LAB 57 ‐ DNS management for 3 tier application, Public vs Private Zone - arunsinghchauhan38-arch/CLOUDARCHITECTDOC GitHub Wiki
1. What is DNS?
DNS (Domain Name System) is a naming service that translates human-readable domain names into IP addresses. It allows users and applications to access services using easy-to-remember names instead of numerical IP addresses.
For example, instead of accessing an application using its IP address:
10.0.1.25
users and applications can use a DNS name:
app.example.com
The DNS resolution process looks like this:
app.example.com → DNS Lookup → 10.0.1.25
Why is DNS important in cloud environments?
DNS is especially important in cloud environments because application components should generally communicate using DNS names instead of hard-coded IP addresses.
For example, if a backend server's IP address changes due to scaling, failover, or infrastructure changes, the application can continue using:
backend.example.com
The DNS record can then be updated to point to the new IP address without requiring changes to the application configuration.
In simple terms:
DNS provides a human-friendly and flexible way to locate applications, servers, and services over a network.
2. DNS in a 3-Tier Application
Consider a standard OCI 3-tier application architecture consisting of:
- Web Tier – Public-facing web servers or load balancer
- Application Tier – Private application servers
- Database Tier – Private database servers
In this architecture, DNS has two different requirements: one for external users and another for internal application communication.
1. External DNS Requirement — Public DNS
External users need to access the application using a publicly resolvable domain name such as:
The DNS record can point the domain name to the public IP address or public load balancer endpoint.
For example:
www.example.com → Public DNS → Public Load Balancer
This allows users on the Internet to access the application without knowing its underlying IP address.
2. Internal DNS Requirement — Private DNS
The application servers and database servers are located in private subnets and should generally not be directly accessible from the Internet.
They can use internal DNS names such as:
- app.internal.example.com
- db.internal.example.com
For example:
app.internal.example.com → Private IP → Application Server
db.internal.example.com → Private IP → Database Server
These DNS names are resolved using a Private DNS Zone, which is accessible only within the appropriate private network/VPC/VCN environment.
3. What is a DNS Zone?
A DNS Zone is a logical container that holds DNS records for a specific DNS namespace.
For example, suppose your organization owns the domain:
example.com
You can create different DNS records within the example.com zone:
The DNS zone contains the information that tells DNS how each domain name should be resolved.
Example
Zone: example.com
Records:
www.example.com → A → 129.x.x.x
api.example.com → A → 129.x.x.x
When a user requests:
www.example.com
DNS looks at the appropriate zone and returns the IP address associated with that record.
Simple Definition
A DNS Zone is a container that stores DNS records and defines how domain names within a particular namespace are resolved.
4. Public DNS Zone
A Public DNS Zone contains DNS records that are intended to be resolvable through the public DNS system.
This is typically used for applications or services that need to be accessed by users over the Internet.
For example, suppose your OCI Load Balancer has the following public IP:
129.146.10.20
You can create a public DNS zone:
Zone: example.com
and add an A record:
Name: www
Type: A
Address: 129.146.10.20
This creates the following DNS mapping:
www.example.com
|
v
Public DNS
|
v
129.146.10.20
|
v
OCI Public Load Balancer
|
v
Application
Therefore, when an Internet user enters:
the public DNS system can resolve the name to the public IP address of the OCI Load Balancer.
T### ypical 3-Tier Application Use
In a 3-tier application, Public DNS is normally used for the public-facing entry point, such as the web tier or public load balancer.
INTERNET
|
v
www.example.com
|
Public DNS Zone
|
v
OCI Public Load Balancer
|
v
Web Tier
|
v
Application Tier
|
v
Database Tier
Important Point
We generally do not create public DNS records for internal application and database servers simply because they need DNS names.
For example, we should avoid exposing:
app.example.com → 10.0.1.20
db.example.com → 10.0.2.30
as public DNS records when these are internal resources.
Instead, internal resources can use Private DNS.
5. Private DNS Zone
A Private DNS Zone is used to provide DNS name resolution within an authorized private environment.
In OCI, a private DNS zone can be associated with a VCN through a private DNS view, allowing resources in that VCN to resolve the DNS records defined in the zone.
For example:
app.internal.example.com → 10.0.1.20
db.internal.example.com → 10.0.2.30
These records are intended for internal name resolution rather than general Internet access.
Example Architecture
OCI VCN
┌─────────────────────────┐
│ │
│ Web / App Server │
│ | │
│ | DNS Query │
│ v │
│ Private DNS Zone │
│ | │
│ +-----+------+ │
│ | | │
│ v v │
│ App Server Database │
│ 10.0.1.20 10.0.2.30 │
│ │
└─────────────────────────┘
For example, instead of configuring an application with:
DB_HOST=10.0.2.30
you can configure it with:
DB_HOST=db.internal.example.com
The application then performs a DNS lookup:
db.internal.example.com
|
v
Private DNS
|
v
10.0.2.30
This is much easier to manage because the application does not need to know the database's actual private IP address.
Why Use Private DNS?
Private DNS provides several benefits:
- Avoids hard-coded private IP addresses
- Makes application configuration easier to manage
- Supports changes to private IP addresses
- Provides clear naming for internal services
- Keeps internal DNS records separate from public DNS
- Works well with multi-tier cloud architectures
Simple Definition
A Private DNS Zone provides DNS name resolution for internal resources within an authorized private network, such as an OCI VCN.
