I85PREP
⌘ K
AWS Networking Specialty study materials
AWS Networking Specialty study resources

Hybrid DNS Resolution Failing for Overlapping Names

AWS Networking Specialty · Put your knowledge to work in context.

All case studies

Hybrid DNS Resolution Failing for Overlapping Names

A company connects an on-premises data center to AWS with a Site-to-Site VPN and a Transit Gateway. On-premises uses Active Directory DNS at 172.16.5.10 and 172.16.5.11. AWS VPCs use the Amazon-provided resolver plus a Route 53 Resolver inbound endpoint (two IPs in the shared-services VPC) and an outbound endpoint with a forwarding rule. The on-premises domain is corp.example.com; a Route 53 private hosted zone also exists for corp.example.com to hold a few cloud-only records. On-premises hosts can resolve AWS private hosted zone names, but AWS workloads intermittently fail to resolve on-premises-only names, and when they do resolve they sometimes get the cloud-only record instead of the on-premises host. No errors appear in Resolver query logs for the failures. The VPC DHCP options set has domain-name corp.example.com and domain-name-servers set to AmazonProvidedDNS.

1. Diagnose the intermittent resolution failures and the wrong-record symptom, and state the configuration corrections.

Read the worked answer

Two separate problems are present.

Intermittent failures for on-premises-only names

  1. The outbound endpoint forwarding rule for corp.example.com is what lets AWS workloads reach 172.16.5.10/11. If the rule is associated with only some VPCs, or if the VPCs' route tables lack a path to the outbound endpoint ENIs in the shared-services VPC, queries fail silently from the client's perspective.
  2. The VPC DHCP option domain-name corp.example.com combined with AmazonProvidedDNS means the resolver treats corp.example.com as a local zone. The resolver answers from the private hosted zone first; if the name is not there it should forward, but only if the forwarding rule is correctly associated and reachable.
  3. Check that the outbound endpoint's security group allows UDP/TCP 53 from the querying VPC CIDRs, and that the Transit Gateway route tables route the endpoint subnet CIDR to the shared-services VPC.
  4. Because no Resolver query log entries appear for failures, the queries are likely never reaching the endpoint: verify rule association at the VPC level (not just the rule's existence) and confirm the querying VPC's resolver is actually AmazonProvidedDNS.

Wrong record returned

This is expected Route 53 behavior, not a bug. A private hosted zone for corp.example.com is authoritative for that name, so the resolver answers from it and does not forward to on-premises for names that exist in the zone. If a cloud-only record shadows an on-premises hostname, AWS clients get the cloud record.

Corrections

  • Use a distinct subdomain for cloud-only records (for example, aws.corp.example.com) and keep the private hosted zone scoped to that subdomain, so corp.example.com queries forward to on-premises.
  • Alternatively, remove the overlapping private hosted zone if the cloud-only records can live under a delegated child zone.
  • Associate the outbound forwarding rule with every VPC that must resolve on-premises names, and enable Resolver query logging on the outbound endpoint to make future failures visible.
  • Validate bidirectional resolution with dig/nslookup from a workload in each VPC and from an on-premises host.

2. The security team asks you to guarantee that DNS queries from regulated VPCs never traverse the public internet. What controls and verification steps do you propose?

Read the worked answer

Guaranteeing that DNS stays private requires controls at the resolver, the routing layer, and the endpoint, plus evidence that they work.

Resolver controls

  • Ensure regulated VPCs use AmazonProvidedDNS (or the Resolver endpoint IPs) and never a public resolver. Enforce via the DHCP options set and detect drift.
  • Use Route 53 Resolver outbound endpoints in a controlled shared-services VPC for all on-premises forwarding, with forwarding rules associated only to approved VPCs.
  • Enable Resolver DNS Firewall on the regulated VPCs to block or alert on disallowed domains, and log all queries.

Routing and network controls

  • The outbound endpoint ENIs live in private subnets with no route to an internet gateway or NAT gateway. Their route table should only reach on-premises via Transit Gateway/VPN.
  • Security groups on the endpoint ENIs allow port 53 only from regulated VPC CIDRs; NACLs mirror that.
  • On-premises DNS servers are reachable only over the private hybrid path; confirm the VPN/Transit Gateway routes and that no public IP path exists.
  • Prevent workloads from configuring arbitrary resolvers by policy and by blocking outbound UDP/TCP 53 to non-approved destinations at security groups and network firewalls.

Verification evidence

  • Query Resolver logs to show all queries for regulated VPCs hit the inbound/outbound endpoints, with no external resolver IPs.
  • Use VPC Flow Logs to confirm no port-53 traffic leaves to public IPs.
  • Run traceroute or Resolver query logging tests from a regulated workload to an on-premises-only name and show the path stays on the private hybrid link.
  • Periodically re-test after any route table or DHCP option change, and record results as compliance evidence.