vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Private DNS zones are resolvable only on IBM Cloud, and only from explicitly [permitted networks](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-dns-conceptspermitted-networks) in an account. To get started, create a DNS Services instance using the IBM Cloud console.

DNS Services allow you to:



* Create private DNS zones that are collections for holding domain names.
* Create DNS resource records under these DNS zones.
* Specify access controls used for the DNS resolution of resource records on a zone-wide level.



DNS Services also maintains its own worldwide set of DNS resolvers. Instances that are provisioned under IBM Cloud on an IBM Cloud network can use resource records that are configured through IBM Cloud DNS Services by querying DNS Services resolvers.

Resource records and zones that are configured through DNS Services are:



* Separated from the wider, public DNS and their publicly accessible records.
* Hidden from machines outside of and not part of the IBM Cloud private network.
* Accessible only from machines that you authorize on the IBM Cloud private network.
* Resolvable only via the resolvers provided by the service.



The DNS service maps the FQDN of each ALB to the virtual hostnames of the ASCS, ERS, and HANA that are used by SAP applications.

Zoom

![Figure 6. DNS records](https://cloud.ibm.com/docs-content/v1/content/f89cc64b006ca59b35404693959c83d5747fee3e/sap/images/sap-terraform-ha-dns.png)

Figure 6. DNS records







 2. Highly available system for SAP HANA database 

Zoom

![Figure 7.
<-- <section "id="section-show-routinge-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--smart-routing: Leverages real-time network intelligence to route traffic across paths from the origin to a CIS data center.--tiered-caching: Uses regional Tier 1 CIS data centers to accelerate content delivery.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-show-routinge-options" "> --><-- <section "id="section-show-routing-examples" "> --> Examples Get the details of routing settings for domain 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis routing 31984fea73a15b45779fa0df4ef62f9b --smart-routing -i "cis-demo"
<-- </section "id="section-show-routing-examples" "> --><-- </section "id="section-show-routing" "> --><-- <section "id="section-update-routing" "> --> ibmcloud cis routing-update Update Routing setting (Enterprise plan only). ibmcloud cis routing-update DNS_DOMAIN_ID (--smart-routing (on|off) | --tiered-caching (on|off)) -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-update-routinge-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--smart-routing: Leverages real-time network intelligence to route traffic across paths from the origin to a CIS data center.
FAQs 

Have a question about IBM Cloud® DNS Services? Review frequently asked questions, which provide answers to provisioning concerns, application access, and other common inquiries.



 How do I create my own private DNS zone using DNS Services? 

To create your own private DNS zone using DNS Services, take the following steps.



1. Create a VPC instance.
2. Create a DNS Services instance.
3. Add a DNS zone to the DNS Services instance.
4. Designate the VPC instance as a permitted network for the DNS zone.
5. Add a DNS Resource Record to the DNS zone.
6. Verify name resolution of the DNS Resource Record works from within the VPC.







 How is DNS Services different from public DNS? 

DNS Services permits name resolution only from permitted VPCs within your IBM Cloud® account. The DNS zone is not resolvable from the internet.





 Can I manage publicly available DNS records with this service? 

No, DNS Services only offers private DNS at the moment. Use [CIS](https://cloud.ibm.com/docs/cis?topic=cis-getting-startedgetting-started) for public DNS.





 Is DNSSec supported with zones managed by DNS Services? 

DNSSec allows resolvers to cryptographically verify the data received from authoritative servers. DNS Services resolvers support DNSSec for public domains, for which requests are forwarded to public resolvers that support DNSSec. For private zones, since the authority is within IBM Cloud, records are fetched using secure protocols, and are guaranteed to have the same level of privacy and security that DNSSec provides for public zones.





 Is DNS Services regional or global? 

DNS Services is a global service and can be used from permitted networks in any IBM Cloud region.





 When creating a DNS zone, what is the purpose of the Label field? 

A given instance can have multiple DNS zones with the same name. The label helps to differentiate zones with name collisions.





 How many private zones are supported?
You must create a CNAME DNS record and point it to the VPN server hostname in your DNS provider. After that, edit the client profile by replacing direct remote 445df6c234345.us-south.vpn-server.appdomain.cloud with remote your-customized-hostname.com.

445df6c234345.us-south.vpn-server.appdomain.cloud is an example VPN server hostname.

