details, see Overview.
Associating a private zone with or disassociating a private zone from a VPC	You can associate a private zone with a VPC or disassociate a private zone from a VPC. For details, see Associating a VPC with a Private Zone and Disassociating a VPC from a Private Zone.
Record set	A record set is a collection of resource records that belong to the same domain name. A record set defines the resolution type and value of a domain name. You can add, modify, delete, or view A, CNAME, MX, AAAA, TXT, PTR, and SRV record sets for private zones. For details, see Overview.
Wildcard DNS record set	You can add record sets for all subdomains of a private domain name. DNS provides resolution services for all subdomains. For details, see Creating a Wildcard DNS Record Set.
TTL	TTL is short for time to live, which specifies how long a record set is cached on a local DNS server. It is measured in seconds. The TTL value ranges from 1 to 2147483647.