content_image/742781.jpg content_image/742777.jpg content_image/742776.jpg
separate. If you need to configure different allowlists to meet your security requirements, ensure that there is sufficient overlap between the allowlists in the replication group to maximize the possibility of servers being able to reconnect in the absence of their original seed member. 

For host names, name resolution takes place only when a connection request is made by another server. A host name that cannot be resolved is not considered for allowlist validation, and a warning message is written to the error log. Forward-confirmed reverse DNS (FCrDNS) verification is carried out for resolved host names. 

<img src='content_image/742781.jpg'>

## Warning 

Host names are inherently less secure than IP addresses in an allowlist. FCrDNS verification provides a good level of protection, but can be compromised by certain types of attack. Specify host names in your allowlist only when strictly necessary, and ensure that all components used for name resolution, such as DNS servers, are maintained under your control. You can also implement name resolution locally using the hosts file, to avoid the use of external components. 

## 18.6.2 Securing Group Communication Connections with Secure Socket Layer (SSL) 

Secure sockets can be used for group communication connections between members of a group. The Group Replication system variable group_replication_ssl_mode  is used to activate the use of SSL for group communication connections and specify the security mode for the connections. The default setting means that SSL is not used. The option has the following possible values: 

<img src='content_image/742777.jpg'>

The remainder of the configuration for Group Replication’s group communication connections is taken from the server’s SSL configuration. For more information on the options for configuring the server SSL, see Command Options for Encrypted Connections. The server SSL options that are applied to Group Replication’s group communication connections are as follows: 

<img src='content_image/742776.jpg'>

