<p>Just as an idea, because I never experienced abuse reports on aws.</p>
<p>Using a CDN like cloudfront in front of the ec2 would block only the cloudfront in case of abuse report (?)</p>
<p>And in the event that the cloudfront is banned, creating another cloudfront with the same origin is easy. And you can even leave a alternative cloudfront prepared without a custom domain waiting in case they block the principal cloudfront, just having to put the domain and certificate in it. You could use CDK to be able to automate the change.</p>
<p>I suppose all this takes expense, but the idea is to put a layer in front. Sorry if this doesn't help you</p>

CC BY-SA 4.0
2024-10-29T17:40:06.970Z
2024-10-29T17:40:06.970Z
Fran Romero
<p>I have 2 Nginx servers, each of which serves around 30k domains. For each of the domains, we have SSL certificate present on that server, generated using Let's Encrypt. I map each of the domain there let's say abc.com and its subdomain <a href="http://www.abc.com" rel="nofollow noreferrer">www.abc.com</a> with IP address of this server as A record. Now, sometimes abuse report comes on any domain from Amazon and if not responded within 24 hours, Amazon blocks the IP. In that case, I have 2 options:</p>
<ol>
<li>For all the domains present on that server, change the A record there for a different server using a script, which will be a very heavy operation. Along with that, all the SSL certificates needs to be transferred to a separate server.</li>
<li>Instead of A records, we will set CNAME records for all the domains and its subdomains (e.g. abc.com and <a href="http://www.abc.com" rel="nofollow noreferrer">www.abc.com</a>) to another server with value, say pqr.xyz.com. And then, we will map that CNAME to the IP of that server at one place in a separate DNS Management in AWS/GCP. With this way, in case, an IP gets blocked by the server, I don't need to change the DNS Records for each domain. Instead, I will update the IP of the old server to new server at that one dedicated server and will transfer the certificates there using automation.</li>
</ol>
<p>Now with this approach 2, I have a disadvantage that if CNAME records are added on both root domain and subdomain then I won't be able to setup other DNS records like MX, TXT, etc.</p>
<p>I also observed that to integrate domain on Shopify, one has to add A record on root domain and CNAME record to www subdomain. But I am not sure how Shopify protects their domains from AWS Report in that case because the IPs associated with root domain and subdomain are different.</p>
<p>Can anyone please tell what would be the best or better approach here and how to protect my servers in this case?</p>

<amazon-web-services><amazon-ec2><nginx><dns><ssl>
How to protect the Nginx servers from AWS Abuse Report?
SherlockHolmesKePapa
# How to protect the Nginx servers from AWS Abuse Report?

(Asked by: username_0 on 2024-10-14)

I have 2 Nginx servers, each of which serves around 30k domains. For each of the domains, we have SSL certificate present on that server, generated using Let's Encrypt. I map each of the domain there let's say abc.com and its subdomain [www.abc.com](http://www.abc.com) with IP address of this server as A record. Now, sometimes abuse report comes on any domain from Amazon and if not responded within 24 hours, Amazon blocks the IP. In that case, I have 2 options:

1. For all the domains present on that server, change the A record there for a different server using a script, which will be a very heavy operation. Along with that, all the SSL certificates needs to be transferred to a separate server.
2. Instead of A records, we will set CNAME records for all the domains and its subdomains (e.g. abc.com and [www.abc.com](http://www.abc.com)) to another server with value, say pqr.xyz.com. And then, we will map that CNAME to the IP of that server at one place in a separate DNS Management in AWS/GCP. With this way, in case, an IP gets blocked by the server, I don't need to change the DNS Records for each domain. Instead, I will update the IP of the old server to new server at that one dedicated server and will transfer the certificates there using automation.

Now with this approach 2, I have a disadvantage that if CNAME records are added on both root domain and subdomain then I won't be able to setup other DNS records like MX, TXT, etc.

I also observed that to integrate domain on Shopify, one has to add A record on root domain and CNAME record to www subdomain. But I am not sure how Shopify protects their domains from AWS Report in that case because the IPs associated with root domain and subdomain are different.

Can anyone please tell what would be the best or better approach here and how to protect my servers in this case?

**Tags:** amazon-web-services, amazon-ec2, nginx, dns, ssl


---

## 1 answers

### Answer by username_1 on 2024-10-29. Score: 0

Just as an idea, because I never experienced abuse reports on aws.

Using a CDN like cloudfront in front of the ec2 would block only the cloudfront in case of abuse report (?)

And in the event that the cloudfront is banned, creating another cloudfront with the same origin is easy. And you can even leave a alternative cloudfront prepared without a custom domain waiting in case they block the principal cloudfront, just having to put the domain and certificate in it. You could use CDK to be able to automate the change.

I suppose all this takes expense, but the idea is to put a layer in front. Sorry if this doesn't help you


---

