Does NS1 Work in China? ICP, DNS Reachability & the Backend Layer
NS1 (now IBM NS1 Connect) is managed authoritative DNS — a backend layer that carries no ICP filing of its own and isn't where your users' data lives. IBM itself sells a separate 'DNS for China' add-on, so mainland resolution is a delivery question while the ICP duty stays on your site. A compliance-first look at the right layer to ask.
Does NS1 work in China?
Yes as plumbing, no as a compliance answer. NS1 — now IBM NS1 Connect — is managed authoritative DNS: a backend layer that resolves your domain, not where your users' data lives and not something that can hold an ICP filing. So whether your site may operate in mainland China is decided one layer up, and pointing your domain at NS1 — even IBM's separate "DNS for China" add-on — does not settle it.
IBM treats the mainland as its own problem: beneath a global anycast network of "26 Points of Presence (PoPs) strategically distributed across six continents," it sells a separate "DNS for China" add-on it describes as "A managed DNS network designed to improve DNS performance and reliability for users in mainland China." That add-on is a delivery fix, not a legal one: an ICP filing (ICP 备案) attaches to your site's in-country hosting resource, not to a DNS provider, so NS1 holds none and cannot confer one. And because DNS resolves names rather than storing your customers' records, NS1 is not itself your PIPL cross-border or data-residency exposure — that lives in your hosting and application layer. The table below is IBM's own wording and the rule each row triggers.
This is a risk map, not a verdict — which layer actually gates you turns on your site, your hosting and who your users are. Our China team can map your exposure with you →
What NS1's own documentation says about China
| Fact | Primary source |
|---|---|
| NS1 is managed authoritative DNS — a backend resolver, not a host and not a data store. In IBM's own words NS1 Connect delivers a "fully managed cloud DNS service" and "can act as both a primary (authoritative) and secondary DNS provider" — "As a primary DNS, it hosts and manages your DNS zones." DNS translates your domain to an address; it is not where your users' personal data lives, so NS1 itself is not your PIPL cross-border or data-residency exposure. | IBM NS1 Connect — Anycast DNS (ibm.com), retrieved 2026-10-07 |
| An ICP filing attaches to your website's in-country hosting, not to your DNS provider. A public site served to mainland visitors needs an ICP filing (ICP 备案) bound to a hosting resource physically inside the mainland, under State Council Order No. 292 and MIIT Order No. 33. A DNS provider is not that hosting resource, so NS1 carries no ICP of its own — and changing authoritative DNS, or adding IBM's "DNS for China" service, does not create the mainland footing a filing requires. | IBM NS1 Connect — Managed DNS (ibm.com), retrieved 2026-10-07; State Council Order No. 292; MIIT Order No. 33 |
| IBM itself treats mainland China as a separate delivery problem. On top of what it calls "a robust anycast DNS network with 26 Points of Presence (PoPs) strategically distributed across six continents," IBM sells a separate "DNS for China" add-on — "A managed DNS network designed to improve DNS performance and reliability for users in mainland China." A vendor that builds a dedicated mainland network is signalling that authoritative DNS answered from offshore anycast does not resolve the mainland reliably by itself — a reachability question, not a legal verdict. | IBM NS1 Connect — Managed DNS (ibm.com), retrieved 2026-10-07 |
| NS1 is now "IBM NS1 Connect." IBM acquired NS1 and relaunched the service under its own name: "We're excited to call this innovative solution IBM NS1 Connect," and "When launched on October 17, 2023, IBM NS1 Connect will leverage the power of DNS." The ownership and branding changed; the compliance facts did not — under any name, a DNS provider still does not carry your site's ICP filing and still sits outside the mainland unless you add its separate China service. | IBM — "IBM NS1 Connect: How IBM is delivering network connectivity with premium DNS offerings" (ibm.com case-studies blog), retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the useful question about NS1 is not how fast it resolves — it is which layer of your stack China’s rules actually land on, and whether NS1 is that layer. It is not. NS1 — now IBM NS1 Connect, after IBM’s 2023 acquisition — is managed authoritative DNS: a backend service that translates your domain into an address. It is not your website’s host, it is not where your users’ data lives, and it cannot hold an ICP filing. So “we run NS1” neither clears your site to operate in China nor, on its own, creates a data-residency problem. What it leaves you is a narrower, honest pair of questions: who files the ICP, and whether DNS answered from offshore resolves reliably inside the mainland.
