Docs

TrafficRoute DNS Suite

Product Overview

Basic concepts

This document introduces the basic concepts of the Domain Name System (DNS).

Domain name system

The Domain Name System (DNS) includes the domain name space (Domain Name Space), DNS record (Resource Record), recursive DNS server, and name server (Name Server). From the user's perspective, the domain name system functions similarly to a telephone directory, providing users with resource information corresponding to domain names.

For example, when a user accesses a website, they enter the website's domain name in the browser. The browser sends a query request to the DNS server. After receiving a query request, the DNS server resolves the domain name to an IP address and returns the IP address to the browser. Then, the browser sends an HTTP request to the IP address of the website server.

See RFC 1034 and RFC 1035 for detailed information.

Domain name

In DNS, domain names are used to identify network resources within the domain name space (Domain Name Space). A domain name (Domain Name) is composed of the root domain, top-level domain, second-level domain, and subdomain. For example, on www.example.com. In this example, the top-level domain is com, the site domain is example, the subdomain is www, and the root domain is.。 The root domain (.) is usually omitted in domain names.

See RFC 1034 and RFC 1035 for more information.

Resource records

A DNS record (Resource Record, RR) is a mapping between a domain name and resource information. For example, the following DNS record specifies that the domain name example.com corresponds to the IPv4 address 1.2.3.4.

See RFC 1034 and RFC 1035 for more information.

TTL（Time-to-Live）

TTL is an attribute of a DNS record that specifies how long the DNS record is stored in the cache of a recursive DNS server. If the retention period exceeds the TTL, the record will be discarded from the cache.

The larger the TTL value, the longer a DNS record is stored in the cache of recursive DNS servers. When a DNS record is changed, the time required for the change to take effect becomes longer.

Record set

DNS uses record sets (RRSet) to manage one or more DNS records with the same domain name, line, and type. You can assign weights to multiple DNS records in a record set to achieve DNS-based load balancing. See RRSet in RFC 7719.

Recorded value

The record value (RDATA) is the resource information in a DNS record. For example, the following DNS record specifies that the domain name example.com corresponds to the IPv4 address 1.2.3.4. Specifically, 1.2.3.4 is the value of this DNS record.

See RFC 1034 and RFC 1035 for more information.

Line

Line indicates the source of a user's request. A line can be an ISP, a geographic location, an IP range, or a combination of ISP, geographic location, and IP range.

If your domain name can resolve to different service IP addresses and you want user requests to be routed to IP addresses that meet the following requirements to reduce user access latency:

The ISP of the user's IP address is the same as the ISP of the service IP address.

The geographic location of the user's IP address should be as close as possible to the geographic location of the service IP address.

You can assign a line to a record set that contains one or more server IP addresses. Each line represents the ISP, geographic location, or IP range associated with a server IP address in the dataset. When the DNS server of DNS receives a DNS query request, it uses the truncated client IP address information contained in the request to determine whether the client's IP address matches the line. These client IP address details are used to obtain information such as the client's ISP, geographic location, IP address range, and other information. If the client's IP address matches the line, the DNS response contains only the server IP addresses within the corresponding record set.

tip

DNS gives priority to matching the line by using the client IP address range contained in the ECS protocol (EDNS Client Subnet protocol) information from the resolution request. If the Local DNS server used by the user does not support the ECS protocol, DNS will use the client IP address in the packet. Most of these client IP addresses are the egress IP addresses of Local DNS servers. You can refer to the Working Principle for more information.

FQDN

FQDN (Fully Qualified Domain Name) is the complete domain name that specifies its exact location in the DNS hierarchy. The FQDN of each domain name is unique in the DNS system. An FQDN includes all levels of a domain name, including the root domain, for example, www.example.com.

PQDN

PQDN (Partially Qualified Domain Name) refers to a relative domain name in DNS, for example, example.com.

Root domain

The root domain (Root Domain) is the first level of a domain name and is represented by a dot (.). In domain name notation, the root domain is usually omitted, but in the FQDN of a domain name, the root domain is included. There are 13 root DNS servers worldwide. Root DNS servers are responsible for the domain name resolution of top-level domains. The IP address of the top-level domain DNS server can be obtained through domain name resolution.

Top-level domain

The top-level domain (TLD) DNS server obtains the IP address of the authoritative DNS server that hosts the site domain by resolving the site's domain name.

Recursive query

A recursive query (Recursive Query) is a type of query used by DNS servers. When a client initiates a domain name resolution request, if the DNS server does not have the requested DNS record cached, the DNS server acts as a client by sending a domain name resolution request to other DNS servers. It then returns the result to the original client. During the recursive query process, the client sends only one resolution request. A recursive DNS server responds to the client's domain name resolution requests using recursive queries.

Iterative query

Iterative query (Iterative Query) is a query mode used by DNS servers. When a client initiates a domain name resolution request, the DNS server does not directly return the resolution result; instead, it returns the address of another DNS server. Then the client initiates a resolution request to this DNS server. If the DNS server returns a resolution result, the iterative query ends. During the iterative query process, the client requests multiple DNS servers. A recursive DNS server is one that sends resolution requests to other DNS servers using the iterative query method.

