Overview
This skill diagnoses CDN domain DNS resolution issues. It queries the CDN domain detail via hcloud CLI to obtain the expected CNAME, probes the actual DNS resolution of the domain via
scripts/dns_resolve.py (dnspython) to collect the IP list, and verifies the IP attribution via ShowIpInfo/v2 to determine whether the domain has been correctly resolved to Huawei Cloud
CDN, helping users identify the root cause of DNS configuration anomalies, resolution not taking effect, false positives, and other issues.
Key Features:
- Domain permission validation and CNAME retrieval (ShowDomainDetailByName)
- DNS resolution probing to obtain the IP list (
python scripts/dns_resolve.py, JSON output withdata.resolved_ipsinside the{result, data, error_msg}envelope) - IP attribution check (ShowIpInfo/v2, up to 20 IPs)
- False positive identification (partial resolution scenarios prompt multi-region probing)
- Structured diagnosis report with remediation suggestions
Tools: hcloud CLI (KooCLI) + python scripts/dns_resolve.py (dnspython >= 2.1)
Probe Timeout: 10 seconds (enforced by dns_resolve.py --timeout 10)
IP Query Limit: 20 IPs
Core Principle: Read-only diagnosis, no configuration changes
Scope
In scope: This skill diagnoses only DNS resolution issues for CDN domains, including:
- Validating that the domain belongs to the current account and retrieving the expected CNAME (
ShowDomainDetailByName) - Probing the actual A-record resolution of the domain (
python scripts/dns_resolve.py, dnspython) - Verifying whether the resolved IPs belong to Huawei Cloud CDN (
ShowIpInfo/v2, up to 20 IPs per call) - Detecting "partial resolution / false positive" scenarios and producing a structured diagnosis report with remediation suggestions
Out of scope:
- ❌ No write/modify/delete operations (this skill is read-only; see the 55 prohibited operations in ⛔ Prohibited Operations)
- ❌ No DNS record changes, no CDN configuration changes, no cache refresh/preheat
- ❌ No diagnosis of other directions: HTTPS certificate, origin-pull failures, domain ownership verification (hand off via the Related Skills section)
- ❌ No handling of requests that require configuration changes (refuse and direct the user to the console or manual hcloud CLI usage)
Applicable scenarios:
- DNS resolution failure / CNAME not taking effect / resolution timeout
- Domain resolving to non-Huawei-Cloud IPs / resolution result not matching the expected CNAME
- DNS configuration anomaly troubleshooting, false-positive investigation (partial regional switchover)
Triggers
Trigger phrases: "DNS resolution diagnosis", "DNS anomaly", "Domain name resolution failed", "CDN resolution anomaly", "DNS configuration", "DNS diagnosis", "resolution diagnosis", "CDN domain name resolution", "DNS resolution issue".
User utterance examples — use this skill when the user says something like:
- "Help me check www.example.com why it cannot resolve to Huawei Cloud CDN" (Why is www.example.com not resolving to Huawei Cloud CDN?)
- "CNAME is configured but has not taken effect; the domain still does not resolve to CDN" (CNAME is configured but not taking effect; the domain still does not resolve to CDN)
- "DNS resolution timed out; how do I troubleshoot" (DNS resolution timed out; how do I troubleshoot?)
- "The resolved IPs are not Huawei Cloud's; what is the problem" (The resolved IPs are not Huawei Cloud's; what is wrong?)
- "This domain has a DNS resolution anomaly; help me diagnose it" (This domain has a DNS resolution anomaly; please diagnose it)
If the user's request matches a Near-miss scenario (certificate / origin / ownership / configuration change), hand off to the corresponding skill or refuse — see Near-miss / Do NOT use.
