AWS Route 53 Resolver: Inbound and Outbound DNS Resolution

Purpose of This Lesson

Route 53 Resolver connects DNS resolution between AWS and an on-premises environment. The key skill is recognizing which direction a DNS query must travel and selecting the corresponding Resolver endpoint:

• Outbound endpoint: AWS resources need to resolve names held by on-premises DNS servers.
• Inbound endpoint: On-premises clients need to resolve names held in Route 53 hosted zones.

This lesson is especially relevant to hybrid-networking scenarios in the AWS Certified CloudOps Engineer Associate SOA-C03 context.

Key Concepts

DNS forwarding

A DNS forwarder sends a query to another DNS server when the current server cannot answer it but knows where the request should be sent. The forwarded query can be recursive, passing through multiple DNS servers until a result is found.

Forwarding allows an organization to maintain an internal DNS namespace while still resolving public internet domains. An internal DNS server can answer for records in its own database or zone file and forward unknown queries to another DNS service.

Route 53 Resolver

Route 53 Resolver provides DNS resolution between:

• AWS resources using Route 53 DNS resolution
• Route 53 hosted zones
• On-premises DNS servers and their internal records

It supports resolution in both directions across a hybrid connection, such as a VPN between a VPC and a corporate data center.

Resolver endpoints

Resolver endpoints provide the boundary through which DNS queries cross between AWS and on-premises DNS infrastructure:

• Outbound endpoints send queries from the AWS environment to on-premises DNS servers.
• Inbound endpoints accept queries from on-premises DNS servers so they can be resolved through Route 53.

Hybrid DNS Resolution Flow

AWS resources resolving on-premises names: outbound endpoint

Use an outbound endpoint when an EC2 instance or another AWS-side client needs a record that exists in the corporate DNS environment.

The conceptual flow is:

1. An EC2 instance requests a DNS record.
2. Route 53 determines that the required record is held by the corporate DNS server.
3. The query is sent to the outbound endpoint.
4. The outbound endpoint forwards the query across the hybrid connection to the on-premises DNS server.
5. The on-premises DNS server returns the result through the outbound endpoint and Route 53.

The decisive clue is the direction of the request: AWS to on premises.

On-premises clients resolving Route 53 names: inbound endpoint

Use an inbound endpoint when a client in the corporate data center needs to resolve a record hosted in Route 53.

The conceptual flow is:

1. The on-premises client sends its query to the corporate DNS server.
2. The on-premises DNS server forwards the query to the inbound endpoint in the VPC.
3. The inbound endpoint passes the request to Route 53.
4. Route 53 returns the result for the relevant hosted zone.
5. The result is returned to the on-premises client through the DNS server and inbound endpoint.

The decisive clue is the direction of the request: on premises to AWS.

Connectivity requirement

The example architecture uses a VPN to provide an encrypted connection between the corporate data center and the VPC. The Resolver endpoint enables DNS forwarding across that connected environment; it does not replace the underlying network path.

Exam- or Assessment-Relevant Takeaways

• Choose an outbound endpoint when AWS workloads must resolve names maintained by on-premises DNS.
• Choose an inbound endpoint when on-premises clients must resolve records in Route 53 hosted zones.
• Determine the endpoint by asking where the query originates and where the authoritative record is located.
• Route 53 Resolver supports hybrid DNS resolution rather than restricting DNS visibility to only AWS or only the corporate network.
• A DNS forwarder does not necessarily answer the original query itself; it sends the query to a DNS server that may be able to resolve it.
• Do not confuse DNS direction with network-traffic direction. The relevant decision is the flow of the DNS query between AWS-side and on-premises DNS services.

Tool / Feature Decision Guide

Requirement	Appropriate feature	Reason
An EC2 instance needs an internal hostname stored on a corporate DNS server	Outbound Resolver endpoint	It forwards an AWS-originated DNS query to on-premises DNS
An on-premises client needs a name stored in a Route 53 hosted zone	Inbound Resolver endpoint	It receives the on-premises DNS server’s forwarded query and uses Route 53
An internal DNS server cannot answer a query but knows another server to ask	DNS forwarding	The server passes the query to another resolver
AWS and the corporate network must exchange DNS queries	Route 53 Resolver plus network connectivity	Resolver handles DNS forwarding; the VPN in the example provides the connection

Common Traps / Misconceptions

• Reversing inbound and outbound: “Inbound” and “outbound” describe the endpoint’s relationship to the AWS VPC. For study purposes, remember that outbound handles AWS-to-on-premises DNS queries, while inbound handles on-premises-to-AWS DNS queries.
• Assuming Route 53 contains every internal record: Internal corporate names may remain in the on-premises DNS database. Route 53 Resolver forwards requests to that DNS server when appropriate.
• Treating forwarding as an answer: A forwarder passes a query to another DNS server; it may not have the record locally.
• Ignoring connectivity: DNS forwarding across a hybrid environment requires a path between the VPC and the corporate network. In the lesson’s architecture, that path is a VPN.
• Selecting an endpoint based only on record ownership: Record location matters, but query origin and direction together identify the required endpoint.

Real-World Engineer / Analyst Notes

• Draw the DNS request path before choosing an endpoint: client → local DNS server → Resolver endpoint → destination DNS service.
• Label both the query origin and the location of the requested record. This quickly exposes whether the design needs inbound or outbound resolution.
• Keep DNS ownership explicit. Route 53 hosted zones and corporate DNS zone data can coexist, but the forwarding relationship must direct each query to the environment that can answer it.
• Troubleshoot hybrid DNS in layers: confirm the client is using the expected DNS server, verify forwarding direction, verify the network connection, and then determine whether the destination DNS service contains the requested record.