Name server

A name server (Name Server, NS) is a server that stores DNS records. Root DNS servers, top-level domain DNS servers, and authoritative DNS servers are all name servers.

Authoritative DNS server

An authoritative DNS server (Authoritative Server) is a server that maintains DNS record. Authoritative DNS servers do not directly receive DNS query requests from users; they only interact with recursive DNS servers. When an authoritative DNS server receives a DNS query request from a recursive DNS server, it returns an authoritative DNS record.

You can use VolcanoEngine Cloud DNS to assign authoritative DNS servers for your internet domain.

Recursive DNS server

The recursive DNS server (Recursive Server) receives users' DNS query requests. If the user's DNS query request matches a cached entry, the recursive DNS server returns the cached resolution result. If a user's DNS query does not hit the cache, the recursive DNS server performs iterative queries to various DNS servers and eventually retrieves the answer from the authoritative DNS server. The recursive DNS server returns the resolution result to the user and caches the resolution result.

Local DNS servers and public DNS servers are both classified as recursive DNS servers.

Local DNS server

Local DNS is a type of recursive DNS server. Most Local DNS servers are maintained by ISPs.

ECS protocol (EDNS client subnet protocol)

The ECS protocol (EDNS Client Subnet protocol) is a DNS extension protocol. Recursive DNS services, such as Local DNS servers, can send part of the client's IP address information to authoritative DNS servers via the ECS protocol. Authoritative DNS servers can return the optimal DNS response based on partial IP address information from the client.

DNS supports the ECS protocol. See RFC 7871 for detailed information about the ECS protocol.

DNS DDoS attack

In a DDoS (Distributed Denial of Service) attack, attackers use multiple hosts distributed across different regions to send a large number of requests to the target server within a short period, exhausting the server's computing resources and causing it to stop providing services.

DNS services are common targets of DDoS attacks. If the DNS service stops, users cannot obtain the IP address of the target service through the domain name, so they cannot access the target service using the domain name. DNS DDoS attacks mainly include two types: DNS flood attacks and DNS amplification attacks.

DNS flood attack: Attackers send a large number of DNS query requests to the DNS server within a short period, exhausting the server's computing resources and causing the server to become unavailable. An NXDOMAIN attack is a type of DNS flood attack.

DNS Amplification Attack: The attacker modifies the client IP address in the DNS query request to the IP address of the targeted client. After receiving a DNS query request, the DNS server returns the DNS query response to the targeted client. Attackers will send a large number of DNS query requests within a short period of time and request as much information as possible in each DNS query request, thereby exhausting the bandwidth resources of the client under attack.

DNSSEC

DNSSEC (DNS Security Extension) is a DNS extension protocol that authenticates DNS responses using asymmetric encryption, enabling verification of whether a DNS response originates from an authoritative DNS server. After DNSSEC is enabled, the DNS system can avoid attacks such as DNS cache poisoning. In a DNS cache poisoning attack, an attacker sends DNS query requests to a recursive DNS server and simultaneously forges responses that appear to be from an authoritative DNS server, thereby injecting incorrect IP addresses into the cache of the recursive DNS server.

Each DNS Zone has a public/private key pair, known as ZSK (Zone Signing Keys). The owner of each Zone uses the private key of that Zone to sign the DNS data in that Zone. When a recursive DNS server queries a zone, it also obtains the public key of the zone and uses this public key to verify whether the digital signature of the DNS data is valid. If the digital signature is valid, the recursive DNS server returns the DNS data to the user; if the digital signature is invalid, the recursive DNS server discards the DNS data and returns an error message. In this way, DNSSEC provides assurance for the origin and integrity of DNS data.

However, the validity of each Zone's public key itself must still be ensured. Therefore, each Zone's owner also uses another public/private key pair (that is, the KSK, Key Signing Keys) to sign the public key of the Zone. The ZSK public key and KSK public key of each Zone are signed by the KSK private key of that Zone. At the same time, to establish the chain of trust, the owner of the Zone publishes the hash value of the KSK public key as a DS (Delegation Signer) record in the parent Zone. Like other types of DNS records, DS records are signed in the parent zone using its ZSK private key. The parent zone's ZSK public key is signed using its KSK private key, and the owner of the parent zone also publishes the hash value of the KSK public key in the parent zone as a DS (Delegation Signer) record. This forms an effective chain of trust.

The root Zone does not have a parent Zone. The KSK (Root Key Signing Key) of the root zone will be generated under the supervision of IANA. During IANA's Key Signing Ceremony, the root zone's KSK private key is used to sign the root zone's ZSK public key.

See RFC 9364 for detailed information about DNSSEC.

Subdomain hosting

Subdomain delegation refers to independently managing the DNS resolution of subdomains. To host a subdomain, you can use a DNS resolution provider different from that of its root domain. Moreover, the DNS configuration of a subdomain does not affect, nor is it affected by, the DNS configuration of its root domain.

Example

In DNS, each root domain corresponds to an instance. Each instance has a unique ID within VolcanoEngine, for example, DNS735********4675116. Each instance has an edition attribute. See the edition specifications.

Last updated: 2025.11.04 20:01:16