Near-miss / Do NOT use
Do not use this skill in the following scenarios; handle them as shown:
| User request | Correct handling |
|---|---|
| HTTPS certificate errors / expired or invalid certificate / HTTPS access failure (DNS resolves correctly) | Hand off to huawei-cloud-cdn-certificate-diagnosis |
| Page returns 502/504 / origin-pull failures (already resolved to Huawei Cloud CDN) | Hand off to huawei-cloud-cdn-origin-diagnosis |
| Domain cannot be added/onboarded to CDN / ownership verification failure | Hand off to huawei-cloud-cdn-domain-ownership-verification |
| User asks to modify CDN configuration, delete domains, refresh/preheat cache, or perform any other write operation | Refuse (this skill is read-only) and direct the user to the CDN console or manual hcloud CLI |
| User asks to modify DNS records (CNAME/A records) | Refuse and direct the user to the DNS service console |
For multi-direction diagnosis with the other skills, see Related Skills; the three related skills are independent and read-only, and can be chained in any order.
⛔ Prohibited Operations (Security Constraints)
This skill strictly forbids all non-GET (write/modify/delete) CDN operations, regardless of user requests.
Total: 55 prohibited operations (24 POST + 25 PUT + 6 DELETE).
For the complete list of all 55 prohibited non-GET operations with risk descriptions, see references/prohibited-operations.md.
Representative prohibited operations (full list in the reference doc):
| Prohibited Operation | API/Command | Reason |
|---|---|---|
| ❌ Create domain | CreateDomain (v1/v2), CreateDomainByDuplicate |
Write operation; creates production resource |
| ❌ Delete domain | DeleteDomain (v1/v2) |
Irreversible; removes domain from CDN |
| ❌ Modify domain config | UpdateDomainFullConfig (v1/v2), UpdateDomainOrigin, UpdateCacheRules, etc. |
Write operations; may affect production traffic |
| ❌ Enable/Disable domain | EnableDomain (v1/v2), DisableDomain (v1/v2) |
Affects production traffic |
| ❌ Modify billing mode | SetChargeModes |
Financial impact; requires explicit authorization |
| ❌ Create refresh/preheat tasks | CreateRefreshTasks (v1/v2), CreatePreheatingTasks (v1/v2) |
Write operations; affects edge cache |
| ❌ Modify DNS configuration | Any DNS write operation (e.g., nsupdate) |
Write operation; may affect global resolution |
If a user requests a prohibited operation, you must refuse and inform: "Per security constraints, this skill does not allow write/delete/modify operations. This skill is for DNS resolution diagnosis only. Please use the Huawei Cloud CDN console, DNS service console, or run hcloud CLI manually for configuration changes. The complete list of 55 prohibited operations is documented in references/prohibited-operations.md."
Architecture
CDN DNS Resolution Diagnosis
├── hcloud configure list (Credential validation)
├── ShowDomainDetailByName (Domain permission validation + obtain CNAME)
├── python scripts/dns_resolve.py (DNS resolution probe, JSON output)
│ --domain <domain_name>
│ [--timeout 10]
│ ├── data.resolved_ips non-empty → Continue to Step 3
│ └── data.resolved_ips empty / error → Not resolved, generate report
├── ShowIpInfo/v2 --ips=<IP1,IP2> (IP attribution check, up to 20 IPs)
│ ├── All belongs=true → Resolved to Huawei Cloud
│ ├── All belongs=false → Not resolved to Huawei Cloud
│ └── Mixed belongs → Partial resolution + false positive prompt
└── Generate diagnosis report
API Call Budget
| Step | API/Command | Rate Limit | Est. Duration |
|---|---|---|---|
| 1 | hcloud configure list |
— | <1s |
| 2 | ShowDomainDetailByName |
— | <2s |
| 3 | python scripts/dns_resolve.py |
— | ≤10s |
| 4 | ShowIpInfo/v2 |
— | <2s |
Total Est. Duration: < 15 seconds
KooCLI Command Format Standard
All hcloud CDN commands follow this standard format:
hcloud CDN <Operation> --cli-region=<region> [--parameter=value ...]
Format Rules:
- Service name:
CDN(uppercase) - Operation name: PascalCase (e.g.,
ShowDomainDetailByName,ShowIpInfo/v2) - Region parameter:
--cli-region=<region>(recommended, use cn-north-1 for CDN) - Parameter format:
--key=value(equals sign, no space)
Examples:
# Correct
hcloud CDN ShowDomainDetailByName --cli-region=<region> --domain_name=www.example.com
# Incorrect (space-separated)
hcloud CDN ShowDomainDetailByName --cli-region <region>
Prerequisites
Prerequisite check: Huawei Cloud CLI (hcloud / KooCLI) >= 3.2.0 required Run
hcloud versionto verify the version. If not installed or version is too low, see references/cli-installation-guide.md.
hcloud version
Prerequisite check: Python >= 3.8 and dnspython >= 2.1 available The DNS resolution probe runs via
python scripts/dns_resolve.py, which depends on thednspythonlibrary (>= 2.1). If the import fails, the probe exits with code 2 and andata.error.reason = "missing_library"JSON output. Install withpip install dnspython>=2.1. See references/cli-installation-guide.md.
python -c "import dns.resolver; print('dnspython ok')"
Prerequisite check: hcloud credentials configured
Before performing CDN operations, you must verify hcloud credentials are configured:
hcloud configure listIf no valid credentials exist, stop and guide the user to configure credentials.
⚠️ hcloud parameter format requirements
hcloud (KooCLI) all parameters must use the
--param=valueformat (connected with equals sign); space-separated format is not supported.✅ Correct:
hcloud CDN ShowDomainDetailByName --cli-region=<region>❌ Incorrect:
hcloud CDN ShowDomainDetailByName --cli-region <region>
⚠️ CDN API region requirements
CDN APIs only support two regions:
cn-north-1(Beijing) andap-southeast-1(Singapore). Query results are region-independent (CDN is a global service). Recommended: usecn-north-1.
⚠️ IP query limit
ShowIpInfo/v2queries at most 20 IPs per call. Ifdns_resolve.pyreturns more than 20 IPs indata.resolved_ips, only the first 20 are taken and noted in the report.
Authentication
Prerequisite check: Huawei Cloud credentials required
Security rules (must be followed):
Prohibited from reading, echoing, or printing AK/SK values
Prohibited from asking the user to input AK/SK directly in the conversation
Prohibited from using
hcloud configure setto pass plaintext credential valuesProhibited from accepting AK/SK directly provided by the user in the conversation
Only allowed to read credentials from environment variables or configured CLI config files
⚠️ Important: Handling user-provided credentials
If a user attempts to provide AK/SK directly (e.g., "my AK is xxx, SK is yyy"):
Stop immediately - Do not execute any commands
Politely refuse and return the following message:
For account security, please do not provide Huawei Cloud Access Key ID and Access Key Secret directly in the conversation. After configuration is complete, please retry your request.
- Do not continue executing any Huawei Cloud operations until credentials are configured
Check CLI configuration:
hcloud configure listCheck whether the output contains valid configuration (AK/SK, IAM, etc.).
If no valid credentials exist, stop here.
IAM Permission Policies
Ensure the IAM user has the required permissions. See references/iam-policies.md for details.
Minimum required permissions:
cdn:*:query*— All CDN query-class actions used by this skill (ListDomains/v2,ShowDomainDetailByName,ShowIpInfo/v2)cdn:configuration:queryDomains— List CDN domains (listed explicitly alongside the wildcard)
ShowIpInfo/v2(IP attribution) is a query-class read interface and is covered bycdn:*:query*; no separate IP-information action is required.