NS1 in China at a glance
| What decides it | In NS1's own terms |
|---|---|
| What it is | A “fully managed cloud DNS service” that “can act as both a primary (authoritative) and secondary DNS provider” — authoritative DNS that resolves your domain. Not a web host, not a data store. |
| Where it runs | “A robust anycast DNS network with 26 Points of Presence (PoPs) strategically distributed across six continents.” Mainland China is marketed separately, not as part of this network. |
| Serving the mainland | A separate add-on, “DNS for China” — “A managed DNS network designed to improve DNS performance and reliability for users in mainland China.” Its existence says offshore DNS doesn't cover the mainland by default. |
| Who files the ICP | You do, against a mainland hosting resource (State Council Order No. 292; MIIT Order No. 33). A DNS provider is not that resource, so NS1 carries no ICP — and a China DNS add-on does not change it. |
| Your users' data | DNS resolves names; it does not store your customers' records. NS1 is not itself your PIPL cross-border or data-residency exposure — that lives in your hosting and application layer. |
NS1 is the plumbing, not the compliance layer
NS1 Connect is, in IBM’s own description, a “fully managed cloud DNS service” that “can act as both a primary (authoritative) and secondary DNS provider” — and, “as a primary DNS, it hosts and manages your DNS zones.” That is authoritative DNS: it answers the question “what address does this domain point to?” and nothing more. It does not serve your pages, it does not hold your customer records, and it is not a mainland hosting resource. China’s operating rules land on the layers NS1 points to — your public site and the host it runs on — not on the resolver itself. So the first correction to “does NS1 work in China” is that NS1 is rarely the thing being gated.
The ICP duty stays on your site, not your DNS provider
A public-facing website served to mainland visitors turns on an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33, and that filing must attach to a hosting resource physically located inside the mainland. A DNS provider is not that resource. NS1 answers queries from its own global network; it does not give you a mainland host to file against, so it carries no ICP of its own — and neither switching your authoritative DNS to NS1 nor adding IBM’s “DNS for China” service changes that. This is where “we already run NS1” runs out: resolving a domain is not the same as being cleared to operate the site it resolves to, and no DNS feature creates the mainland footing a filing needs.
Mainland resolution is a delivery question — and IBM builds for it separately
IBM’s standard network is, in its own words, “a robust anycast DNS network with 26 Points of Presence (PoPs) strategically distributed across six continents.” For mainland China it does not simply lean on that network: IBM sells a separate “DNS for China” add-on, “A managed DNS network designed to improve DNS performance and reliability for users in mainland China.” A vendor that builds and sells a dedicated mainland DNS network is, in effect, confirming the point — authoritative DNS answered from offshore anycast does not resolve reliably inside the mainland on its own. That is a reachability-and-resilience matter, the delivery half of “does it work in China,” and it is read in qualities rather than a verdict: it says nothing about whether you are permitted to operate.
What NS1 is not — the data-residency trap
It is tempting to file NS1 under “cross-border data” and move on, but that would overstate it. DNS resolves names; it does not store the personal information your application collects from Chinese users. The PIPL cross-border and localization questions — notice and separate consent, a transfer mechanism, and for a CIIO or large-volume handler in-country storage (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — are real, but they attach to your hosting and application layer, not to your authoritative DNS. Keeping that distinction straight is part of an honest risk map: NS1 is not your residency exposure, and treating it as one hides where the exposure actually sits.
This is a risk map, not a verdict: whether the gate on you is the ICP filing, mainland DNS reachability, or a data-residency duty somewhere else in your stack depends on what you serve, where it is hosted and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
You keep NS1 — IBM NS1 Connect — as your authoritative DNS. We add the one thing a resolver was never meant to be: compliant, ICP-filed delivery from inside the mainland, placed in front of your existing origin — no rebuild, no second codebase, and no change to where your DNS or your application already run. Our China team maps where your exposure actually sits — the ICP duty on your public site, mainland reachability, and any PIPL or data-residency obligations in your hosting layer — then stands up the in-country, ICP-filed delivery a lawful China presence needs, while the rest of your stack stays exactly where it is.
Related reading:
