huawei-cloud-cdn-dns-resolution-diagnosis

CDN DNS Resolution Diagnosis

Overview

This skill diagnoses CDN domain DNS resolution issues. It queries the CDN domain detail via hcloud CLI to obtain the expected CNAME, probes the actual DNS resolution of the domain via scripts/dns_resolve.py (dnspython) to collect the IP list, and verifies the IP attribution via ShowIpInfo/v2 to determine whether the domain has been correctly resolved to Huawei Cloud CDN, helping users identify the root cause of DNS configuration anomalies, resolution not taking effect, false positives, and other issues.

Key Features:

• Domain permission validation and CNAME retrieval (ShowDomainDetailByName)
• DNS resolution probing to obtain the IP list (python scripts/dns_resolve.py, JSON output with data.resolved_ips inside the {result, data, error_msg} envelope)
• IP attribution check (ShowIpInfo/v2, up to 20 IPs)
• False positive identification (partial resolution scenarios prompt multi-region probing)
• Structured diagnosis report with remediation suggestions

Tools: hcloud CLI (KooCLI) + python scripts/dns_resolve.py (dnspython >= 2.1) Probe Timeout: 10 seconds (enforced by dns_resolve.py --timeout 10) IP Query Limit: 20 IPs Core Principle: Read-only diagnosis, no configuration changes

Scope

In scope: This skill diagnoses only DNS resolution issues for CDN domains, including:

• Validating that the domain belongs to the current account and retrieving the expected CNAME (ShowDomainDetailByName)
• Probing the actual A-record resolution of the domain (python scripts/dns_resolve.py, dnspython)
• Verifying whether the resolved IPs belong to Huawei Cloud CDN (ShowIpInfo/v2, up to 20 IPs per call)
• Detecting "partial resolution / false positive" scenarios and producing a structured diagnosis report with remediation suggestions

Out of scope:

• ❌ No write/modify/delete operations (this skill is read-only; see the 55 prohibited operations in ⛔ Prohibited Operations)
• ❌ No DNS record changes, no CDN configuration changes, no cache refresh/preheat
• ❌ No diagnosis of other directions: HTTPS certificate, origin-pull failures, domain ownership verification (hand off via the Related Skills section)
• ❌ No handling of requests that require configuration changes (refuse and direct the user to the console or manual hcloud CLI usage)

Applicable scenarios:

• DNS resolution failure / CNAME not taking effect / resolution timeout
• Domain resolving to non-Huawei-Cloud IPs / resolution result not matching the expected CNAME
• DNS configuration anomaly troubleshooting, false-positive investigation (partial regional switchover)

Triggers

Trigger phrases: "DNS解析诊断", "DNS异常", "域名解析失败", "CDN解析异常", "DNS配置", "DNS diagnosis", "resolution diagnosis", "CDN 域名解析", "DNS resolution issue".

User utterance examples — use this skill when the user says something like:

1. "帮我看看 www.example.com 为什么解析不到华为云 CDN" (Why is www.example.com not resolving to Huawei Cloud CDN?)
2. "CNAME 配置了但没生效，域名还是没解析到 CDN" (CNAME is configured but not taking effect; the domain still does not resolve to CDN)
3. "DNS 解析超时了，怎么排查" (DNS resolution timed out; how do I troubleshoot?)
4. "解析出来的 IP 不是华为云的，是什么问题" (The resolved IPs are not Huawei Cloud's; what is wrong?)
5. "这个域名 DNS 解析异常，帮我诊断一下" (This domain has a DNS resolution anomaly; please diagnose it)

If the user's request matches a Near-miss scenario (certificate / origin / ownership / configuration change), hand off to the corresponding skill or refuse — see Near-miss / Do NOT use.

Near-miss / Do NOT use

Do not use this skill in the following scenarios; handle them as shown:

For multi-direction diagnosis with the other skills, see Related Skills; the three related skills are independent and read-only, and can be chained in any order.

⛔ Prohibited Operations (Security Constraints)

This skill strictly forbids all non-GET (write/modify/delete) CDN operations, regardless of user requests.

Total: 55 prohibited operations (24 POST + 25 PUT + 6 DELETE).

For the complete list of all 55 prohibited non-GET operations with risk descriptions, see references/prohibited-operations.md.

Representative prohibited operations (full list in the reference doc):

If a user requests a prohibited operation, you must refuse and inform: "Per security constraints, this skill does not allow write/delete/modify operations. This skill is for DNS resolution diagnosis only. Please use the Huawei Cloud CDN console, DNS service console, or run hcloud CLI manually for configuration changes. The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."

