Route 53 Resolver & Hybrid DNS — Overview
Hybrid DNS is a key ANS-C01 topic (85 questions) that tests Resolver endpoints (inbound/outbound), conditional forwarding, DNSSEC, split-horizon DNS, and private hosted zone associations. Understanding DNS resolution flow between on-premises and AWS is critical.
(Active Directory DNS)
Resolves: corp.internal
(on-prem queries AWS)
(AWS queries on-prem)
(VPC .2 address)
Resolves: aws.internal
+ public DNS
Resolver Endpoints
| Endpoint | Direction | Use Case |
|---|---|---|
| Inbound | On-premises → AWS (queries FROM on-prem resolved by Route 53) | On-prem servers need to resolve AWS private hosted zones (e.g., rds.internal.aws) |
| Outbound | AWS → On-premises (queries FROM VPC forwarded to on-prem DNS) | EC2 instances need to resolve on-prem domains (e.g., ldap.corp.internal) |
- Inbound endpoint: Creates ENIs in your VPC with IP addresses. On-prem DNS forwards to these IPs. Requires DX/VPN connectivity.
- Outbound endpoint: Creates ENIs that forward DNS queries to on-prem DNS servers. Uses forwarding rules to determine which domains go where.
- Multi-AZ: Always deploy endpoints in 2+ AZs for availability (min 2 ENIs per endpoint).
Forwarding Rules
- Conditional forwarding: “If query matches *.corp.internal → forward to 10.0.1.53 (on-prem DNS)”
- System rules: Auto-created for VPC CIDR reverse DNS and private hosted zones
- Recursive: Default behavior — Route 53 Resolver recursively resolves public domains
- Rule sharing: Share forwarding rules via RAM to other accounts (centralized DNS management)
- Rule priority: Most specific domain match wins (corp.internal beats .internal beats .)
Private Hosted Zones
- What: DNS zone accessible only from associated VPCs (not public internet)
- Cross-account: Associate private hosted zone with VPCs in other accounts (via CLI/API authorization)
- Split-horizon: Same domain name (example.com) resolves differently: public hosted zone → internet users, private hosted zone → VPC users. Private takes precedence inside VPC.
- Overlap: If multiple private hosted zones match, most specific wins (a.b.example.com > b.example.com)
DNSSEC
- What: Cryptographic signing of DNS records to prevent spoofing/tampering
- Route 53 supports: DNSSEC signing for public hosted zones (KMS-backed signing key)
- Validation: Route 53 Resolver validates DNSSEC signatures on responses (enable per VPC)
- Chain of trust: Root → TLD → domain. All must have DNSSEC for full validation.
- Exam note: “Prevent DNS spoofing” → DNSSEC signing + validation. “DNS poisoning protection” → DNSSEC.
Route 53 Resolver DNS Firewall
- What: Filter DNS queries from your VPC (block queries to malicious domains)
- Rules: ALLOW, BLOCK, or ALERT on domain lists (managed or custom)
- Managed lists: AWS provides threat intelligence domain lists (malware, botnet C2)
- Use case: Prevent DNS-based data exfiltration, block known malicious domains, compliance
- Priority: DNS Firewall → Forwarding Rules → Resolver. Firewall evaluates first.
Exam Tips
| Exam | Key Points |
|---|---|
| ANS-C01 | “On-prem resolve AWS private zones” → Inbound Resolver endpoint. “AWS resolve on-prem domains” → Outbound + forwarding rules. “Centralize DNS rules across accounts” → share rules via RAM. “Prevent DNS spoofing” → DNSSEC. “Block malicious DNS queries” → DNS Firewall. “Same domain different answers internal vs external” → split-horizon (public + private hosted zone). “Cross-account private hosted zone” → associate + authorize. |
AWS Certification Exam Practice Questions
Question 1:
A company has on-premises Active Directory DNS resolving corp.internal. EC2 instances in AWS need to resolve hostnames in corp.internal (e.g., ldap.corp.internal). The VPCs are connected to on-premises via Direct Connect. Which configuration enables this?
- Create a Route 53 private hosted zone named corp.internal with manual records
- Create a Route 53 Resolver outbound endpoint + forwarding rule for corp.internal pointing to on-premises DNS server IPs
- Configure EC2 instances to use on-premises DNS servers directly (change DHCP options)
- Create an inbound resolver endpoint for on-premises to query
Show Answer
Answer: B — Outbound endpoint forwards DNS queries from VPC to on-premises DNS. Forwarding rule specifies: if query matches *.corp.internal → forward to on-prem DNS IPs (10.0.1.53, 10.0.2.53). EC2 instances use the VPC Resolver (.2 address) as normal — it transparently forwards matching queries. DHCP option (C) works but loses Route 53 features and breaks AWS service DNS. Inbound (D) is the reverse direction.
Question 2:
On-premises servers need to resolve private hostnames in AWS (e.g., mydb.internal.aws which points to an RDS instance in a private hosted zone). Which configuration allows on-premises DNS to resolve these AWS-hosted names?
- Make the private hosted zone public
- Create a Route 53 Resolver inbound endpoint in the VPC. Configure on-premises DNS to forward *.internal.aws queries to the inbound endpoint IPs.
- Create a public hosted zone with the same records
- Add the records to on-premises DNS manually
Show Answer
Answer: B — Inbound endpoint creates ENIs in your VPC that accept DNS queries from outside the VPC. On-premises DNS is configured with a conditional forwarder: *.internal.aws → inbound endpoint IPs. Queries travel over DX/VPN to the endpoint, Route 53 Resolver resolves from the private hosted zone, returns the answer. Making it public (A) exposes internal records to the internet.
Question 3:
A company wants the domain api.example.com to resolve to a public ALB IP for internet users, but to a private ALB IP for users inside the VPC (avoiding internet round-trip). How should this be configured?
- Create two A records in the public hosted zone with geolocation routing
- Create a public hosted zone with public ALB record + a private hosted zone (same name) with private ALB record associated with the VPC
- Use CloudFront to route differently based on source
- Configure the ALB to return different IPs based on source IP
Show Answer
Answer: B — Split-horizon DNS: public hosted zone (api.example.com → public ALB) serves internet queries. Private hosted zone (api.example.com → private ALB IP) serves VPC queries. When a VPC instance queries api.example.com, the private zone takes precedence (VPC Resolver checks private zones first). Internet users hit the public zone. Same domain, different answers based on source.
Related Posts
- Global Traffic Management (Route 53 Routing Policies)
- Direct Connect Deep Dive
- Hybrid Cloud Networking
- VPC Advanced Networking
References
Frequently Asked Questions
Inbound vs Outbound endpoint — which do I need?
Inbound: When on-premises needs to resolve AWS domains (on-prem → AWS). On-prem DNS forwards to inbound endpoint IPs. Outbound: When AWS instances need to resolve on-premises domains (AWS → on-prem). Forwarding rules send matching queries to on-prem DNS. Most hybrid environments need BOTH: inbound for on-prem→AWS resolution, outbound for AWS→on-prem resolution.
What is split-horizon DNS?
Same domain name resolves to different IPs depending on where the query originates. Public hosted zone serves internet users (public IPs). Private hosted zone serves VPC users (private IPs). VPC Resolver checks private zones first — if a match exists, it returns the private answer without querying the public zone. Common for internal vs external access to the same service.