How does DNS work inside a VPC, and how do you make on-prem and cloud resolve each other's names?
Show the answer
Say this first
Every VPC has the Amazon-provided resolver at the VPC base address plus two (10.10.0.2 for 10.10.0.0/16) and at 169.254.169.253. It answers public names, private hosted zones and instance names. For hybrid DNS I use Route 53 Resolver endpoints: an inbound endpoint that on-prem DNS servers forward cloud zones to, and an outbound endpoint with forwarding rules that send on-prem zones to the corporate DNS.
Go deeper
VPC settings
enableDnsSupportturns the Amazon resolver on (default true).enableDnsHostnamesgives instances DNS hostnames (default false in custom VPCs). Private hosted zones need both set to true.- Private hosted zones are associated with specific VPCs, so the same name can resolve differently inside and outside (split-horizon).
Hybrid with Route 53 Resolver
on-prem DNS --- conditional forward aws.corp.example --> inbound endpoint IPs (ENIs in the VPC)
VPC resolver --- rule: forward corp.example --------> outbound endpoint --> on-prem DNS 192.168.10.53Each endpoint has ENIs in at least two AZs. Forwarding rules can be shared to other accounts with AWS RAM and associated with many VPCs.
Azure and GCP
- Azure: the platform resolver is
168.63.129.16. Private DNS zones link to VNets. Azure DNS Private Resolver gives inbound and outbound endpoints plus forwarding rulesets, the same pattern as Route 53 Resolver. Before it existed, people ran DNS forwarder VMs. - GCP: Cloud DNS private zones, forwarding zones to on-prem, and an inbound server policy that gives on-prem a forwarding target inside the VPC.
They will ask next
Why might DNS queries fail under load even though the resolver is up?
The Amazon resolver limits each network interface to 1024 packets per second. A busy host without a local cache can hit that. A local caching resolver on the host fixes it.
Why not point instances directly at on-prem DNS servers?
Then they lose private hosted zones, endpoint private DNS and instance names unless on-prem forwards back. Every lookup also crosses the VPN or circuit. Forwarding rules keep each zone answered where it lives.
Traps
- Forgetting
enableDnsHostnamesand wondering why the private hosted zone does not resolve. - Running only one resolver endpoint ENI, which makes DNS the single point of failure for hybrid traffic.