vania-janet/multiturn-rag-retrieval-data huggingface dataset:
A moved domain might stop serving traffic, and could potentially be deleted. If your domain is in moved state and you believe this is in error, [contact IBM Support](https://cloud.ibm.com/docs/cis?topic=cis-gettinghelp).
7. Moved domains could potentially be deleted automatically, or by the user.





 Domain lifecycle states 

You may encounter any of the following domain lifecycle states:



* Pending: The zone has been added to a CIS instance, and the DNS configuration is being verified at the DNS provider or registrar to activate the domain. After confirmation that the correct nameservers (or CNAME validation records) have been configured the domain is transitioned to active. The domain remains pending otherwise.
* Active: The DNS configuration has been verified and the domain is actively serving traffic, taking advantage of the Cloudflare products.
* Moved: The zone was active, but DNS validation detected that the domain is no longer configured for the assigned authoritative name servers only, for a number of repeated checks. There is an implication that the DNS could be pointed back, but this state is the start of a zone deprovision. The domain stays in a moved state for 7 days, or indefinitely if there is an active subscription on the zone. If the same domain becomes active or pending in a different account, this domain will no longer serve traffic because pending or active zones take precedence.
* Deletion pending: (Enterprise only) The customer initiated the deletion of this domain from the CIS instance. Enterprise domains can take up to 24 hours to be completely removed.
* Deleted: Removed from a customers dashboard and services deprovisioned, but not removed from the Cloudflare database.
Valid values are any, all.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

List all dns records in domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis dns-records 31984fea73a15b45779fa0df4ef62f9b -i "cis-demo"







 ibmcloud cis dns-records-import 

Import your BIND config.

ibmcloud cis dns-records-import DNS_DOMAIN_ID --file FILE [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

--file
: BIND config to import. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Import BIND config in domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis dns-records-import 31984fea73a15b45779fa0df4ef62f9b --file bind_config_file.txt -i "cis-demo"







 ibmcloud cis dns-records-export 

Export BIND config.

ibmcloud cis dns-records-export DNS_DOMAIN_ID [--file FILE] [-i, --instance INSTANCE]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

--file
: The BIND config file that saves exported DNS records.

-i, --instance
: Instance name or ID.
Best practices for CIS setup 

Because IBM Cloud® Internet Services is positioned at the edge of your network, you’ll need to take a few steps to guarantee a smooth integration with your CIS services. Here are some recommended best practices for integrating CIS with your origin servers.

You can do these steps either before or after you change your DNS and activate our proxy service. These recommendations allow CIS to connect to your origin servers properly. They’ll help you prevent any issues with API or HTTPS traffic, and help your logs capture the correct IP addresses of your customers, rather than the protective CIS IP addresses.

Here’s what you’ll need to set up:



* Restore the originating IPs of your customers
* Incorporate CIS IP addresses
* Make sure your security settings don't interfere with API traffic
* Configure your security settings as strictly as possible





 Best practice 1: Know how to restore the originating IPs of your customers 

As a reverse proxy, CIS provides the origination IP in these headers:



* CF-Connecting-IP
* X-Forwarded-For
* True-Client-IP (optional)



You can restore user IP addresses using a variety of tools, for infrastructures such as Apache, Windows IIS, and NGINX.





 Best practice 2: Incorporate CIS IP addresses to make integration smoother 

Here are the two steps to take:



* Remove any rate limiting of CIS IP addresses
* Set up your ACLs to allow only CIS IP addresses and other trusted parties



You can find the updated list of IP ranges for IBM CIS [at this location](https://cloud.ibm.com/docs/cis?topic=cis-cis-allowlisted-ip-addresses).





 Best practice 3: Review your security settings to make sure they don’t interfere with API traffic 

IBM CIS usually accelerates API traffic by removing connection overhead. However, the default security stance can interfere with many API calls. It is recommended that you take a few actions to prevent interference with your API traffic after proxying is active.



* Turn security features off selectively, using the Page Rules features.