Architecture

CDN DNS Resolution Diagnosis
├── hcloud configure list              (Credential validation)
├── ShowDomainDetailByName             (Domain permission validation + obtain CNAME)
├── python scripts/dns_resolve.py      (DNS resolution probe, JSON output)
│      --domain <domain_name>
│      [--timeout 10]
│   ├── data.resolved_ips non-empty     → Continue to Step 3
│   └── data.resolved_ips empty / error → Not resolved, generate report
├── ShowIpInfo/v2 --ips=<IP1,IP2>      (IP attribution check, up to 20 IPs)
│   ├── All belongs=true               → Resolved to Huawei Cloud
│   ├── All belongs=false              → Not resolved to Huawei Cloud
│   └── Mixed belongs                  → Partial resolution + false positive prompt
└── Generate diagnosis report

API Call Budget

Total Est. Duration: < 15 seconds

KooCLI Command Format Standard

All hcloud CDN commands follow this standard format:

hcloud CDN <Operation> --cli-region=<region> [--parameter=value ...]

Format Rules:

• Service name: CDN (uppercase)
• Operation name: PascalCase (e.g., ShowDomainDetailByName, ShowIpInfo/v2)
• Region parameter: --cli-region=<region> (recommended, use cn-north-1 for CDN)
• Parameter format: --key=value (equals sign, no space)

Examples:

# Correct
hcloud CDN ShowDomainDetailByName --cli-region=<region> --domain_name=www.example.com

# Incorrect (space-separated)
hcloud CDN ShowDomainDetailByName --cli-region <region>

Prerequisites

Prerequisite check: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required Run hcloud version to verify the version. If not installed or version is too low, see references/cli-installation-guide.md.

hcloud version

Prerequisite check: Python >= 3.8 and dnspython >= 2.1 available The DNS resolution probe runs via python scripts/dns_resolve.py, which depends on the dnspython library (>= 2.1). If the import fails, the probe exits with code 2 and an data.error.reason = "missing_library" JSON output. Install with pip install dnspython>=2.1. See references/cli-installation-guide.md.

python -c "import dns.resolver; print('dnspython ok')"

Prerequisite check: hcloud credentials configured Before performing CDN operations, you must verify hcloud credentials are configured: ``bash hcloud configure list `` If no valid credentials exist, stop and guide the user to configure credentials.

⚠️ hcloud parameter format requirements hcloud (KooCLI) all parameters must use the `--param=value` format (connected with equals sign); space-separated format is not supported. ✅ Correct: hcloud CDN ShowDomainDetailByName --cli-region=<region> ❌ Incorrect: hcloud CDN ShowDomainDetailByName --cli-region <region>

⚠️ CDN API region requirements CDN APIs only support two regions: cn-north-1 (Beijing) and ap-southeast-1 (Singapore). Query results are region-independent (CDN is a global service). Recommended: use `cn-north-1`.

⚠️ IP query limit ShowIpInfo/v2 queries at most 20 IPs per call. If dns_resolve.py returns more than 20 IPs in data.resolved_ips, only the first 20 are taken and noted in the report.

Authentication

Prerequisite check: Huawei Cloud credentials required

Security rules (must be followed): - Prohibited from reading, echoing, or printing AK/SK values - Prohibited from asking the user to input AK/SK directly in the conversation - Prohibited from using hcloud configure set to pass plaintext credential values - Prohibited from accepting AK/SK directly provided by the user in the conversation - Only allowed to read credentials from environment variables or configured CLI config files ⚠️ Important: Handling user-provided credentials If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"): - Stop immediately - Do not execute any commands - Politely refuse and return the following message: `` For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation. After configuration is complete, please retry your request. - **Do not continue** executing any Huawei Cloud operations until credentials are configured **Check CLI configuration**: bash hcloud configure list `` Check whether the output contains valid configuration (AK/SK, IAM, etc.). If no valid credentials exist, stop here.

IAM Permission Policies

Ensure the IAM user has the required permissions. See references/iam-policies.md for details.

Minimum required permissions:

• cdn:domain:get — Query domain details
• cdn:ip:info — Query IP attribution information (if the IAM policy can be split)

The actual minimum permissions are subject to the CDN service policy. Typically cdn:domain:get covers the read-only queries of ShowDomainDetailByName and ShowIpInfo/v2.

Core Commands

Quick reference for all hcloud CDN commands and probe commands used in this skill:

Notes:

• All hcloud commands should use --cli-region=<region>
• dns_resolve.py enforces a 10-second timeout via --timeout 10 (default); returns a single JSON object on stdout (wrapped in {result, data, error_msg}; business fields are inside data)
• The --ips parameter of ShowIpInfo/v2 takes multiple IPs separated by English commas, up to 20 IPs
• If dns_resolve.py returns more than 20 IPs in data.resolved_ips, only query the first 20 and note this in the report

Parameter Confirmation

Before executing the diagnosis, confirm the following parameters with the user:

User Confirmation Checklist:

• [ ] Target domain provided
• [ ] User understands this is a read-only diagnosis operation
• [ ] User understands the dns_resolve.py probe enforces a 10-second timeout
• [ ] User understands the IP attribution query limit is 20 IPs

Core Workflows

Step 1: Credential Validation and Domain Permission Check

Check hcloud credential availability, and validate the domain belongs to the current account via ShowDomainDetailByName while obtaining the CNAME.

