Hybrid DNS
Resolving names between on-premises and many AWS accounts with Resolver endpoints, shared rules, private hosted zones and Route 53 Profiles.
Exam tasks: 1.1 (design hybrid DNS, integrate on-premises and AWS name resolution)
The decision: which direction do queries flow (on-premises to AWS, AWS to on-premises, or both), and how do you give hundreds of VPCs in many accounts the same DNS view without configuring each one?
The pieces
Every VPC has the built-in Route 53 Resolver (the docs now call it VPC Resolver) at the VPC base address plus
two, and at 169.254.169.253. It answers for private hosted zones, AWS names and the internet. It can't be
reached from outside the VPC, which is why hybrid DNS needs endpoints.
| Piece | Direction | What it is |
|---|---|---|
| Inbound endpoint | On-premises → AWS | ENIs in your VPC that accept DNS queries. On-premises servers conditionally forward AWS zones to these IPs |
| Outbound endpoint | AWS → on-premises | ENIs that Resolver sends queries out of, toward your DNS servers |
| Forwarding rule | AWS → on-premises | "Send corp.example.internal to 10.50.0.10 and 10.60.0.10 via this outbound endpoint." Associated with VPCs |
| System rule | Override | "Resolve aws.corp.example.internal locally," even though a forwarding rule covers the parent |
| Private hosted zone (PHZ) | Inside AWS | Authoritative records visible only to associated VPCs |
| Route 53 Profile | Distribution | Bundles PHZs, rules, DNS Firewall rule groups and query logging, shared via RAM and applied to VPCs |
Rules and precedence
- The most specific domain wins. A rule for
app.corp.example.internalbeats one forcorp.example.internal. - A forwarding rule applies to the domain and all subdomains. Carve out a subdomain with a system rule.
- If a forwarding rule and a PHZ cover the same name, the forwarding rule wins.
- A
.rule forwards everything to on-premises, except names AWS keeps as autodefined system rules (for example names AWS services need internally). - Rules are shared through AWS RAM. Sharing a rule also shares its outbound endpoint, so one endpoint per Region can serve every account.
The spoke doesn't need its own endpoints
Spoke VPCs don't need their own inbound or outbound endpoints. Associate the shared rule with the spoke VPC and its queries leave through the hub's outbound endpoint. The spoke just needs network reachability to on-premises.
Private hosted zones across accounts
- A PHZ resolves only in the VPCs associated with it. The VPC needs
enableDnsSupportandenableDnsHostnamesturned on. - Cross-account association is a two-step, API/CLI-only handshake:
- The zone owner runs
create-vpc-association-authorizationfor the other account's VPC. - The VPC owner runs
associate-vpc-with-hosted-zone. - The owner can then delete the authorization. The association stays.
- The zone owner runs
- For on-premises clients to resolve a PHZ, associate it with the VPC that holds the inbound endpoint.
- Overlapping PHZs: the most specific zone that is associated with the VPC answers. There's no fall-through: if
app.example.internalis associated but lacks a record, the query doesn't fall back toexample.internal.
Route 53 Profiles
When a question asks for the least operational overhead to give many VPCs in many accounts the same PHZs, Resolver rules and DNS Firewall settings, a Route 53 Profile shared with RAM beats scripting cross-account PHZ associations for every VPC. New VPCs get the full DNS setup with one Profile association.
The centralized DNS hub
- Put the inbound and outbound endpoints in a shared-services VPC in a network account, attached to the Transit Gateway that carries DX and VPN.
- Create forwarding rules for on-premises domains there and share them with the organization through RAM.
- Associate all PHZs with the hub VPC so the inbound endpoint can answer for them. Associate them with the spokes too, directly or through a Profile.
- On-premises DNS forwards the AWS zones (for example
aws.example.internal) to the inbound endpoint IPs.
Forwarding loops
Don't create a forwarding rule for a zone that on-premises forwards back to the inbound endpoint and associate it with the endpoint VPC. Queries bounce between on-premises and AWS until they time out.
Protect and observe DNS
| Feature | Does | Notes |
|---|---|---|
| Resolver DNS Firewall | Filters outbound queries from VPCs by domain list: allow, block (NXDOMAIN, NODATA or custom answer) or alert | AWS managed lists cover malware and botnet domains. Manage centrally with Firewall Manager. Choose fail-open or fail-closed |
| DNS Firewall Advanced rules | Detect DNS tunneling and domain generation algorithm (DGA) patterns, and filter by threat or content category | Added as rules in the same DNS Firewall rule groups |
| Resolver query logging | Logs queries from VPCs to CloudWatch Logs, S3 or Firehose | Share a logging config with RAM so every account logs to one destination |
DNS exfiltration
"Block instances from resolving known-malicious domains" or "stop data exfiltration over DNS" points to DNS Firewall. Network Firewall and security groups see port 53 to the Resolver as normal traffic.
Legacy: use Resolver endpoints instead
Before Resolver endpoints, hybrid DNS meant running your own forwarders (BIND or Windows DNS on EC2) and pointing DHCP option sets at them. It still works, but you manage patching, scaling and HA yourself.
Scenarios
One outbound endpoint and a shared rule serve every VPC, because sharing the rule shares the endpoint too. Endpoints in every VPC multiply the cost. An inbound endpoint receives queries and doesn't forward them to on-premises. Copying records into a PHZ creates a second source of truth that drifts.
The inbound endpoint answers with whatever its own VPC can resolve, so the PHZ must be associated with the shared-services VPC. Because the zone lives in another account, that takes an authorization in the zone owner's account followed by the association from the VPC's account. An outbound endpoint handles the opposite direction, making the zone public exposes internal names, and system rules in app accounts don't affect the endpoint VPC.