* Create a Page Rule with the URL pattern of your API, such as api.example.com
* Add the following rule behaviors:
: The ID of DNS domain. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

Create an access application for domain 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis access-app-create 31984fea73a15b45779fa0df4ef62f9b --name exampleCreate --domain example.com --session-duration 12h -i cis-demo







 ibmcloud cis access-apps 

List all access applications for a given DNS domain (Enterprise plan only).

ibmcloud cis access-apps DNS_DOMAIN_ID [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

-i, --instance
: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.

--output
: Specify output format, only JSON is supported.





 Examples 

List all access applications for domains 31984fea73a15b45779fa0df4ef62f9b.

ibmcloud cis access-apps 31984fea73a15b45779fa0df4ef62f9b -i cis-demo







 ibmcloud cis access-app 

Show details of an access application (Enterprise plan only).

ibmcloud cis access-app DNS_DOMAIN_ID ACCESS_APPLICATION_ID [-i, --instance INSTANCE] [--output FORMAT]



 Command options 

DNS_DOMAIN_ID
: The ID of DNS domain. Required.

ACCESS_APPLICATION_ID
: The ID of access application. Required.

-i, --instance
: Instance name or ID.
This allows the client devices to cache the private DNS hostname until the A records are created.





 Unbinding a DNS zone to an existing load balancer in the UI 

To unbind a DNS zone from a load balancer, follow these steps:



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2. Select the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the upper left, then click VPC Infrastructure > Load balancers in the Network section.
3. From the list of load balancers, select the load balancer to view its details page.
4. Click the Unbind button in the Private DNS section
5. Verify the action by clicking Unbind again.









 Working with DNS zones from the CLI 

You can bind and unbind DNS zones to a network load balancer during provisioning, or to an existing load balancer.



 Creating a load balancer bound to a private DNS zone from the CLI 

You will need the CRN of the private DNS that you want to bind to your load balancer. To find it, click Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Resource List from the IBM Cloud console. Click the table row of the DNS whose CRN you want to find. The CRN is shown in the side panel that appears.

To create a network load balancer with a private DNS zone, follow these steps:



1. Set up your [CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).
2. Use the terminal to log in to your account. After you enter the password, the system prompts which account and region that you want to use:
However, on the Origins page, you can configure different types of origins (COS or origin server). You can also edit or delete origins on this page.
* Why can't I change the protocol and port for an origin?

 Why can't I change the protocol and port for an origin? 

The displayed protocol and port options match what you selected when you ordered the CDN. For example, if you selected an HTTP port when you ordered a CDN, only the HTTP port option is shown as part of Add Origin.
* How many origins can I add to a CDN?

 How many origins can I add to a CDN? 

See [Known limitations](https://cloud.ibm.com/docs/CDN?topic=CDN-limits-and-maximum-valuesis-there-a-limit-on-the-number-of-origin-and-ttl-entries) for the number of origins per CDN.
* Will deleting a CDN also delete my account?

 Will deleting a CDN also delete my account? 

No. Selecting Delete deletes only the CDN; it does not delete your account.
* Why is the DV SAN certificate CDN still there after I deleted it?

 Why is the DV SAN certificate CDN still there after I deleted it? 

If your CDN is configured with HTTPS with DV SAN certificate, it can take up to 5 hours to complete the deletion process.
* Why did the deletion of the DV SAN certificate domain fail? It shows that the domain is still live on the network.

 Why did the deletion of the DV SAN certificate domain fail? It shows that the domain is still live on the network. 