Core Commands
Quick reference for all hcloud CDN commands and probe commands used in this skill:
| Command | Purpose | Key Parameters |
|---|---|---|
hcloud configure list |
Check credential configuration | None |
hcloud CDN ShowDomainDetailByName --cli-region=<region> --domain_name=<domain> |
Validate domain permission + obtain CNAME | --domain_name |
python scripts/dns_resolve.py --domain <domain_name> [--timeout 10] |
DNS resolution probe; emits JSON in {result, data, error_msg} envelope with data.resolved_ips, data.duration_ms, data.error |
--domain (required), --timeout (default 10) |
hcloud CDN ShowIpInfo/v2 --cli-region=<region> --ips=<IP1,IP2> |
Query IP attribution (up to 20 IPs) | --ips |
Notes:
- All hcloud commands should use
--cli-region=<region> dns_resolve.pyenforces a 10-second timeout via--timeout 10(default); returns a single JSON object on stdout (wrapped in{result, data, error_msg}; business fields are insidedata)- The
--ipsparameter of ShowIpInfo/v2 takes multiple IPs separated by English commas, up to 20 IPs - If
dns_resolve.pyreturns more than 20 IPs indata.resolved_ips, only query the first 20 and note this in the report
Parameter Confirmation
Before executing the diagnosis, confirm the following parameters with the user:
| Parameter | Required | Description | Default | Example |
|---|---|---|---|---|
domain_name |
Yes | CDN accelerated domain to diagnose | None | www.example.com |
--cli-region |
Yes | Huawei Cloud region | cn-north-1 |
cn-north-1 |
User Confirmation Checklist:
- Target domain provided
- User understands this is a read-only diagnosis operation
- User understands the
dns_resolve.pyprobe enforces a 10-second timeout - User understands the IP attribution query limit is 20 IPs
Core Workflows
Target domain is required before any diagnosis step.
- If the user did not provide a target domain, ask the user for the domain name and wait for the reply before starting.
- Only if the user does not know the domain or asks you to look it up, list the account's domains via
hcloud CDN ListDomains/v2and ask the user to choose one.- Never start the diagnosis without an explicit user-provided domain: do not guess a domain, do not fall back to an example/default domain, and do not pick a domain from the list yourself.
Step 1: Credential Validation and Domain Permission Check
Check hcloud credential availability, and validate the domain belongs to the current account via ShowDomainDetailByName while obtaining the CNAME.
📄 Detailed steps → references/task-permission-check.md
Step 2: DNS Resolution Probe
Resolve the domain via python scripts/dns_resolve.py --domain <domain_name> [--timeout 10] and parse the JSON data.resolved_ips field (inside the {result, data, error_msg} envelope) to
obtain the actual IP list.
📄 Detailed steps → references/task-dns-resolve.md
Step 3: IP Attribution Check
Query IP attribution via ShowIpInfo/v2 to determine whether the domain has been resolved to Huawei Cloud CDN.
📄 Detailed steps → references/task-ip-attribution.md
Step 4: Generate Diagnosis Report
Aggregate probe results and generate a structured text diagnosis report.
📄 Detailed steps → references/task-report-generation.md
Step 5: Deliver Report and Remediation Suggestions
Output the diagnosis report to the user, and provide specific remediation suggestions based on the status (e.g., configure CNAME, wait for DNS to take effect, multi-region probing, etc.).
Related Skills (Multi-Direction Diagnosis)
This skill focuses on DNS resolution diagnosis. The same CDN domain may have issues in other directions. When this skill's diagnosis is complete, or when the user's problem involves one of the following directions, refer to the corresponding skill to run a synchronized diagnosis of the other directions:
| Direction | Related Skill | When to Use |
|---|---|---|
| 🔒 HTTPS certificate | huawei-cloud-cdn-certificate-diagnosis |
DNS resolves correctly but the browser reports certificate errors, expired/invalid certificate, or HTTPS access fails |
| ✅ Domain ownership verification | huawei-cloud-cdn-domain-ownership-verification |
Domain cannot be added/accessed via CDN, or ownership verification fails (DNS TXT / verification file) |
| 🔄 Origin (回源) | huawei-cloud-cdn-origin-diagnosis |
DNS resolves to Huawei Cloud CDN but the page returns 502/504 or origin-pull failures |
Usage flow: After the DNS diagnosis report is delivered, if the user's issue also matches any row above (e.g., HTTPS access fails, domain ownership cannot be verified, or origin pull errors), invoke the corresponding skill for that direction before concluding the diagnosis. The three skills are independent and read-only; they can be chained in any order.
Note on cross-references:
dns_resolve.pyin this skill uses the host's system DNS resolver and does not expose a--resolverargument — for targeted resolver testing, switch the system DNS resolver (e.g., 8.8.8.8 / 114.114.114.114) and re-runpython scripts/dns_resolve.py --domain <domain_name> --timeout 10, as noted in references/task-ip-attribution.md.- The skills referenced above are separate skill packages; do not call their internal scripts directly from this skill — invoke the skill itself.
FAQ (Frequently Asked Questions)
Full troubleshooting guide: references/troubleshooting.md.
| Issue | Quick resolution |
|---|---|
| Q1: "Credentials not configured" | Run hcloud configure interactively, or set the environment variables HUAWEICLOUD_SDK_AK / HUAWEICLOUD_SDK_SK, then verify with hcloud configure list |
| Q2: ShowDomainDetailByName returns 404 / CDN.0171 | The domain is not under the current account or not onboarded to CDN; check the spelling and account, or list onboarded domains with hcloud CDN ListDomains/v2 --cli-region=<region> --page_size=100 |
| Q3: 403 permission denied | Verify the IAM user has the CDN query permission (cdn:*:query*, plus cdn:configuration:queryDomains); contact the primary account administrator to grant permissions if needed (see references/iam-policies.md) |
| Q4: dns_resolve.py returns dns_timeout | Check local network and DNS configuration; switch the system DNS resolver (e.g., 8.8.8.8 / 114.114.114.114) and retry python scripts/dns_resolve.py --domain <domain> --timeout 10 |
| Q5: missing_library (exit code 2) | Install dnspython: pip install dnspython>=2.1 (preferred: python -m pip install dnspython>=2.1) and retry |
Known limitations
dns_resolve.pydoes not expose a--resolverargument: multi-region / multi-DNS-server probing requires switching the system DNS resolver and re-running (see troubleshooting.md)- Only A records are probed: AAAA is not resolved, CNAME chains are not queried directly
ShowIpInfo/v2queries at most 20 IPs per call; excess IPs are truncated and noted in the report- CDN APIs support only two regions:
cn-north-1andap-southeast-1; query results are region-independent,cn-north-1is recommended
Error code quick reference
| Error code / error.reason | Meaning | Handling |
|---|---|---|
| 200 | Success | Continue to the next step |
| 403 | Permission denied | Abort and prompt for authorization (see Q3) |
| 404 / CDN.0171 | Domain not under the current account | Abort and prompt to confirm ownership (see Q2) |
dns_nxdomain |
Domain does not exist | Report NXDOMAIN; check the spelling and authoritative DNS |
dns_no_answer |
No A records | Report "no A records"; check A/CNAME configuration |
dns_timeout |
Probe timeout | Mark as timeout and return partial results (see Q4) |
missing_library |
dnspython missing | Abort and prompt to install (see Q5) |
Failure Modes
Per-step exception handling details are in the corresponding task documents; the following is a full-flow summary of failure modes and recovery strategies.
| # | Failure mode | Detection point | Recovery strategy |
|---|---|---|---|
| 1 | Credentials not configured / expired | Step 1 hcloud configure list |
Abort; guide the user to hcloud configure or environment variables, then retry |
| 2 | Domain not found (404 / CDN.0171) | Step 1 ShowDomainDetailByName |
Abort; prompt to confirm domain ownership |
| 3 | Permission denied (403) | Step 1 ShowDomainDetailByName |
Abort; prompt to contact the administrator to grant cdn:*:query* (+ cdn:configuration:queryDomains) |
| 4 | API call failure (500 / network error) | Step 1 / Step 3 | Degrade: output probe results only and note "API query failed; verify IP attribution manually" in the report |
| 5 | Domain not resolved (data.resolved_ips empty) |
Step 2 JSON | Skip Step 3; report "domain not resolved" + CNAME remediation suggestion |
| 6 | Probe timeout (dns_timeout) |
Step 2 JSON | Mark "probe timeout"; return partial results; suggest switching the DNS resolver and retrying |
| 7 | NXDOMAIN / NoAnswer | Step 2 JSON | Generate the corresponding conclusion report; check the domain spelling and A-record configuration |
| 8 | dnspython missing (missing_library, exit 2) |
Step 2 import self-check | Abort; prompt to install dnspython>=2.1 |
| 9 | More than 20 IPs | Before Step 2 → Step 3 | Query only the first 20 and note "Actually resolved to N IPs; only the first 20 are verified" in the report |
| 10 | Mixed attribution (partial belongs=true) |
Step 3 ShowIpInfo/v2 |
Conclude "partially resolved / suspected false positive"; prompt multi-region verification |
| 11 | Step 3 returns empty cdn_ips |
Step 3 response | Defensive conclusion "not resolved to Huawei Cloud"; report Fail and prompt manual verification |
Self-check: before generating the final report, verify that all required fields are present (Analysis Time / Target Domain / Expected CNAME / DNS Resolution / Diagnosis Items / Conclusion / Suggestion); see references/verification-method.md for the verification method.
