Amazon Route 53 Resolver for Hybrid DNS – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

Amazon Route 53 Resolver provides DNS resolution between AWS VPCs and external networks such as on-premises data centers or other VPCs. It is a key component of hybrid architectures where workloads in AWS must resolve private names outside AWS, or external systems must resolve names hosted in AWS.

The most important exam distinction is directional:

Outbound endpoint: DNS queries leave a VPC and are forwarded to external DNS servers.
Inbound endpoint: DNS queries enter a VPC from external DNS servers and are answered by Route 53 Resolver.

Route 53 Resolver can also answer queries for VPC-local names, private hosted zones, and public DNS names without requiring custom endpoints.

Key Concepts

Default Route 53 Resolver behavior

Every VPC includes a Route 53 Resolver. It can resolve:

VPC-specific DNS names, including names associated with EC2 instances.
Records in Route 53 private hosted zones associated with the VPC.
Public DNS names through recursive resolution using public DNS infrastructure.

This built-in resolver is sufficient when AWS resources only need to resolve AWS-hosted or public names. Resolver endpoints are required when DNS queries must cross the VPC boundary to another DNS environment.

Outbound Resolver endpoints

An outbound endpoint forwards DNS queries from a VPC to DNS servers outside the VPC, such as:

DNS servers in an on-premises data center.
DNS servers in another VPC.
DNS infrastructure connected through AWS Direct Connect, Site-to-Site VPN, or another private network path.

A forwarding rule specifies:

The domain name or suffix to match.
The outbound endpoint to use.
The target DNS server IP addresses.
The VPCs to which the rule applies.

For example, a rule for corp.example.local can forward matching queries to DNS servers located in a corporate data center. An EC2 instance can then resolve app1.corp.example.local even though the record is not hosted in Route 53.

The network connection must already provide reachability between the endpoint and the target DNS servers. Route 53 Resolver does not replace the VPN, Direct Connect connection, routing, or firewall rules required to transport the query.

Inbound Resolver endpoints

An inbound endpoint allows DNS queries from external networks to enter a VPC and be answered by Route 53 Resolver. This is used when on-premises systems or another VPC need to resolve:

Records in Route 53 private hosted zones.
AWS VPC-specific names.
Other names that the VPC’s Route 53 Resolver can resolve.

The external DNS servers are configured with conditional forwarding rules. For example, they can forward queries for an AWS private domain to the IP addresses assigned to the inbound endpoint. Route 53 Resolver then processes the query inside the VPC.

Conditional forwarding rules

Conditional forwarding sends queries for selected DNS suffixes to specific DNS servers rather than forwarding every query. This keeps DNS ownership clear and prevents unnecessary traffic.

Typical examples include:

Query domain	Forwarding direction	Destination
`corp.example.local`	AWS to on-premises	Outbound endpoint and corporate DNS servers
`aws.example.internal`	On-premises to AWS	Inbound endpoint IP addresses

Rules are associated with VPCs. A rule does not automatically apply to every VPC in an organization; each required VPC must be associated directly or through an appropriate sharing and governance model.

Route 53 Resolver supports rule types such as forwarding and system behavior. A forwarding rule sends matching queries to specified DNS servers. System rules allow Resolver to handle queries for subdomains in situations where a parent domain is subject to forwarding.

Endpoint placement and resiliency

Resolver endpoints use elastic network interfaces in selected subnets. For production workloads, deploy endpoint network interfaces across multiple Availability Zones. Configure security groups and network routing so that DNS traffic can flow between clients, endpoints, and target DNS servers.

DNS commonly uses UDP port 53, but TCP port 53 is also required for responses that do not fit in a UDP packet and for certain DNS operations. Network ACLs, security groups, firewalls, and on-premises controls must allow the required traffic.