If your CDN is configured with DV SAN certificate HTTPS, you must remove the DNS record that points your domain to the [IBM CNAME](https://cloud.ibm.com/docs/CDN?topic=CDN-next-steps-after-orderingibm-cname) before deleting your CDN.
ibmcloud cis routing-update DNS_DOMAIN_ID (--smart-routing (on|off) | --tiered-caching (on|off)) -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! !
<-- <section "id="section-update-routinge-options" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--smart-routing: Leverages real-time network intelligence to route traffic across paths from the origin to a CIS data center. Valid values: on, off.--tiered-caching: Uses regional Tier 1 CIS data centers to accelerate content delivery. Valid values: on, off.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-update-routinge-options" "> --><-- <section "id="section-update-routing-examples" "> --> Examples Update routing settings for domain 372e67954025e0ba6aaa6d586b9e0b60. ibmcloud cis routing-update 31984fea73a15b45779fa0df4ef62f9b --smart-routing on --tiered-caching on -i "cis-demo"
<-- </section "id="section-update-routing-examples" "> --><-- </section "id="section-update-routing" "> --><-- <section "id="section-display-routing-analytics" "> --> ibmcloud cis routing-analytics Get analytics of smart-routing latency. (Enterprise plans only) ibmcloud cis routing-analytics DNS_DOMAIN_ID --colos] -i, --instance INSTANCE] --output FORMAT] ! ! ! ! ! ! !
Deprecated] ibmcloud cis origin-certificate-create DNS_DOMAIN_ID --json-str JSON_STR -i, --instance INSTANCE] --output FORMAT]
Deprecated] ibmcloud cis origin-certificate-create DNS_DOMAIN_ID --json-file JSON_FILE -i, --instance INSTANCE] --output FORMAT] ! !!!!!!
<-- <section "id="section-command-options-origin-certificate-create" "> --> Command options DNS_DOMAIN_ID: The ID of DNS domain. Required.--request-type REQUEST_TYPE: Signature type desired on certificate. Valid values: origin-rsa, origin-ecc.--hostnames HOSTNAME: hostname or wildcard name bound to the certificate.--requested-validity DAYS: The number of days for which the certificate should be valid. The default value is 5475.--csr CSR: The Certificate Signing Request (CSR). If not set, CIS will generate one.--json value: The JSON file or JSON string used to describe an origin certificate.
<-- <ul> -->

* The required fields in JSON data are request_type, hostnames.

<-- <ul> -->

* request_type: Signature type desired on certificate. Valid values: origin-rsa, origin-ecc.
* hostnames: Array of hostnames or wildcard names bound to the certificate.

<-- </ul> -->

* The optional fields are requested_validity, csr.

<-- <ul> -->

* requested_validity: The number of days for which the certificate should be valid. Valid values: 0, 7, 30, 90, 365, 730, 1095, 5475.
* csr: The Certificate Signing Request (CSR). If not set, CIS will generate one.

<-- </ul> -->

<-- </ul> -->

Sample JSON data:
{
Working with load balancers and existing DNS records 

A IBM Cloud® Internet Services load balancer is identified by the DNS hostname whose traffic you want to balance (for example, www.example.com). The load balancer defines which origin server pools to use, the order in which they are used, and how to geographically distribute traffic among pools.

When you create a load balancer on CIS, you can do one of the following:



*  Use a unique hostname with no existing DNS record
*  Use a hostname that has an existing DNS record (an A, AAAA, or CNAME record)



If a hostname has an existing DNS record, the load balancer supersedes the DNS record if the DNS record is an A, AAAA, or canonical name (CNAME) record. It does not supersede other record types.

If the load balancer is disabled, preexisting DNS records are served.

If there is no preexisting DNS record with the same name, disabling the load balancer prevents clients from resolving the host, and requests fail.

If a load balancer is manually disabled, traffic is not served to the associated origins or the fallback. If all pools in a load balancer are manually disabled, the fallback origin is used unless the fallback is also disabled. If the fallback is also disabled, the SOA record is served. Otherwise, if there is one pool in the load balancer and the pool is unhealthy, CIS sends traffic to the fallback pool regardless of the fallback pool's health.



  HTTP keep-alive (persistent HTTP connection) 

CIS maintains keep-alive connections to improve performance and to reduce the cost of recurring TCP connects in the request transaction as CIS proxies customer traffic from its edge network to the site's origin.