Quick Reference Summary

• DNS forwarder: Sends an unanswerable query to another DNS server.
• Route 53 Resolver: Enables DNS resolution between AWS Route 53 hosted zones and on-premises DNS servers.
• Outbound endpoint: AWS resources resolve records held on premises.
• Inbound endpoint: On-premises clients resolve records held in Route 53.
• Hybrid path: A connection such as a VPN links the VPC and corporate data center; Resolver carries the DNS request across that path.
• Decision rule: Identify the query’s origin and the DNS environment that owns the requested record.

Flashcards

Q: An EC2 instance needs to resolve a hostname stored in the corporate data center’s DNS server. Which Route 53 Resolver endpoint is appropriate?
A: Use an outbound endpoint because the DNS query originates in AWS and must be forwarded to on-premises DNS.

Q: An on-premises client needs to resolve a record in a Route 53 hosted zone. Which endpoint handles this request?
A: Use an inbound endpoint because the query comes from on premises and must enter the VPC to use Route 53 resolution.

Q: What does a DNS forwarder do when its local DNS server cannot answer a query?
A: It sends the query to another DNS server that may be able to resolve it. The query can be recursive and pass through multiple DNS servers.

Q: What is the main difference between Route 53 Resolver inbound and outbound endpoints?
A: Outbound endpoints forward AWS-originated queries to on-premises DNS, while inbound endpoints accept on-premises queries for resolution through Route 53.

Q: A company keeps internal server records in its corporate DNS but wants users to resolve internet names as well. What DNS capability supports this design?
A: DNS forwarding allows the internal DNS server to answer records in its own database and send unknown queries to another DNS service.

Q: Which two locations can Route 53 Resolver connect for DNS resolution?
A: It connects Route 53 hosted zones in AWS with DNS records maintained by on-premises DNS servers.

Q: In the example hybrid architecture, what provides the connection between the VPC and the corporate data center?
A: A VPN provides the encrypted connection across which the DNS forwarding traffic travels.

Q: An on-premises DNS server receives a request for a Route 53 record. What is its role in the inbound-resolution flow?
A: It forwards the query to the inbound Resolver endpoint in the VPC, which then uses Route 53 to return the result.

Q: An AWS-side client requests a record that Route 53 cannot resolve locally but the corporate DNS server owns. What happens next?
A: The request is sent through an outbound endpoint to the on-premises DNS server, which returns the result through the Resolver path.

Q: Why is choosing a Resolver endpoint based only on the location of the DNS record unreliable?
A: The endpoint choice also depends on where the query originates. AWS-to-on-premises queries use outbound, while on-premises-to-AWS queries use inbound.

Q: What is the operational risk of configuring a Resolver endpoint without a working hybrid network path?
A: The DNS query cannot reach the destination DNS environment. Resolver handles forwarding, but it does not substitute for connectivity such as the VPN shown in the architecture.

Q: How should you begin troubleshooting a hybrid DNS-resolution failure?
A: Trace the request from the client to its DNS server, confirm the forwarding direction and endpoint type, verify the network connection, and confirm that the destination DNS environment contains the record.

Practice Questions

Question 1

An EC2 instance must resolve app.corp.example, and that record exists only on a DNS server in the corporate data center. Which design should be used?

A. An inbound Resolver endpoint receiving queries from the corporate DNS server
B. An outbound Resolver endpoint forwarding the query to the corporate DNS server
C. A Route 53 hosted zone containing a duplicate record
D. No Resolver endpoint because DNS forwarding is recursive by default

Correct answer: B. The query originates in AWS and the record is held on premises, so it must use an outbound endpoint.

Question 2

Employees connected to the corporate network need to resolve a private name hosted in a Route 53 hosted zone. The corporate DNS server should forward these requests into AWS. What should the operations team configure?

A. An outbound endpoint in the VPC
B. An inbound endpoint in the VPC
C. A second on-premises zone file only
D. A public internet DNS forwarder

Correct answer: B. An inbound endpoint accepts queries forwarded from the on-premises DNS server and allows Route 53 to resolve the hosted-zone record.

Question 3

A company has a VPN between its VPC and data center and has configured an outbound Resolver endpoint. AWS instances still cannot resolve internal corporate names. Which diagnostic sequence is most appropriate?

A. Replace the corporate DNS server with a Route 53 hosted zone immediately
B. Confirm the instances use the expected DNS path, verify outbound forwarding, check the VPN connection, and confirm the record exists on premises
C. Add an inbound endpoint because all hybrid DNS queries require inbound resolution
D. Disable recursive DNS queries on the corporate DNS server

Correct answer: B. Hybrid DNS failures should be traced through the client, forwarding direction, endpoint, network path, and destination DNS data.

Question 4

A DNS server can answer records in its own internal zone but receives a request for an internet domain it does not know. Which behavior best describes DNS forwarding?

A. The server discards the request because it is outside its zone
B. The server converts the request into a Route 53 hosted zone automatically
C. The server sends the request to another DNS server that may resolve it
D. The server returns the internal zone’s start-of-authority record as the answer

Correct answer: C. A forwarder passes an unanswerable query to another DNS server, potentially allowing recursive resolution.

WordPress Metadata

Suggested Slug:
aws-route-53-resolver-inbound-outbound-dns-resolution

Meta Description:
Understand how Route 53 Resolver connects AWS VPC DNS resolution with on-premises DNS servers using outbound and inbound endpoints.

Tags:
AWS, Route 53 Resolver, DNS, VPC, Hybrid Networking, Inbound Endpoints, Outbound Endpoints, On-Premises DNS, SOA-C03