Exam-Relevant Takeaways

Outbound means out of AWS: VPC resources send DNS queries to external DNS servers through an outbound Resolver endpoint.
Inbound means into AWS: External clients send DNS queries to an inbound Resolver endpoint so Route 53 Resolver can answer them.
Resolver rules match domain names and are associated with one or more VPCs.
A private hosted zone is only available to associated VPCs unless external DNS is directed to an inbound endpoint.
An outbound endpoint does not make on-premises DNS records available automatically; a forwarding rule and reachable target DNS servers are required.
An inbound endpoint does not cause on-premises clients to discover AWS private zones automatically; the on-premises DNS servers need conditional forwarding rules.
Route 53 Resolver endpoints carry DNS queries, not general application traffic. The underlying VPN, Direct Connect, Transit Gateway, routing, and firewall configuration must still be correct.
Use multiple endpoint IP addresses in separate Availability Zones to avoid making hybrid DNS dependent on a single subnet or Availability Zone.
VPCs must use DNS resolution and DNS hostnames appropriately for standard Route 53 and EC2 name resolution behavior.

Architecture Decision Guide

Requirement	Recommended design
EC2 instances resolve public internet names	Use the VPC-provided Route 53 Resolver; no custom endpoint is normally required
EC2 instances resolve records hosted on corporate DNS	Create an outbound Resolver endpoint and a forwarding rule for the corporate domain
On-premises servers resolve Route 53 private hosted zone records	Create an inbound Resolver endpoint and configure on-premises conditional forwarding
AWS resources in one VPC resolve private names in another environment	Use inbound or outbound endpoints as appropriate, with network connectivity and forwarding rules
Multiple VPCs need the same external DNS resolution policy	Associate the forwarding rule with the required VPCs and manage it centrally where appropriate
Hybrid DNS must survive an Availability Zone failure	Place endpoint network interfaces in multiple Availability Zones and use resilient network paths
Only general IP connectivity is required	Resolver endpoints are not sufficient; configure VPN, Direct Connect, Transit Gateway, routing, and security controls separately

Common Exam Traps

Reversing inbound and outbound: Judge the direction from the AWS VPC’s perspective. Queries leaving AWS use outbound; queries entering AWS use inbound.
Assuming Route 53 public hosted zones resolve private corporate names: Public DNS cannot discover records that exist only on private corporate DNS servers.
Confusing private hosted zones with on-premises DNS: A private hosted zone is managed by Route 53 and associated with VPCs. Corporate DNS records remain on the corporate DNS infrastructure unless migrated or forwarded.
Forgetting the forwarding rule: Creating an outbound endpoint alone does not tell Resolver which domain suffixes to forward or where to send them.
Forgetting external DNS configuration: Inbound resolution requires on-premises or remote DNS servers to forward the relevant AWS domain to the inbound endpoint addresses.
Ignoring network reachability: Resolver endpoints do not establish a VPN or Direct Connect connection and do not fix missing routes or blocked port 53 traffic.
Deploying only one endpoint IP address: A single endpoint interface can create an unnecessary Availability Zone dependency.
Using an internet-based workaround for private names: Hybrid DNS should normally use private connectivity and Resolver endpoints rather than exposing internal DNS services publicly.

Real-World Engineer Notes

Treat DNS as a dependency of application connectivity. An operationally healthy VPN does not guarantee that name resolution works.
Document DNS ownership by suffix. For example, define which system is authoritative for corp.example.local and which system is authoritative for AWS private zones.
Test both query directions independently. AWS-to-on-premises and on-premises-to-AWS resolution use different endpoint types and different configuration locations.
Check the complete path when troubleshooting: client resolver settings, VPC rule association, endpoint ENI security groups, subnet network ACLs, route tables, private connectivity, firewall rules, and target DNS server behavior.
Use centralized DNS architectures carefully. Shared rules and endpoints can reduce duplication, but they also introduce dependencies between VPCs and the networking or DNS account that owns the shared resources.
Design for DNS server redundancy on both sides. Multiple target DNS servers and multi-AZ Resolver endpoints reduce the chance that a single failure interrupts application discovery.

Quick Reference Summary

Route 53 Resolver: DNS resolution service available within every VPC.
Outbound endpoint: AWS VPC to external DNS servers.
Inbound endpoint: External DNS clients to Route 53 Resolver in AWS.
Forwarding rule: Matches a domain suffix and sends queries to selected DNS servers.
Private hosted zone: Route 53 private DNS data available to associated VPCs.
Hybrid connectivity: Still requires VPN, Direct Connect, routing, and security configuration.
Resiliency: Use endpoint interfaces in multiple Availability Zones and redundant DNS targets.

Flashcards

Q: What is the simplest way for an EC2 instance to resolve a public DNS name?

A: Use the VPC-provided Route 53 Resolver.