If you are using [IBM Cloud Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-getting-started) as your DNS provider, refer to [CNAME Type record](https://cloud.ibm.com/docs/cis?topic=cis-set-up-your-dns-for-ciscname-type-record) for information about how to add a CNAME DNS record.





 What information should I provide in an IBM Support case if I need help? 

Supply the following content in your [IBM Support case](https://cloud.ibm.com/docs/get-support?topic=get-support-open-case):



1. Your VPN server ID.
2. Your VPN client and operating system version.
3. The logs from your VPN client.
4. The time range when you encountered the problem.
5. If user-ID-based authentication is used, supply the username.
6. If certificate-based authentication is used, supply the common name of your client certificate.

To view the common name of your client certificate, use the OpenSSL command openssl x509 -noout -text -in your_client_certificate_file in the subject section.







 How do I assign the VPN client role using IAM access management tags in the API? 

When you manage user access using access management tags on a client-to-site VPN and enable the UserId and Passcode mode for Client Authentication, you must attach the VPN Client role with an access tag. Otherwise, the VPN client cannot connect to the VPN server.
Understanding DNS concepts 

This document contains some concepts and definitions that are related to the internet's domain name system (DNS) and how it affects your usage of IBM Cloud® DNS Services.



 DNS zones 

A DNS zone is a collection of resource records, which belongs to a single parent instance. All resource records have the zone's domain name as a suffix. You can create, update, delete, get, and list the DNS Zones by using curl commands.

See [Managing DNS zones](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-dns-zones) to learn more about how to manage DNS zones.





 Permitted networks 

Permitted networks are the VPCs that can perform name resolution on the DNS Zone. It is used as an access control mechanism to guarantee that only the VPC that has been added as a permitted network can perform name resolution on the DNS zone.

See [Managing permitted networks](https://cloud.ibm.com/docs/dns-svcs?topic=dns-svcs-managing-permitted-networks) to learn more.





 Resource records (RR) 

Resource records (RR) are entries in the DNS zone files. The most common type is an A record that provides a mapping between a name and an IPv4 address.

DNS Services supports the following types of resource records:



 A (IPv4 Address Record) 

Provides a mapping of a host to an IPv4 address.





 AAAA (IPv6 Address Record) 

Provides a mapping of a host to an IPv6 address.





 CNAME (Canonical Name) 

Provides a way to alias a hostname to another hostname or Canonical Name (CNAME).





 PTR (Pointer) 

Enables reverse DNS lookup, from an IP address (IPv4 or IPv6) to a hostname





 MX (Mail Exchange) 

This record specifies the SMTP mail server for the DNS zone.





 SRV (Service Location) 

This record specifies the location of one or more of the servers for a specific protocol and domain.





 TXT (Text)
The process is similar to adding a domain, but instead of the registrar, you work with the DNS provider for the higher level domain. When you add a subdomain to CIS, you are given two name servers to configure, as usual. You configure a Name Server (NS) record for each of the two name servers as DNS records within your domain being managed by the other DNS provider. When we are able to verify that the required NS records have been added, we activate your subdomain. If you do not manage the higher level domain within your organization, you must work with the owner of the higher level domain to get the NS records added.
* What is TLS?

TLS is a standard security protocol for establishing encrypted links between a web server and a browser in an online communication. A TLS certificate is necessary to create a TLS connection with a website and comprises the domain name, the name of the company, and additional data, such as company address, city, state, and country. The certificate also shows the expiration date and details of the issuing Certificate Authority (CA).
* How Does TLS Work?

When a browser initiates a connection with a TLS secured website, it first retrieves the site's TLS Certificate to check whether the certificate is still valid. It verifies that the CA is one that the browser trusts, and that the certificate is being used by the website for which it has been issued. If any of these checks fail, you'll get a warning indicating that the website is not secured by a valid certificate.

When a TLS certificate is installed on a web server, it enables a secure connection between the web server and the browser that connects to it. The website's URL is prefixed with "HTTPS" instead of "HTTP" and a padlock is shown on the address bar. If the website uses an extended validation (EV) certificate, the browser might also show a green address bar.
* Why do I see a privacy warning?