Interview Answer
If an interviewer asks "What is the difference between Public and Private DNS in OCI?", you can answer:
A Public DNS Zone is used for DNS names that need to be resolved by users or systems on the Internet, such as www.example.com pointing to a public load balancer. A Private DNS Zone is used for internal name resolution within an authorized OCI private network, such as db.internal.example.com resolving to a private database IP. In a 3-tier architecture, Public DNS is typically used for the Internet-facing web entry point, while Private DNS is used for communication between internal application and database tiers.
DNS Configuration Lab
This lab demonstrates how to configure DNS for an application running on Oracle Cloud Infrastructure (OCI).
The objective is to replace the application's public IP-based access with a user-friendly DNS name, such as itsm.example.com.
1. Accessing the ITSM Application Using the Load Balancer Public IP
As shown in the current setup, the ITSM application is accessible through the public IP address of the OCI Load Balancer.
For example:
http://157.151.201.137
Here:
- 157.151.201.137 → Public IP address of the OCI Load Balancer
- Load Balancer → Receives incoming client requests
- Backend Servers → Host the ITSM application
The current request flow is:
User
|
| HTTP Request
v
Public Load Balancer
|
| Backend Traffic
v
ITSM Application
2. Why Do We Need DNS?
Although the application is accessible using the public IP address, using an IP address is not ideal for users.
Instead of asking users to remember:
http://157.151.201.137
we can configure a DNS name such as:
http://itsm.arunsinghchauhan.online
DNS will then resolve the hostname to the Load Balancer's public IP:
itsm.arunsinghchauhan.online
|
| DNS Lookup
v
157.151.201.137
|
v
OCI Public Load Balancer
|
v
ITSM Application
This makes the application easier to access and provides a more professional and manageable architecture.
2. Purchase a Domain Name
First, purchase a domain name from a domain registrar, such as GoDaddy or any other domain registration provider.
Once the domain is registered, you can use it to create DNS records for your OCI application.
For this lab, we will use the domain:
arunsinghchauhan.online
3. Map the Load Balancer IP Address to a DNS Name
Now that we have registered the domain, the next step is to map the OCI Load Balancer's public IP address to a user-friendly DNS name.
Go to the DNS Management section of domain registrar.
For example, if the OCI Load Balancer has the public IP:
http://157.151.201.137
we can create a DNS record such as:
itsm.arunsinghchauhan.online → 157.151.201.137
This allows users to access the ITSM application using a meaningful hostname instead of the Load Balancer's IP address.
DNS request flow:
User
|
| itsm.arunsinghchauhan.online
v
DNS Management
|
| DNS Lookup
v
157.151.201.137
|
v
OCI Load Balancer
|
v
ITSM Application
Create an A Record in GoDaddy
1. Add a New DNS Record
In the DNS Management section of your domain, scroll down to the Records section.
Click Add Record to create a new DNS record.
You will then be prompted to provide details such as:
- Type
- Name
- Value
- TTL
For our OCI ITSM application, we will create an A (Address) record that maps the application hostname to the public IP address of the OCI Load Balancer.
3. Access the Application Using the DNS Name
Now that the A record has been created and mapped to the OCI Load Balancer's public IP address, we can test the DNS configuration.
Open a web browser and enter the DNS name that you configured in the record.
For example:
http://itsm.tickettool.arunsinghchauhan.online/
The DNS resolution process will work as follows:
itsm.tickettool.arunsinghchauhan.online
|
| DNS Lookup
v
157.151.201.137
|
v
OCI Public Load Balancer
|
v
ITSM Application
If the DNS configuration is correct, the ITSM application should open successfully using the domain name instead of the Load Balancer's public IP address.
Verify the Result
Previously, the application was accessed using:
http://157.151.201.137
After configuring DNS, it can be accessed using:
http://itsm.tickettool.arunsinghchauhan.online
This confirms that the DNS A record is correctly resolving the hostname to the OCI Load Balancer's public IP address.
4. Verify DNS Resolution Using the CLI
We can also verify that the DNS name is resolving correctly by using CLI commands.
For example, use the nslookup command:
nslookup itsm.tickettool.arunsinghchauhan.online
Create a CNAME Record in GoDaddy
A CNAME (Canonical Name) record is used to create an alias that points one domain name to another hostname, rather than directly to an IP address.
For example, suppose your existing hostname is:
itsm.tickettool.arunsinghchauhan.online
You can create another hostname:
support.arunsinghchauhan.online
and point it to:
itsm.tickettool.arunsinghchauhan.online
The DNS resolution will work like this:
support.arunsinghchauhan.online
|
| CNAME
v
itsm.tickettool.arunsinghchauhan.online
|
| A Record
v
157.151.201.137
|
v
OCI Load Balancer
|
v
ITSM Application
Steps to Create the CNAME Record
1. Log in to GoDaddy and open DNS Management for your domain.
- Scroll down to the DNS Records section.
- Click Add Record.
- Select CNAME as the record type.
- Enter the required values.
2. verify the CNAME using CLI
command:
nslookup -type=CNAME support.arunsinghchauhan.online
3. Now we will use this site to access our itsm tool - support.arunsinghchauhan.online