Docs

TrafficRoute DNS Suite

Product Overview

How it works

This document introduces how VolcanoEngine PrivateZone works.

The resolver of VolcanoEngine PrivateZone can respond to DNS queries from VPCs or inbound endpoints through authoritative, forwarding, or recursive methods. Upon receiving a DNS query, the resolver determines whether it can respond using authoritative, forwarding, or recursive methods in sequence.

If the resolver determines it can respond to the DNS query using one of these methods, it will use that method. At this point, DNS resolution is complete.

If the resolver determines it cannot respond to the DNS query using the current method, it will check if it can respond using the next method. If the resolver determines that none of the methods can be used to respond to the DNS query, the DNS resolution fails.

How VolcanoEngine PrivateZone Processes DNS queries

After receiving a DNS query, the resolver determines whether it can respond using authoritative, forwarding, or recursive methods in sequence. The following diagram shows the decision process and the processing flow of DNS queries in VolcanoEngine PrivateZone.

Step 1: The resolver determines whether it can respond to the DNS query using the authoritative method

The resolver determines whether the DNS query matches a domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names). See How the resolver determines if a DNS query matches a domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names).

If a domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names) that matches the DNS query is found, the resolver first searches for DNS records of the matched domain name (including cloud product authoritative domain names) in the cache.

If DNS records are found in the cache, the resolver returns the found DNS records. At this point, DNS resolution is complete.

tip

If intelligent DNS or load balancing is enabled for the domain name, the DNS records of the domain name will not be cached.

If no DNS records are found in the cache, the resolver sends a DNS query to the authoritative DNS server of VolcanoEngine PrivateZone.

If the authoritative DNS server finds DNS records, it returns the found DNS records to the resolver. The resolver returns the DNS records to the client and saves the records in the cache. At this point, DNS resolution is complete.

If the authoritative DNS server does not find DNS records, the resolver determines whether recursive resolution is enabled for the domain name:

If recursive resolution is enabled for the domain name, the resolver will use recursive resolution proxy as a fallback. At this point, the DNS query will successfully meet the effective conditions of the recursive resolution proxy. See Step 3: The resolver attempts to respond to the DNS query using the recursive method.

If recursive resolution is not enabled for the domain name, the DNS resolution fails.

If no domain name (including cloud product authoritative domain names) matching the DNS query is found, the resolver proceeds to the next step. See Step 2: The resolver attempts to respond to the DNS query using the forwarding method.

How the resolver determines if a DNS query matches a domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names)

For DNS queries from VPCs associated with domain names in VolcanoEngine PrivateZone (including cloud product authoritative domain names), if the domain name of the DNS query is the same as or a subdomain of a domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names), the DNS query successfully matches the domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names).

tip

The matching process between DNS queries and domain names in VolcanoEngine PrivateZone (including cloud product authoritative domain names) follows the longest suffix matching principle. For example, if the domain name of the DNS query is 123.abc.example.com, and there are two domain names example.com and abc.example.com in VolcanoEngine PrivateZone, then the DNS query matches the domain name abc.example.com.

Step 2: The resolver determines whether it can respond to the DNS query using the forwarding method

The resolver determines whether the DNS query matches a forwarding rule of type Forward DNS queries to an external DNS server. See How the resolver determines if a DNS query matches a forwarding rule.

If a forwarding rule matching the DNS query is found, the resolver first checks the cache for DNS records obtained according to the forwarding rule.

If DNS records are found in the cache, the resolver returns the found DNS records. At this point, DNS resolution is complete.

If no DNS records are found in the cache, the resolver forwards the DNS query to an external DNS server (such as an on-premise IDC or third-party cloud service) according to the matched forwarding rule, and then returns the DNS response from the external DNS server to the client. At this point, DNS resolution is complete.

If no forwarding rule matching the DNS query is found, the resolver proceeds to the next step. See Step 3: The resolver attempts to respond to the DNS query using the recursive method.

How the resolver determines if a DNS query matches a forwarding rule

For DNS queries from VPCs associated with forwarding rules, if the domain name of the DNS query is the same as or a subdomain of the forwarding domain name associated with the forwarding rule, the DNS query successfully matches the forwarding rule.

For example, if the forwarding domain name is example.com, the DNS query will match successfully when the domain name of the request is example.com, abc.example.com, or 1234.abc.example.com.

Step 3: The resolver determines whether it can respond to the DNS query using the recursive method

The resolver determines whether the DNS query meets the effective conditions of the recursive resolution proxy. See How the resolver determines if a DNS query meets the effective conditions of the recursive resolution proxy.

If the DNS query meets the effective conditions of the recursive resolution proxy, the resolver first checks the cache for DNS records from public recursive DNS servers.

If DNS records are found in the cache, the resolver returns the found DNS records. At this point, DNS resolution is complete.

If no DNS records are found in the cache, the resolver sends a DNS query to a public recursive DNS server:

If the DNS query matches a forwarding rule of type Custom line, the resolver returns the query results obtained from the public recursive DNS server. The line of the egress IP address of the public recursive DNS server is the custom line you configured. The resolver also saves the record in the cache. At this point, DNS resolution is complete.

If the DNS query does not match a forwarding rule of type Custom line, the resolver returns the query results obtained from the public recursive DNS server. The line of the egress IP address of the public recursive DNS server is the default BGP line of VolcanoEngine public IP addresses. The resolver also saves the record in the cache. At this point, DNS resolution is complete.

If the DNS query does not meet the effective conditions of the recursive resolution proxy, the DNS resolution fails.

How the resolver determines if a DNS query meets the effective conditions of the recursive resolution proxy

If a DNS query meets any of the following conditions, the DNS query meets the effective conditions of the recursive resolution proxy:

The domain name of the DNS query does not match any domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names) or any forwarding rule of type Forward DNS queries to an external DNS server.

The domain name of the DNS query matches a domain name in VolcanoEngine PrivateZone (including cloud product authoritative domain names). Recursive resolution is enabled for the domain name (including cloud product authoritative domain names), and the domain name of the DNS query does not match any DNS record under the domain name (including cloud product authoritative domain names). For example, the domain name of the DNS query is www.example.com, and there is a domain name example.com in VolcanoEngine PrivateZone, but none of the DNS records under the domain name match www.example.com.

Last updated: 2025.11.04 20:38:48