Ensure that HTTP keep-alive connections are enabled on your origin. CIS reuses open TCP connections for up to 15 minutes (900 seconds) after the last HTTP request. Origin web servers close TCP connections if too many are open. HTTP keep-alive helps avoid the premature reset of connections for requests that are proxied by CIS.
This allows the client devices to cache the private DNS hostname until the A records are created.





 Unbinding a DNS zone to an existing load balancer in the UI 

To unbind a DNS zone from a load balancer, follow these steps:



1. From your browser, open the [IBM Cloud console](https://cloud.ibm.com/login) and log in to your account.
2. Select the Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) from the upper left, then click VPC Infrastructure > Load balancers in the Network section.
3. From the list of load balancers, select the load balancer to view its details page.
4. Click the Unbind button in the Private DNS section
5. Verify the action by clicking Unbind again.









 Working with DNS zones from the CLI 

You can bind and unbind DNS zones to an application load balancer during provisioning, or to an existing load balancer.



 Creating a load balancer bound to a private DNS zone from the CLI 

You will need the CRN of the private DNS that you want to bind to your load balancer. To find it, click Navigation Menu icon ![Navigation Menu icon](https://cloud.ibm.com/docs-content/v1/content/icons/icon_hamburger.svg) > Resource List from the IBM Cloud console. Click the table row of the DNS whose CRN you want to find. The CRN is shown in the side panel that appears.

To create an application load balancer with a private DNS zone, follow these steps:



1. Set up your [CLI environment](https://cloud.ibm.com/docs/vpc?topic=vpc-infrastructure-cli-plugin-vpc-reference).
2. Use the terminal to log in to your account. After you enter the password, the system prompts which account and region that you want to use:
The plug-in abstracts the IBM Cloud® APIs that are used to provision, update, or delete domain resources.
* Create a Terraform configuration file that is named main.tf. In this file, you add the configuration to create a domain resource. For more information, see the [Terraform documentation](https://www.terraform.io/docs/language/index.html).





1. Create a CIS instance by using the ibm_resource_instance resource argument in your main.tf file. The following example creates an ibm_dns_domain_registration_nameservers resource with an ID of data.ibm_dns_domain_registration.dns-domain-test.id and two name servers called ns006.name.ibm.cloud.com and ns017.name.ibm.cloud.com. The name of the domain resource is test-domain.com.

For more information, see the [ibm_dns_domain_registration_nameservers](https://registry.terraform.io/providers/IBM-Cloud/ibm/latest/docs/resources/dns_domain_registration_nameservers) usage example.

resource "ibm_dns_domain_registration_nameservers" "dns-domain-test" {
dns_registration_id = data.ibm_dns_domain_registration.dns-domain-test.id
name_servers = ["ns006.name.ibm.cloud.com", "ns017.name.ibm.cloud.com"]
}

data "ibm_dns_domain_registration" "dns-domain-test" {
name = "test-domain.com"
}
2. After you finish building your configuration file, initialize the Terraform CLI. For more information, see [Initializing Working Directories](https://www.terraform.io/cli/init).

terraform init
3. Provision the resources from the main.tf file. For more information, see [Provisioning Infrastructure with Terraform](https://www.terraform.io/cli/run).
Securing your data in DNS Services 

To ensure that you can securely manage your data when you use IBM Cloud® DNS Services, it is important to know exactly what data is stored and encrypted and how you can delete any stored personal data.



  How your data is stored and encrypted in DNS Services 

The DNS Services data which includes DNS Services instance, DNS zone, permitted networks and DNS resource records is encrypted at rest in a Cloudant database. The data is also encrypted in transit using SSL.





  Deleting your data in DNS Services 

After DNS records are deleted from a DNS zone, they are deleted immediately from the database. The DNS zone itself is retained for seven days from deletion.



  Deleting DNS Services instances 

DNS Services instance data is retained for seven days from deletion.

The DNS Services data retention policy describes how long your data is stored after you delete the service. The data retention policy is included in the DNS Services service description, which you can find in the [IBM Cloud Terms and Notices](https://cloud.ibm.com/docs/overview?topic=overview-terms).
Provides a way to alias a hostname to another hostname or Canonical Name (CNAME).