The TLS certificates issued by IBM Cloud CIS cover the root domain (example.com) and one level of subdomain (.example.com).
<-- <section "id="section-dns-analytics-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.DIMENSION: The queried dimension. Valid values: queries-by-response-code, queries-by-type, queries-by-name. Required.-s, --since: Since time to now. Valid values are: 6h (6 hours ago), 12h, 1d (1 day ago), 1w (1 week ago)-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-dns-analytics-options" "> --><-- <section "id="section-dns-analytics-examples" "> --> Examples Get DNS analytics for domain 31984fea73a15b45779fa0df4ef62f9b. ibmcloud cis dns-analytics 31984fea73a15b45779fa0df4ef62f9b queries-by-response-code -s 6h -i "cis-demo" --output json
<-- </section "id="section-dns-analytics-examples" "> --><-- </section "id="section-dns-analytics" "> --><-- <section "id="section-ratelimit-analytics" "> --> ibmcloud cis ratelimit-analytics Get rate limit analytics for a DNS domain. ibmcloud cis ratelimit-analytics DNS_DOMAIN_ID --recent DURATION] --time-delta SECONDS] -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! ! ! !
<-- <section "id="section-ratelimit-analytics-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain.
"id": "b7246cdf-892a-4a6c-8fa9-491a5f585bd0",
"created_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"modified_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"permitted_network": {
"vpc_crn": "crn:v1:staging:public:is:us-east:a/0821fa9f9ebcc7b7c9a0d6e9bf9442a4::vpc:b7246cdf-892a-4a6c-8fa9-491a5f585bd0"
},
"type": "vpc",
"state": "ACTIVE"
}
]
}







 Removing a permitted network 

Delete a specific permitted network from your instance, and unlink VPC from a zone.



 Request remove permitted network 

curl -X DELETE $DNSSVCS_ENDPOINT/v1/instances/$INSTANCE_ID/dnszones/$DNSZONE_ID/permitted_networks/$PERMITTED_NETWORK_ID -H "Authorization: $TOKEN"





 Response 

{
"id": "b7246cdf-892a-4a6c-8fa9-491a5f585bd0",
"created_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"modified_on": "2019-09-11 13:46:51.68793557 +0000 UTC",
"permitted_network": {
ibmcloud cis range-app-create DNS_DOMAIN_ID --name NAME --edge-port EDGE_PORT --origin-direct ORIGIN_DIRECT --origin-direct ORIGIN_DIRECT] --proxy-protocol on|off] --ip-firewall on|off] --edge-connectivity all|ipv4|ipv6] --edge-tls off|flexible|full|strict] --traffic-type direct/http/https] -i, --instance INSTANCE] --output FORMAT]

ibmcloud cis range-app-create DNS_DOMAIN_ID --name NAME --edge-port EDGE_PORT --origin-lb-name ORIGIN_LB_NAME --origin-lb-port ORIGIN_LB_PORT --proxy-protocol on|off] --ip-firewall on|off] --edge-connectivity all|ipv4|ipv6] --edge-tls off|flexible|full|strict] --traffic-type direct/http/https] -i, --instance INSTANCE] --output FORMAT]

ibmcloud cis range-app-create DNS_DOMAIN_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT]

Deprecated] ibmcloud cis range-app-create DNS_DOMAIN_ID -s JSON_STR -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis range-app-create DNS_DOMAIN_ID -j JSON_FILE -i, --instance INSTANCE] --output FORMAT] ! !!!!!!!!!!!!
Show more
<-- <section "id="section-create-range-app-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--name: The name of DNS record for the range application.--edge-port: Port configuration at CIS's edge.
In either case, you should be able to retrieve the copy of the Domain Validation Challenge file object from Akamai at the dcv.akamai.com domain, to which the original request was redirected.





 Clean up for the Redirect method 

After your CDN indicates Certificate deploying status, you can:



1. (Optional) Remove the redirect statements or blocks from the configuration file.
2. (Optional) Remove the added ServerAlias (Apache2) or the server_name (Nginx) from your server configuration, if needed.
3. Remove the A record between the CDN domain and the origin server IP.











 Next steps 

Continue following instructions in [Getting to Running status](https://cloud.ibm.com/docs/CDN?topic=CDN-next-steps-after-ordering).