Output Format
Final output: a structured text diagnosis report. Full report template, field mapping, sample output, and examples: references/task-report-generation.md.
==================== CDN DNS Resolution Diagnosis Report ====================
Analysis Time: <ISO 8601 time>
Target Domain: <domain>
Expected CNAME: <CDN expected CNAME>
--- DNS Resolution ---
Resolved IPs: <IP1, IP2, ...>
IP Count: <count>
--- Diagnosis Items ---
[Domain Permission Check]: ✅ Pass / ❌ Fail / ⚠️ Warning
Detail: <detail>
[DNS Resolution Probe]: ✅ Pass / ❌ Fail / ⚠️ Warning
Detail: <detail>
Resolved IPs: <IP list>
[IP Attribution Check]: ✅ Pass / ❌ Fail / ⚠️ Warning / N/A
Detail: <X/Y IPs belong to Huawei Cloud CDN>
--- Conclusion ---
Status: <overall status>
Suggestion: <remediation suggestion>
Required fields:
| Field | Description |
|---|---|
| Analysis Time | ISO 8601 (e.g., 2026-08-12T10:00:00+08:00) |
| Target Domain | The domain being diagnosed (entered by the user) |
| Expected CNAME | The CDN expected CNAME retrieved in Step 1 |
| DNS Resolution | IP list and count from dns_resolve.py data.resolved_ips |
| Diagnosis Items | Diagnosis items in step order: name + status + detail |
| Conclusion / Suggestion | Overall conclusion and concrete remediation suggestion |
Status enum:
| Mark | Meaning | Usage scenario |
|---|---|---|
| ✅ Pass | Passed | Probe result meets expectations |
| ❌ Fail | Failed | Probe result does not meet expectations |
| ⚠️ Warning | Warning | Timeout, partial result, or suspected false positive |
| N/A | Not applicable | Step not executed (e.g., IP attribution check skipped when the domain is not resolved) |
Probe JSON contract (output structure): dns_resolve.py emits a single JSON object on stdout wrapped in the {result, data, error_msg} envelope; business fields are inside data.*
(data.resolved_ips / data.duration_ms / data.error). data.error.reason enum: dns_nxdomain / dns_no_answer / dns_timeout / missing_library / invalid_domain /
invalid_timeout / unexpected_probe_error. See references/task-dns-resolve.md.
Forbidden content: the report must NEVER include AK/SK or any plaintext credentials, must never expose other customers' domains, and must never include internal URLs / API internals; only diagnosis conclusions and remediation suggestions are allowed.
Version History (Changelog)
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | 2026-08-12 | Initial version: CDN domain DNS resolution diagnosis (permission check + DNS probe + IP attribution check + diagnosis report) |
- Owner: cdn-ops
- Versioning policy: major behavioral changes (commands, output contract, workflow adjustments) bump the minor version and are recorded here; pure documentation fixes bump the patch version.
References
| Document | Description |
|---|---|
| task-permission-check.md | Step 1: Credential validation and domain permission check |
| task-dns-resolve.md | Step 2: DNS resolution probe |
| task-ip-attribution.md | Step 3: IP attribution check |
| task-report-generation.md | Step 4: Generate diagnosis report |
| prohibited-operations.md | All 55 prohibited non-GET operations (POST/PUT/DELETE) |
| dataflow-diagram.md | Mermaid data flow diagram |
| related-apis.md | API and CLI command reference |
| iam-policies.md | IAM permission policies |
| verification-method.md | Verification method |
| cli-installation-guide.md | CLI installation guide |
| troubleshooting.md | Troubleshooting |
| acceptance-criteria.md | Acceptance criteria checklist |