Domain Name Service. Product Description. Issue 03 Date HUAWEI TECHNOLOGIES CO., LTD.

Transcription

1 Issue 03 Date HUAWEI TECHNOLOGIES CO., LTD.

2 Copyright Huawei Technologies Co., Ltd All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written consent of Huawei Technologies Co., Ltd. Trademarks and Permissions and other Huawei trademarks are trademarks of Huawei Technologies Co., Ltd. All other trademarks and trade names mentioned in this document are the property of their respective holders. Notice The purchased products, services and features are stipulated by the contract made between Huawei and the customer. All or part of the products, services and features described in this document may not be within the purchase scope or the usage scope. Unless otherwise specified in the contract, all statements, information, and recommendations in this document are provided "AS IS" without warranties, guarantees or representations of any kind, either express or implied. The information in this document is subject to change without notice. Every effort has been made in the preparation of this document to ensure accuracy of the contents, but all statements, information, and recommendations in this document do not constitute a warranty of any kind, express or implied. Huawei Technologies Co., Ltd. Address: Website: Huawei Industrial Base Bantian, Longgang Shenzhen People's Republic of China support@huawei.com Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. i

3 Contents Contents 1 Basic Concepts DNS Domain Name Resolution Public Zone Private Zone Private DNS Server Record Set PTR Record Domain Name Format Domain Name Levels Resolution Line Project Application Scenarios Accessing and Using DNS How to Access DNS Related Services Change History... 8 Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. ii

4 1 Basic Concepts 1 Basic Concepts 1.1 DNS (DNS) provides highly available and scalable authoritative DNS services and domain name management services. It translates domain names or application resources into IP addresses required for network connection. By doing so, visitors' access requests are directed to the desired resources. Function The DNS service provides the following functions: Private zone Application Scenarios Enables you to flexibly customize private domain names in your VPCs. Allows one private zone to be associated with multiple VPCs for unified management. Provides private DNS servers to quickly respond to requests for accessing ECSs in VPCs as well as OBS and RDS resources, preventing DNS spoofing. Record management Provides stable, secure, and quick domain name resolution capabilities. Supports commonly used record types, such as A, AAAA, MX, CNAME, TXT, and NS. Supports reverse resolution, DKIM, and wildcard records. General DNS resolution Online and offline service management Multi-application deployment 1.2 Domain Name Resolution When users need to access servers on the Internet, IP addresses are required. However, it is hard to memorize IP addresses. Domain names easy to memorize are used to identify IP Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 1

5 1 Basic Concepts 1.3 Public Zone addresses. After registering a domain name, you get the right to use it but users cannot access the website, send or receive s using your domain name until the name is resolved. Domain name resolution is to map domain names to IP addresses. To access a website on the Internet, visitors only need to enter a domain name in the browser address bar, instead of an IP address. There are two types of domain name resolutions: Forward resolution: to translate domain names into IP addresses. If not specifically noted, domain name resolution mentioned in this document indicate forward resolution. Reverse resolution: to translate IP addresses into domain names based on PTR records. There are a large number of DNS servers on the Internet, constituting DNS domain namespaces. Each DNS server has its own domain name resolution responsibilities. Only when a DNS server cannot resolve a domain name itself, it forwards the request to another DNS server. Domain namespaces are managed by segment. That is, a large space is divided into several separately hosted zones. Each public zone is a part of the namespace that is administered by a particular DNS server. For example, a DNS server is configured on the cloud platform to resolve all domain names in the namespace example.com. Public zones are accessible to hosts on the Internet. 1.4 Private Zone A private zone is a namespace in which domain names are resolved by private DNS servers (see section 1.5 Private DNS Server). It records the route for a domain name to be accessed in one or more VPCs. Private zones are accessible only to hosts in specified VPCs. 1.5 Private DNS Server A private DNS server provides domain name services for VPC subnets. It resolves private domain names for cloud services and forwards requests for accessing public domain names to DNS servers on the Internet. 1.6 Record Set A record set is a collection of resource records of the same type in the same DNS zone. After you create a zone, you can expand the domain name or record its information by creating record sets, for example, of the A or CNAME type. The DNS service supports record sets of the following types: A, CNAME, MX, AAAA, TXT, SRV, NS, SOA, CAA (only in public zones), and PTR (only in private zones). Table 1-1 describes the application scenarios for each type of record sets. Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 2