Q: What does an outbound Resolver endpoint do?

A: It forwards DNS queries from a VPC to DNS servers outside the VPC.

Q: What does an inbound Resolver endpoint do?

A: It accepts DNS queries from outside the VPC so Route 53 Resolver can answer them.

Q: Which endpoint is used when AWS workloads need to resolve on-premises names?

A: An outbound endpoint.

Q: Which endpoint is used when on-premises clients need to resolve Route 53 private hosted zone records?

A: An inbound endpoint.

Q: What determines whether a DNS query is forwarded?

A: A Resolver rule that matches the query’s domain name or suffix.

Q: Where are outbound forwarding rules associated?

A: With one or more VPCs.

Q: Does an outbound endpoint create network connectivity to an on-premises DNS server?

A: No. VPN, Direct Connect, routing, and firewall configuration are still required.

Q: Why deploy Resolver endpoint interfaces across multiple Availability Zones?

A: To reduce dependence on a single Availability Zone and improve DNS availability.

Q: What is the directional mnemonic for Resolver endpoints?

A: Outbound is out of AWS; inbound is into AWS.

Practice Questions

Question 1

A company runs application servers in a VPC and maintains authoritative DNS records for corp.example.local on-premises. The application servers must resolve those names over an existing Site-to-Site VPN. What should the solutions architect configure?

A. An inbound Resolver endpoint and a Route 53 public hosted zone
B. An outbound Resolver endpoint and a forwarding rule for corp.example.local
C. An outbound Resolver endpoint and a private hosted zone containing all corporate records
D. A NAT gateway and a Route 53 public hosted zone

Correct answer: B

Explanation: The DNS queries originate inside AWS and must be sent to on-premises DNS, so the design requires an outbound endpoint and a conditional forwarding rule. A NAT gateway and public DNS do not provide access to private corporate records.

Question 2

On-premises clients must resolve records in a Route 53 private hosted zone associated with a VPC. The VPC is connected to the data center through AWS Direct Connect. Which design meets the requirement?

A. Configure the on-premises DNS servers to forward the private domain to an inbound Resolver endpoint
B. Configure the VPC to forward the private domain to the on-premises DNS servers
C. Create a public hosted zone with the same records
D. Deploy an outbound endpoint and configure an internet gateway

Correct answer: A

Explanation: Queries originate on-premises and must enter the VPC for Route 53 Resolver to answer them. An inbound endpoint provides the target IP addresses for on-premises conditional forwarding.

Question 3

A forwarding rule for internal.example is correctly associated with a VPC, but EC2 instances cannot resolve the names. The outbound endpoint has been deployed in a private subnet. Which issue should be checked first in addition to the DNS configuration?

A. Whether the VPC has an internet gateway
B. Whether routing, security groups, network ACLs, and the private connection allow DNS traffic to the target servers
C. Whether the records are published in a public hosted zone
D. Whether the EC2 instances use public IPv4 addresses

Correct answer: B

Explanation: Resolver endpoints depend on network reachability to the target DNS servers. The VPN or Direct Connect path, routes, and controls must allow DNS traffic, typically UDP and TCP port 53. Internet access and public IP addresses are not required for private DNS resolution.

Question 4

A company wants hybrid DNS to remain available if one Availability Zone fails. Which configuration is most appropriate?

A. Deploy one Resolver endpoint interface and one DNS target server
B. Deploy Resolver endpoint interfaces in multiple Availability Zones and use redundant DNS target servers
C. Use only a Route 53 public hosted zone
D. Place the endpoint in the VPC’s default subnet only

Correct answer: B

Explanation: Multi-AZ endpoint placement and redundant DNS targets remove single points of failure in the hybrid DNS path.

Question 5

A network engineer says that creating an inbound Resolver endpoint automatically makes AWS private hosted zone names resolvable from the corporate network. What additional action is required?

A. Add a NAT gateway to the VPC
B. Configure corporate DNS conditional forwarding for the AWS private domain to the inbound endpoint IP addresses
C. Create an outbound endpoint for every corporate DNS server
D. Publish the private hosted zone records to the internet

Correct answer: B

Explanation: The inbound endpoint accepts queries, but corporate DNS must be configured to send matching queries to it. Publishing private records publicly would be insecure and is unnecessary.