Contribute in GitHub

Open doc issue

Edit topic





On this page[Initial steps to Domain Control Validation](https://cloud.ibm.com/docs/CDN?topic=CDN-completing-domain-control-validation-for-https-with-dv-saninitial-steps-to-domain-control-validation)[Domain Control Validation](https://cloud.ibm.com/docs/CDN?topic=CDN-completing-domain-control-validation-for-https-with-dv-sandomain-control-validation)[Next steps](https://cloud.ibm.com/docs/CDN?topic=CDN-completing-domain-control-validation-for-https-with-dv-sancdn-next-steps1)


Feedback

Focus sentinel

 Give us your feedback 

Tell us about your experience0/1500



Don't include any sensitive or personal information.

How satisfied are you with your experience?

How satisfied are you with your experience?

1

2

3

4

5

info icon

Your feedback is carefully reviewed, but you won't be contacted in response. Need help? Try searching the docs or chatting with the Virtual Assistant in console.

Cancel

Submit

Focus sentinel Cookie Preferences
* TTL (Default value is 15 min)







 SRV type record 

To add this record type, valid values must exist in the Name, Service Name, and Target fields. Use the list menu to select a protocol, which defaults to the UDP protocol. Additionally, you can specify Priority, Weight, and Port. These three fields default to a value of 1. Specify a TTL value from the list menu, with a default value of 15 min.

Required fields



* Name
* Service Name
* Target
* TTL (Default value is 15 min)
* Protocol (Default value is UDP)
* Priority (Default value is 1)
* Weight (Default value is 1)
* Port (Default value is 1)







 TXT type record 

To add this record type, valid values must exist in the Name and Content fields. Specify a TTL value from the list menu, with a default value of 15 min.

For security and privacy reasons, it is recommended that you not use TXT type records for sensitive and confidential data.

Required fields



* Name
* Content
* TTL (Default value is 15 min)









 Updating DNS records 

In each record row, click the Edit icon to open a panel where you can update the record.





 Deleting DNS records 

In each record row, click the Delete icon to open a panel where you can confirm the delete process.





 Importing resource records 

To import resource records, take the following steps:



1. From your DNS Services instance, select the zone to which you want to import records
2. Click Select record action in the zone details section and choose Import records
3. You can drag and drop the import file into the panel that appears, or click the link to upload from your computer

Import files must be plain text format, and cannot exceed 8 MB
4. Click Import records



Your import file should follow this sample format:

www.test.com. 900 IN A 127.0.0.1
www.test.com. 900 IN AAAA ::1
w3.test.com.
ibmcloud dns resource-record-create $VMWARE_DNS_ZONE --type A --name NAME --ipv4 IP_ADDRESS







 Step 4: Validate DNS records 



1. List information about configured zones in your DNS instance dns-vmware. Use the following command.

ibmcloud dns zones -i dns-vmware
2. List information about configured records in your DNS instance dns-vmware and zone vmware.ibmcloud.local. Use the following command.

ibmcloud dns resource-records $VMWARE_DNS_ZONE -i dns-vmware
3. Verify that you permitted your IBM Cloud VPC networks to access and use the DNS service:

ibmcloud dns permitted-networks $VMWARE_DNS_ZONE
4. When a DNS record is created during the tutorial, validate that you get correct responses from your Windows Jump host, for example using nslookup via Windows command line.

nslookup <hostname>







 Next steps 

The next step in the tutorial series is:



* [Provision bare metal servers for VMware deployment](https://cloud.ibm.com/docs/solution-tutorials?topic=solution-tutorials-vpc-bm-vmware-bmsvpc-bm-vmware-bms)
ibmcloud cis waf-override-update DNS_DOMAIN_ID OVERRIDE_WAF_ID (--json @JSON_FILE | JSON_STRING) -i, --instance INSTANCE] --output FORMAT] ! !!!!!!
<-- <section "id="section-update-waf-override-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.OVERRIDE_WAF_ID: The ID of override WAF rule. Required.--json: The JSON file or JSON string used to describe a override WAF rule. Required.
<-- <ul> -->

* The required fields in JSON data are urls and rules.

<-- <ul> -->

* urls: URLs to be included in this rule definition. Wildcards are permitted.
* rules: Change the action assigned to a WAF rule. The keys of this object are WAF rule IDs and the values must be a valid WAF action. Unless disabling the rule, ensure that you also enable the rule group that this WAF rule belongs to. Max length: 1024.

<-- </ul> -->

* The optional fields are paused, description, priority, groups and rewrite_action.