📄 Detailed steps → references/task-permission-check.md

Step 2: DNS Resolution Probe

Resolve the domain via python scripts/dns_resolve.py --domain <domain_name> [--timeout 10] and parse the JSON data.resolved_ips field (inside the {result, data, error_msg} envelope) to obtain the actual IP list.

📄 Detailed steps → references/task-dns-resolve.md

Step 3: IP Attribution Check

Query IP attribution via ShowIpInfo/v2 to determine whether the domain has been resolved to Huawei Cloud CDN.

📄 Detailed steps → references/task-ip-attribution.md

Step 4: Generate Diagnosis Report

Aggregate probe results and generate a structured text diagnosis report.

📄 Detailed steps → references/task-report-generation.md

Step 5: Deliver Report and Remediation Suggestions

Output the diagnosis report to the user, and provide specific remediation suggestions based on the status (e.g., configure CNAME, wait for DNS to take effect, multi-region probing, etc.).

Related Skills (Multi-Direction Diagnosis)

This skill focuses on DNS resolution diagnosis. The same CDN domain may have issues in other directions. When this skill's diagnosis is complete, or when the user's problem involves one of the following directions, refer to the corresponding skill to run a synchronized diagnosis of the other directions:

Usage flow: After the DNS diagnosis report is delivered, if the user's issue also matches any row above (e.g., HTTPS access fails, domain ownership cannot be verified, or origin pull errors), invoke the corresponding skill for that direction before concluding the diagnosis. The three skills are independent and read-only; they can be chained in any order.

Note on cross-references:

• dns_resolve.py in this skill uses the host's system DNS resolver and does not expose a --resolver argument — for targeted resolver testing, switch the system DNS resolver (e.g.,

8.8.8.8 / 114.114.114.114) and re-run python scripts/dns_resolve.py --domain <domain_name> --timeout 10, as noted in references/task-ip-attribution.md.

• The skills referenced above are separate skill packages; do not call their internal scripts directly from this skill — invoke the skill itself.

FAQ (Frequently Asked Questions)

Full troubleshooting guide: references/troubleshooting.md.

Known limitations

• dns_resolve.py does not expose a --resolver argument: multi-region / multi-DNS-server probing requires switching the system DNS resolver and re-running (see troubleshooting.md)
• Only A records are probed: AAAA is not resolved, CNAME chains are not queried directly
• ShowIpInfo/v2 queries at most 20 IPs per call; excess IPs are truncated and noted in the report
• CDN APIs support only two regions: cn-north-1 and ap-southeast-1; query results are region-independent, cn-north-1 is recommended

Error code quick reference

Failure Modes

Per-step exception handling details are in the corresponding task documents; the following is a full-flow summary of failure modes and recovery strategies.

Self-check: before generating the final report, verify that all required fields are present (Analysis Time / Target Domain / Expected CNAME / DNS Resolution / Diagnosis Items / Conclusion / Suggestion); see references/verification-method.md for the verification method.

Output Format

Final output: a structured text diagnosis report. Full report template, field mapping, sample output, and examples: references/task-report-generation.md.

==================== CDN DNS Resolution Diagnosis Report ====================
Analysis Time: <ISO 8601 time>
Target Domain: <domain>
Expected CNAME: <CDN expected CNAME>

--- DNS Resolution ---
Resolved IPs: <IP1, IP2, ...>
IP Count: <count>

--- Diagnosis Items ---
[Domain Permission Check]: ✅ Pass / ❌ Fail / ⚠️ Warning
  Detail: <detail>
[DNS Resolution Probe]: ✅ Pass / ❌ Fail / ⚠️ Warning
  Detail: <detail>
  Resolved IPs: <IP list>
[IP Attribution Check]: ✅ Pass / ❌ Fail / ⚠️ Warning / N/A
  Detail: <X/Y IPs belong to Huawei Cloud CDN>

--- Conclusion ---
Status: <overall status>
Suggestion: <remediation suggestion>

Required fields:

Status enum:

Probe JSON contract (output structure): dns_resolve.py emits a single JSON object on stdout wrapped in the {result, data, error_msg} envelope; business fields are inside data.* (data.resolved_ips / data.duration_ms / data.error). data.error.reason enum: dns_nxdomain / dns_no_answer / dns_timeout / missing_library / invalid_domain / invalid_timeout / unexpected_probe_error. See references/task-dns-resolve.md.

Forbidden content: the report must NEVER include AK/SK or any plaintext credentials, must never expose other customers' domains, and must never include internal URLs / API internals; only diagnosis conclusions and remediation suggestions are allowed.

Version History (Changelog)

• Owner: cdn-ops
• Versioning policy: major behavioral changes (commands, output contract, workflow adjustments) bump the minor version and are recorded here; pure documentation fixes bump the patch version.

References