6 1 Basic Concepts Table 1-1 Application scenarios for different types of record sets Record Set Type A CNAME MX AAAA TXT SRV NS SOA CAA PTR Application Scenario Maps domain names to IPv4 addresses. Creates domain name aliases. You can map multiple aliases to one domain name and thereby map them to the same host. Maps domain names to servers. Maps domain names to IPv6 addresses. Provides text information based on service requirements. A TXT record set is usually used to prevent junk mails in the SPF mechanism. Records services provided by servers. Specifies authoritative DNS servers of domain names. Specifies the master authoritative DNS servers for a domain name. You cannot create an SOA record set. It is generated by default. Specifies certification authorities (CAs) that issue HTTPS certificates for domain names to prevent the wrong certificate issuing. Maps IP addresses to domain names. 1.7 PTR Record A PTR record is used for reverse DNS lookup and resolves IP addresses into domain names. 1.8 Domain Name Format A valid domain name meets the following requirements: A domain name contains only specified characters in different languages, letters, digits, and hyphens (-) and cannot start or end with a hyphen. A domain name cannot start or end with a hyphen. A domain name label cannot exceed 63 characters. Every two labels are separated using a dot (.), and the total length of a domain name, including the dot added at the end by default, cannot exceed 254 characters. For example, example.com and are valid domain names. 1.9 Domain Name Levels Domain names are classified into the following levels: Root domain:. (a dot) Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 3

7 1 Basic Concepts Top-level domain: for example,.com,.net,.org, and.cn Second-level domain: subdomain names of the top-level domain names, such as example.com, example.net, and example.org Third-level domain: subdomain names of the second-level domain names, such as abc.example.com, abc.example.net, and abc.example.org The next level domain names are similarly expanded by adding prefixes on the left of the previous-level domain names. NOTE A domain name is segmented using dots (.). Each segment can contain letters, digits, and hyphens (-) and cannot start or end with a hyphen. A segment cannot exceed 63 characters. A domain name is not case-sensitive and does not exceed 254 characters, including the dot added at the end by default. The DNS service allows you to create a first-level subdomain in a zone, for example, abc.example.com in example.com and abc.example.com.cn in example.com.cn. You cannot create a second-level domain, for example, def.abc.example.com and def.abc.example.com.cn Resolution Line Usually, a DNS server only returns the same IP address to visitors of all types. While in crosscarrier network access, this would lead to bad user experience. To solve the problem, the DNS service in HUAWEI CLOUD offers resolution lines, which identify visitors based on carriers and geographical areas. After a visitor sends a domain name query request, the DNS server checks the source IP address and returns the IP address of the specified carrier. Specifically, when the visitor is a Unicom user, the DNS server will return an IP address of the Unicom server, which is also the case for China Telecom users. With this function, you can improve DNS resolution efficiency and speed up cross-carrier network accesses. The DNS service offers the following resolution line options: Default, China Telecom, China Mobile, China Unicom, Mainland China, and Global. NOTE Resolution lines are only applicable to public zones. You cannot use them for private zones and PTR records Project Projects are used to group and isolate OpenStack resources, including computing, storage, and network resources. Multiple projects can be created for one account. A project can be a department or a project team. In the DNS service, public zones are global-level resources, and private zones and PTR records are resources at the region level. Therefore, the system will isolate and manage private zones and PTR records based on projects. Before creating, querying, and configuring private zones or PTR records, you need to specify a region and project. Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 4

