Skip to content
DNSmigrator
betaDNS betaCloud platformSetup guide checked 2026-09-27

Alibaba Cloud DNS

Alibaba Cloud signing key setup: create a RAM user with a permanent AccessKey and grant read-only or narrowly scoped Alibaba Cloud DNS API access.

On this page

Alibaba Cloud signing key permissions

Credential type
RAM user AccessKey pair
Preview access
AliyunDNSReadOnlyAccess
Apply access
The domain-scoped DNSMigrator apply policy
API endpoint
DNSMigrator uses the provider's fixed API endpoint.

Additional access

`AliyunDNSFullAccess` also works, but its current policy grants `alidns:*` and permission to create DNS service-linked roles. The copied custom policy limits record and DNSSEC operations to named domain ARNs. `DescribeDomains` and optional `AddDomain` still require Resource `*` under Alibaba's current authorization tables.

DNSControl id

creds.json TYPE
{
  "TYPE": "ALIDNS"
}

Create credentials

Create a RAM user with a permanent AccessKey and grant read-only or narrowly scoped Alibaba Cloud DNS API access.

Access you'll grant

Preview

AliyunDNSReadOnlyAccess

Apply

The domain-scoped DNSMigrator apply policy

AliyunDNSFullAccess also works, but its current policy grants alidns:* and permission to create DNS service-linked roles. The copied custom policy limits record and DNSSEC operations to named domain ARNs. DescribeDomains and optional AddDomain still require Resource * under Alibaba's current authorization tables.

Before you start

  • An Alibaba Cloud account with Alibaba Cloud DNS activated and the zones on that account.
  • A RAM administrator; Alibaba documents AliyunRAMFullAccess as the system policy that can create users and their AccessKeys.

Setup steps

0 of 5 done

  1. Create a RAM user

    Open the RAM console and go to Identities → Users → Create User. Enter a Logon Name and optional Display Name for a dedicated DNSMigrator user.

    Open RAM users

  2. Create the AccessKey

    Under Access Mode, select Permanent AccessKey and do not select Console Access for this API-only user. Select the confirmation checkbox, finish creating the user, and immediately save the AccessKey ID and AccessKey secret. The secret is shown only once.

    Alibaba Cloud: create a RAM user

  3. Grant Cloud DNS access

    On the user's permissions page, select Add Permissions. Attach AliyunDNSReadOnlyAccess for preview only. For apply, create a custom RAM policy in JSON view, replace <account-id> and <domain-name>, add one domain ARN per zone, and attach it. Your numeric account ID appears when you point to the profile picture in the console's upper-right corner. Remove the final alidns:AddDomain statement if every zone already exists. AliyunDNSFullAccess is the broader alternative.

    Preview system policyAliyunDNSReadOnlyAccess
    Domain-scoped apply policy{ "Version": "1", "Statement": [ { "Effect": "Allow", "Action": "alidns:DescribeDomains", "Resource": "*" }, { "Effect": "Allow", "Action": [ "alidns:DescribeDomainRecords", "alidns:DescribeDomainDnssecInfo", "alidns:AddDomainRecord", "alidns:UpdateDomainRecord", "alidns:DeleteDomainRecord", "alidns:SetDomainDnssecStatus" ], "Resource": [ "acs:alidns:*:<account-id>:domain/<domain-name>" ] }, { "Effect": "Allow", "Action": "alidns:AddDomain", "Resource": "*" } ] }
    Broader apply alternativeAliyunDNSFullAccess

  4. Limit the key by source IP (optional)

    On the key's Configure network access policy page, you may allow only our egress IP. Do not restrict it to your workstation's address: DNSMigrator calls the API from its static egress address.

    DNSMigrator source IPour egress IP

  5. Paste the key pair

    Paste the saved public identifier into AccessKey ID and its paired secret into AccessKey secret, then check access. For an existing RAM user, keys are under the user's Credential tab → AccessKey.

Troubleshooting

InvalidAccessKeyId or SignatureDoesNotMatch

Use the ID and secret from the same active RAM-user AccessKey pair. Replace the key if its one-time secret was not saved correctly.

NoPermission or Forbidden

Attach AliyunDNSReadOnlyAccess for preview, or attach the copied custom apply policy for writes. New RAM users start with no permissions.

The zone list is empty

Confirm the zones belong to the Alibaba Cloud account that owns this RAM user and that Alibaba Cloud DNS is active for them.

Requests are blocked after adding a network ACL

Replace your workstation IP with our egress IP in the AccessKey network access policy.

Official documentation

Guide checked against the official documentation on .

Credential fields

FieldRequirementWhere to find it
AccessKey IDaccessKeyIdRequiredThe AccessKey ID created for the dedicated RAM user, not an Alibaba Cloud account AccessKey.
AccessKey secretaccessKeySecretRequiredThe AccessKey secret shown once with that AccessKey ID. If it was not saved, create a replacement pair.

Capabilities

Create zones
Yes
List zones
Yes
DNSSEC
Managed through the API
Minimum TTL
600 seconds
Apex CNAME
No
Read only
No

Record types

  • A
  • AAAA
  • CNAME
  • MX
  • TXT
  • NS
  • SRV
  • CAA
  • HTTPS
  • SVCB
  • TLSA

Caveats

  • Free and Personal editions have a minimum TTL of 600 seconds; only Enterprise Ultimate allows TTLs down to 1 second.
  • TXT values are limited to 512 characters and MX priorities must be 50 or lower.
  • ALIAS records and DNSSEC are only available on paid editions.

Troubleshooting

InvalidAccessKeyId or SignatureDoesNotMatch
Use the ID and secret from the same active RAM-user AccessKey pair. Replace the key if its one-time secret was not saved correctly.
NoPermission or Forbidden
Attach AliyunDNSReadOnlyAccess for preview, or attach the copied custom apply policy for writes. New RAM users start with no permissions.
The zone list is empty
Confirm the zones belong to the Alibaba Cloud account that owns this RAM user and that Alibaba Cloud DNS is active for them.
Requests are blocked after adding a network ACL
Replace your workstation IP with `{egressIp}` in the AccessKey network access policy.

Related links

Alibaba Cloud DNS migration overviewMarketing overview and provider differences.Connect a providerHow connection checks and permissions work.Cloudflare → Alibaba CloudRoute 53 → Alibaba CloudAzure DNS → Alibaba CloudCloud DNS → Alibaba Cloud