Alibaba Cloud

Dotnify connects to Alibaba Cloud DNS (Alidns) using an AccessKey ID and AccessKey Secret pair. Requests are signed using the V1 HMAC-SHA1 signing algorithm — no SDK dependency is needed.

Creating an AccessKey Pair

1. Log in to the Alibaba Cloud console
2. Go to AccessKey Management → AccessKey
3. Click Create AccessKey — an AccessKey ID and AccessKey Secret will be generated
4. Save the AccessKey Secret securely — you won't be able to view it again after closing the dialog

WARNING

Alibaba Cloud recommends using RAM user AccessKeys instead of the primary account AccessKey. Create a RAM user with the minimum required permissions and use its AccessKey pair.

Required Permissions

The RAM user (or AccessKey) needs the following Alidns permissions:

Service	Action	Description
Alidns	alidns:DescribeDomains	List domains
Alidns	alidns:DescribeDomainRecords	List records in a domain
Alidns	alidns:AddDomainRecord	Create a record
Alidns	alidns:UpdateDomainRecord	Update a record
Alidns	alidns:DeleteDomainRecord	Delete a record
Alidns	alidns:DescribeDomainInfo	Get domain info (used for resolution lines)

You can assign these through a custom policy in RAM → Policies → Create Policy.

Example custom policy (JSON):

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "alidns:DescribeDomains",
        "alidns:DescribeDomainRecords",
        "alidns:AddDomainRecord",
        "alidns:UpdateDomainRecord",
        "alidns:DeleteDomainRecord",
        "alidns:DescribeDomainInfo"
      ],
      "Resource": "*"
    }
  ]
}

For simplicity, you can also use the AliyunDNSFullAccess preset policy, which grants full Alidns access.

Adding the Provider in Dotnify

1. Go to Providers → Add provider
2. Select Alibaba Cloud as the provider type
3. Enter a Display name (e.g. "My Alibaba Cloud")
4. Enter the AccessKey ID and AccessKey Secret
5. Click Verify & continue

Dotnify will attempt to list domains using the provided credentials. If verification fails, check that:

• The AccessKey ID and AccessKey Secret were copied correctly
• The RAM user has the required Alidns permissions
• The account has domains configured in Alibaba Cloud DNS

Selecting Zones

After verification, Dotnify shows all domains accessible with the credentials. You can:

• Check specific domains to manage only those
• Leave all unchecked to manage every accessible domain

You can change the domain selection later by editing the provider.

How Dotnify Uses the Credentials

Dotnify implements the Alibaba Cloud V1 API signing directly in Node.js (no SDK). The signing process:

1. Sorts all request parameters by key and percent-encodes them per Alibaba Cloud spec
2. Constructs the string to sign: METHOD&%2F&<percent-encoded canonical query string>
3. Computes the HMAC-SHA1 signature using the AccessKey Secret with a trailing &
4. Appends the Signature parameter to the request

Operation	Alidns API Action
List domains	DescribeDomains
List records	DescribeDomainRecords
Create record	AddDomainRecord
Update record	UpdateDomainRecord
Delete record	DeleteDomainRecord
List lines	DescribeDomainInfo (with NeedDetailAttributes=true)

All requests are sent to https://alidns.aliyuncs.com/ using the 2015-01-09 API version.

Alibaba Cloud-Specific Features

Resolution Lines

Alibaba Cloud DNS supports resolution lines — you can set different records for different ISPs or regions (e.g. default, telecom, unicom, mobile). When creating or editing a record in Dotnify, you can select a resolution line from a dropdown.

The available lines are fetched live from the API via the DescribeDomainInfo action with NeedDetailAttributes=true. The available lines may vary per domain depending on your Alibaba Cloud DNS plan.

Lines are organized with a two-level hierarchy (parent category and specific line):

Category	Examples
Default	Default line
ISP/Carrier	Telecom, Unicom, Mobile
Region	China provinces, Overseas, Continents, Countries
Search Engine	Baidu, Google, Bing

When selecting a line in the Dotnify UI, the first dropdown shows the top-level group and the second dropdown shows the specific line within that group.

Record Weight

Alibaba Cloud DNS supports per-record weighting. When creating or editing a record, you can set a weight value. This is useful for load balancing — Alibaba Cloud DNS will distribute traffic based on the weight ratio across records with the same name, type, and line.

Minimum TTL

Alibaba Cloud DNS enforces a minimum TTL of 600 seconds (10 minutes). Dotnify automatically enforces this: if you set a TTL below 600, it will be rounded up to 600.

Record Status

Alibaba Cloud DNS records have an enable/disable status (ENABLE / DISABLE). Dotnify exposes this as a status field on records ("enable" or "disable").

Record Remarks

Alibaba Cloud DNS supports remarks (comments) on DNS records. Dotnify preserves remarks when reading and displaying records.

Security Notes

• The AccessKey ID and AccessKey Secret are stored in plaintext in Redis (current MVP design). Protect your Redis instance with strong credentials.
• When the provider list is returned via the API, keys are masked — only the last 4 characters are visible.
• When editing a provider, you can leave the AccessKey fields blank to keep the current values unchanged.
• All Alibaba Cloud API calls are made server-side — the credentials are never exposed to the browser.