 PTR (Pointer) 

Enables reverse DNS lookup, from an IP address (IPv4 or IPv6) to a hostname





 MX (Mail Exchange) 

This record specifies the SMTP mail server for the DNS zone.





 SRV (Service Location) 

This record specifies the location of one or more of the servers for a specific protocol and domain.





 TXT (Text) 

This record is used to hold descriptive text for a given name.





 NS (Name Server) 

You cannot create this type of record in DNS zone, but you can query for your DNS zone. The data that is returned is statically defined and cannot be changed.





 SOA (Start of Authority) 

You cannot create this type of record in DNS zone, but you can query for your DNS zone. The data that is returned is statically defined and cannot be changed.
Will deleting a CDN also delete my account? 

No. Selecting Delete deletes only the CDN; it does not delete your account.
* Why is the DV SAN certificate CDN still there after I deleted it?

 Why is the DV SAN certificate CDN still there after I deleted it? 

If your CDN is configured with HTTPS with DV SAN certificate, it can take up to 5 hours to complete the deletion process.
* Why did the deletion of the DV SAN certificate domain fail? It shows that the domain is still live on the network.

 Why did the deletion of the DV SAN certificate domain fail? It shows that the domain is still live on the network. 

If your CDN is configured with DV SAN certificate HTTPS, you must remove the DNS record that points your domain to the [IBM CNAME](https://cloud.ibm.com/docs/CDN?topic=CDN-next-steps-after-orderingibm-cname) before deleting your CDN. Otherwise, the deletion fails with the error message 'Delete CDN failed: the xxxxxx is still live on network, please remove the DNS record pointing to Akamai.'

If you already deleted the DNS record that points your domain to the [IBM CNAME](https://cloud.ibm.com/docs/CDN?topic=CDN-next-steps-after-orderingibm-cname) and you still get an error, wait 15 - 30 minutes for the DNS update to take effect.
* What is a Content Delivery Network (CDN)?

A Content Delivery Network (CDN) is a collection of Edge servers that are distributed through various parts of the country or the world. Their web content is served from an Edge server, which is located in the geographic area closest to the customer who requests the content. This technique lets the users receive the content with less delay than we might achieve by delivering the content from one centralized location. It delivers a better overall experience for your customers.
* How does a Content Delivery Network (CDN) work?

A CDN achieves its purpose by caching web content on Edge servers around the world.
Let's say we have two zones, domain.example.com and example.com.

Records for example.com

{
myhost.domain.example.com A 1.1.1.1
me.domain.example.com A 8.8.8.8
}

Records for domain.example.com

{
myhost.domain.example.com A 2.2.2.2
}

If a user queries for myhost.domain.example.com, the expected result (which is 2.2.2.2) should come from domain.example.com, because domain.example.com is the longest match with the user query.

If they queried for me.domain.example.com instead, the resolver searches only the longest matching zone. Because me.domain.example.com does not exist in domain.example.com, the result is an NXDOMAIN.





 Using the IBM Cloud console 

DNS zones can be managed through the IBM Cloud® console, or the API. The following sections cover the console usage.



 Creating a DNS zone 



1. From the Resource page, select the desired DNS Services instance.
2. Click the Create Zone button on the DNS Zones page.
3. In the panel that appears, enter your zone name in the Name field. Optionally, enter Label and Description fields. See [Restricted DNS zone names(#restricted-dns-zone-names) for information about what names are not permitted.
4. Click Create Zone.



If the zone creation is successful, you are directed to the Zone Details page.

Newly added zones have a pending state until you add permitted networks to the zone. The zone becomes active after permitted networks are added.

If the zone creation is unsuccessful, an error notification appears with information about what caused the error.



 Restricted DNS zone names 

Subdomains to any of the restricted 2-level zones are not permitted. For example, my.host.ibm.com is a subdomain to ibm.com. Therefore, my.host.ibm.com is also a restricted zone.

The following DNS zone names are not permitted.