8 2 Application Scenarios 2 Application Scenarios Public Zone Private Zone General DNS resolution You can use public zones to access cloud resources, such as ECS, OBS, CDN, and WAF, with your own domains names. DomainKeys Identified Mail (DKIM) DKIM aims to address fraud, one of the most serious threats to the Internet. It works on the basis of key authentication. In DKIM, a key pair is generated, with the public key saved in a TXT record on the DNS server and the private key on the server sending s. An delivered to the destination server contains a private key signature. The destination server then obtains the public key from the TXT record and compares it with the private key. If the keys are inconsistent, the server considers the as spam. The signature cannot be forged. Therefore, DKIM is a perfect remedy to spam. The DNS service supports the DKIM standard perfectly. A TXT record can contain 4096 characters at most, which is absolutely enough for storing a public key. Multiple resolution lines In China, there are several carriers, including China Telecom, China Mobile, and China Unicom. Network access across carriers faces high latency, for example, a China Unicom user trying to access a server in China Telecom's equipment room. The DNS service in HUAWEI CLOUD offers multiple resolution lines to tackle this problem. It uses different lines to resolve DNS requests for users of different carriers. Requests issued by users of a carrier are directed to a server in this carrier's equipment room, greatly optimizing visitors' network access experience. Private domain name As the number of netizens are surging, a website application deployed only on one server will certainly corrupt upon heavy concurrent requests. The common practice is to spread service load to multiple servers. Currently, the servers communicate with each other with private IP addresses. If one of the servers is changed, the private IP address will also change. In this case, you must change the IP address configured in the code of other servers and publish your website again. This whole process is extremely inconvenient. With the DNS service, you can create private domain names and map them to private IP addresses of servers so that they can access each other with domain names. If the IP Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 5

9 2 Application Scenarios address of one server is changed, you only need to change the IP address in the DNS record, enabling easy network maintenance. Accessing internal cloud service addresses Currently, ECSs use a public DNS server by default and must be assigned with EIPs. When you try to access internal cloud services, such as OBS, SMN, and SFS, from an ECS, your requests will be routed to the Internet and encounter high latency in getting a response. After a private DNS server is configured for the ECSs, your requests will be responded with internal service addresses by the private DNS server. In this case, no EIP is required, and the requests do not go through the Internet, greatly lowering network latency and offering optimum performance in private network accesses. Reverse resolution for private IP addresses You can add PTR records to map private IP addresses to domain names in the private network. As a result, after an ECS receives communication requests sent from a private IP address, it will know which host sends the requests by domain name. Creating top-level domains The DNS service allows you to create any top-level domain names except com in the private network. When buying an ECS, you are required to specify a host name, for example, esc01. In this case, you can create a top-level domain name ecs01 and add a record set to map the domain name to the private IP address of the ECS, so that you can access the ECS with the domain name ecs01, instead of an IP address. PTR Record For the sake of security, some large companies choose to build their own servers. When receiving s, the receiver server detects the domain name mapped to the IP address of the sender and checks whether the s are coming from an server whose domain name is trustworthy. If no PTR record is available for the IP address, or its domain name is blacklisted by Spamhaus, the receiver will treat s from this IP address as spam or malicious and discard them. Therefore, if you want to build servers, it is necessary to add PTR records to map the server IP addresses to your domain names. Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 6

10 3 Accessing and Using DNS 3 Accessing and Using DNS 3.1 How to Access DNS A web-based management console is provided for you to access the DNS service. Upon a quick configuration on the management console, you can start using the DNS service for domain name resolution. You can access the DNS service at Related Services Elastic Cloud Server (ECS) The DNS service can map domain names to ECS IP addresses. Object Storage Service (OBS) The DNS service can map domain names to OBS buckets. For details, see Static Website Hosting in the Object Storage Service Best Practice. Cloud Trace Service (CTS) CTS can record DNS-related operations. These records may be required for query, auditing, and tracking. Domain Registration The DNS service enables you to manage and resolve your domain names registered in Domain Registration. Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 7

11 4 Change History 4 Change History Released On Description This issue is the third official release, which incorporates the following changes: Modified resolution lines in section 1.10 Resolution Line This issue is the second official release, which incorporates the following changes: Added relationship between DNS and CTS in section 3.2 Related Services This issue is the first official release. Issue 03 ( ) Copyright Huawei Technologies Co., Ltd. 8