Public DNS resolver · Alibaba Cloud
AliDNS (Alibaba Cloud Public DNS) DNS servers
AliDNS (Alibaba Cloud Public DNS) (run by Alibaba Cloud) answers on 223.5.5.5 and 223.6.6.6, with DNS over TLS at dns.alidns.com. In our 2026-09-24 test it did not validate DNSSEC and sent a /25 client subnet to authoritative servers.
- Addresses
- 4
- Variants
- 1
- Measured
- 2026-09-24
- Operator
- Alibaba Cloud
- Primary IPv4
- 223.5.5.5
- All IPv4
- 223.5.5.5, 223.6.6.6
- All IPv6
- 2400:3200::1, 2400:3200:baba::1
- DNS over HTTPS
- not documented
- DNS over TLS
- dns.alidns.com
- Service variants
- 1 (AliDNS)
- DNSSEC in our test
- Does not validate
- Client subnet (ECS)
- Sends /25
- Protocols
- DNS (53), DoT
AliDNS (Alibaba Cloud Public DNS) DNS addresses by variant
| Variant | Filtering (operator description) | IPv4 | IPv6 | Encrypted |
|---|---|---|---|---|
| AliDNS | Not specified by the operator | 223.5.5.5223.6.6.6 | 2400:3200::12400:3200:baba::1 | DoT dns.alidns.com |
The operator lists dns.alidns.com as its DoH and DoT address without a full DoH URL.
What we observed
- DNSSEC validation
- Does not validate Returned addresses for dnssec-failed.org, rhybar.cz and badsig.go.dnscheck.tools, which a validating resolver would refuse.
- Client subnet (ECS)
- Sends /25. The authoritative server received that much of the client address, enough to locate a user to a block of addresses.
- Plain DNS and NXDOMAIN
- 2/2 documented IPv4 addresses answered on port 53. Random non-existent names came back as NXDOMAIN, so errors are not rewritten into ads or search pages.
| Protocol | Endpoint | Our test query |
|---|---|---|
| DoT | dns.alidns.com | Answered |
Which networks carry it
| ASN | Holder | Role |
|---|---|---|
| AS45102 | ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. | Announces the service addresses |
| AS45102 | ALIBABA-CN-NET - Alibaba (US) Technology Co., Ltd. | Queried from, in our probe |
Operator statements
“支持用户ECS扩展技术，智能解析”
Confirm your device is using AliDNS (Alibaba Cloud Public DNS)
# Which address did the resolver query from?
dig +short whoami.akamai.net @223.5.5.5
# Does it pass your subnet on (ECS)?
dig +short TXT o-o.myaddr.l.google.com @223.5.5.5
# Does it validate DNSSEC? SERVFAIL means yes
dig dnssec-failed.org @223.5.5.5Behind a proxy
With an HTTP proxy, or a client set to socks5h://, the proxy side resolves hostnames, so your own resolver setting does not apply to that traffic. With socks5:// in curl or Python requests, your device resolves names first. The SOCKS5 vs SOCKS5h guide shows how to check which one you have.
AliDNS (Alibaba Cloud Public DNS) questions
- What are AliDNS (Alibaba Cloud Public DNS)'s DNS server addresses?
- AliDNS: 223.5.5.5, 223.6.6.6, 2400:3200::1, 2400:3200:baba::1.
- Does AliDNS (Alibaba Cloud Public DNS) validate DNSSEC?
- Not in our 2026-09-24 test: it returned addresses for all three deliberately mis-signed domains.
- Does AliDNS (Alibaba Cloud Public DNS) support DNS over HTTPS or DNS over TLS?
- DoT: dns.alidns.com. 1 of 1 answered our test query on 2026-09-24.
- Does AliDNS (Alibaba Cloud Public DNS) send my IP subnet to other servers (ECS)?
- Yes on at least one address: we observed a /25 client subnet reaching the authoritative server.
- How can I check that I am using AliDNS (Alibaba Cloud Public DNS)?
- Run a DNS leak test and compare the network it reports with the one AliDNS (Alibaba Cloud Public DNS) queried from in our probe (AS45102). On the command line, dig +short whoami.akamai.net @223.5.5.5 returns the address the resolver used to query Akamai.
Sources
Documentation checked 2026-09-24. Measured 2026-09-24. Registry reviewed 2026-09-24.
Addresses and endpoints come from each operator's documentation; behaviour is what we measured from one location on 2026-09-24. Speed, uptime and how well a filter blocks what it promises were not tested.