<-- <ul> -->

* paused: Whether this package is currently paused. Valid values: true and false.
* description: A note that you can use to describe the purpose of this rule.
* priority: Relative priority of this configuration when multiple configurations match a single URL. Higher priority configurations may overwrite values set by lower priority configurations. Min value is-1000000000, max value is 1000000000.
* groups Enable or disable WAF rule groups. The keys of this object are WAF rule group IDs and the values must be a valid WAF action (usually default or disable).
* rewrite_action: When a WAF rule matches, substitute its configured action for a different action specified by this object.
ID PTR:f20cfe91-b936-4bad-a8d1-f7afa4ac32a6
Name 192.168.1.100
Type PTR
Created On 2020-04-10 09:34:49.722454606 +0000 UTC
Modified On 2020-04-10 09:34:49.722454606 +0000 UTC
TTL 900
Data
ptrdname www.example.com





 Creating type 'CNAME' resource record 

Use ibmcloud dns resource-record-create command with --type CNAME option to create a type CNAME resource record. --name and --cname are mandatory options.

$ ibmcloud dns resource-record-create $DNS_ZONE_ID --type CNAME --name web --cname www.example.com
Creating resource record in zone 'example.com:f7f40364-a5e6-48f7-9fc9-387434c579ae' for service instance 'DNS Services-km' ...
OK

ID CNAME:6e80f079-effd-409a-a520-b8c1b10f6e6e
Name web.example.com
Type CNAME
Created On 2020-04-10 09:36:13.186040793 +0000 UTC
Modified On 2020-04-10 09:36:13.186040793 +0000 UTC
TTL 900
Data
cname www.example.com





 Creating type 'AAAA' resource record 

Use ibmcloud dns resource-record-create command with --type AAAA option to create a type AAAA resource record. --name and --ipv6 are mandatory options.

$ ibmcloud dns resource-record-create $DNS_ZONE_ID --type AAAA --name www --ipv6 2019::2020
"Redirect": {
"HostName": "<bucketname>.<endpoint>",
"HttpRedirectCode": "302",
"Protocol": "https",
"ReplaceKeyWith": "error404.html"
}
}
]

The same rule codified previously can be added as an individual rule using the Console, and shown in Figure 3.

Zoom

![Add individual rules](https://cloud.ibm.com/docs-content/v1/content/63322f2f3a72050206eb05ba7f590fdcb741105c/cloud-object-storage/images/cos-sw-ui-rule-creation.jpg)

Figure 3. Add individual rules





 IBM Cloud Internet, Domain, and Delivery Services 

One of the benefits of using IBM Cloud Internet Services pertains to [setting up your own domains](https://cloud.ibm.com/docs/cis?topic=cis-set-up-your-dns-for-cis). A "domain" is part of the overall web address, consisting of a Top Level Domain (TLD) and one or more unique words separated by dots, like example.com where the TLD is com. You can choose to skip this step, but if your DNS records are not configured properly using CIS (or other service providing domain name resolution), it might leave all or part of your website inaccessible.

Static websites are meant to be fast and secure. Serving up static content is easy with the right tools that deliver the content to your customers. Many deployment tools have built-in support for CDN support. Getting started configuring your domains using [IBM Cloud® Internet Services](https://cloud.ibm.com/docs/cis?topic=cis-resolve-override-cos). When creating redirect rules, you will be adding a CNAME, a "canonical (domain) name", or alias. Just like files on an operating system can have an alias for convenience, your hosted static website can be just as convenient.
Currently, json is the only supported format.







 Deleting a secondary zone using the API 

To delete a secondary zone using the API, follow these steps:



1. Set up your [API environment](https://cloud.ibm.com/apidocs/dns-svcsauthentication) with the correct variables.
2. Store the following values in variables to be used in the API command:



* INSTANCE_ID, which is the unique identifier of a service instance.
* RESOLVER_ID, which is the unique identifier of a custom resolver.
* SECONDARY_ZONE_ID is the unique identifier of a secondary zone.
* X-Correlation-ID (optional), which uniquely identifies a request.



3. When all variables are initiated, delete a secondary zone:



curl -X DELETE https://api.dns-svcs.cloud.ibm.com/v1/instances/2be5d4a7-78f0-4c62-a957-41dc15342777/custom_resolvers/ddbe7a53-7971-46dc-b021-420335c31562/secondary_zones/f97ef698-d5fa-4f91-bc5a-33f17d143b7d -H 'Authorization: Bearer xxxxxx'