Why can't I resolve domain names over my Amazon VPC peering connection?

Resolution

If you configured your Amazon VPC with AmazonProvidedDNS and can't resolve the domain names over a peering connection, then complete the resolution for your configuration.

Your domain name resolves to the public DNS of an Amazon EC2 instance created in the peered VPC

To resolve the public domain name to the private IP address of the Amazon Elastic Compute Cloud (Amazon EC2) instance, activate DNS resolution for the VPC peering connection. Then, run the following command to check that the public DNS resolves to the private IP address of the EC2 instance:

dig ec2-35-88-61-144.us-west-2.compute.amazonaws.com +short

Example output:

172.31.12.97

Access public Amazon RDS DB instances over VPC Peering

If you created an Amazon Relational Database Service (Amazon RDS) DB instance with Public access turned on, then Amazon RDS assigns a public IP address to the database. The RDS endpoint resolves to a public IP address, and other resources outside of the VPC can connect to your database.

To access the public RDS endpoint privately with a VPC peering connection, turn on the Requester DNS resolution and Accepter DNS resolution options for VPC peering.

To check if you can access the public RDS endpoint privately, run a command similar to the following:

dig database-test.1234abcde-east-1.rds.amazonaws.com +short

Example output:

ec2-35-88-61-144.us-west-2.compute.amazonaws.com
172.31.12.97

If you experience issues with DNS resolution, then take the following actions:

• Verify the source VPC and the destination VPC ID.
• Confirm that there's an active peering connection between the source and destination VPCs.
• Check the DNS configuration for the peering connection. Make sure that you turned on the DNS resolution for both the requester and accepter VPCs.
• Verify that the public domain name that you resolve to exists. Check the destination VPC to make sure that there's an instance with the public IP address mentioned in the domain name.
• Verify whether the DNS configuration in the VPC is AmazonProvidedDNS or CustomDNS. If you're using a custom DNS, then verify that the custom DNS resolves the domain name of the public instance. If the custom DNS can't resolve the domain name, then either add a static DNS record or redirect the query to AmazonProvidedDNS.

Your domain name resolves to the domain name of the services created in a peered VPC

Service endpoint domain names, such as ssm.us-east-1.amazonaws.com, resolve to the public IP address. This is true even if there's an interface endpoint created in the peered VPC with the private DNS option turned on. These names resolve to private IP addresses when queried from within the VPC where you created the interface endpoint.

To resolve the endpoint domain names to endpoint private IP addresses from a peered VPC, you must have the correct DNS architecture.

For the following example, you configured interface VPC endpoint on VPC A. To resolve the service domain name to the interface VPC endpoint IP addresses in VPC A from VPC B, complete the following steps:

1. Create an interface endpoint for the service with PrivateDNS turned off.
2. Use the service domain name to create a private hosted zone, for example, ssm.us-east-1.amazonaws.com. Create the zone from the AWS account where you created the interface endpoint.
3. Make sure to turn on DNS hostnames and DNS resolution for both VPCs in the peering connection.
4. Create an alias record that points the service domain name to the Regional endpoint of the interface endpoint DNS, such as vpce-057d3426e21755b8a-svk1k3tm.ssm.us-east-1.vpce.amazonaws.com. Or, create a record that points the service domain name to the private IP addresses of the interface VPC endpoint you created in VPC A.
5. Associate the private hosted zone that you created to the peered VPC. If VPC B is a cross-account, then see How do I associate an Amazon Route 53 private hosted zone with a VPC in a different account?

If you still can't resolve your endpoint domain names to an endpoint private IP address from a peered VPC, then take the following actions:

• Verify the source VPC and the destination VPC ID.
• Make sure that there's an active peering connection between the source and destination VPC.
• Make sure that you turned on DNS hostnames and DNS resolution for both VPCs in the peering connection.
• Verify whether the DNS you configured in the VPC is AmazonProvidedDNS or CustomDNS. If you're using a custom DNS, then verify that the custom DNS can resolve the domain name. If the custom DNS can't resolve the domain name, then add a static DNS record. If that doesn't resolve the issue, then configure custom DNS to forward the query to AmazonProvidedDNS.
• Verify that you associated both peered VPCs to the same private hosted zone where you created the domain name record.
• Make sure that the records point to the correct VPC endpoint Region-specific domain or interface endpoint IP addresses.

You created your custom domain name in a private hosted zone

The following scenarios can cause issues with custom domain name resolution over a VPC peering connection:

• You created a private hosted zone for a custom domain name that's used to resolve the domain to a record created in a private hosted zone.
• You associated VPC A to a private hosted zone.
• You established a peering connection from VPC B to VPC A.

To resolve these issues, associate VPC B to the private hosted zone for the custom domain where you created the record. After you make the association, you can resolve the custom domain name in a private hosted zone from resources in both of the peered VPCs.

If you experience issues after you associate VPC B to the private hosted zone, then take the following actions:

• Verify the source VPC and the destination VPC ID.
• Verify whether the DNS configured in the VPC is AmazonProvidedDNS or CustomDNS. If you're using a custom DNS, then you can't resolve to records hosted in private hosted zones. To correct this, add a static domain name record on the custom DNS. Or, configure a custom DNS to forward the query to AmazonprovidedDNS.
• If you're using Amazon provided DNS, then verify the domain that you're trying to resolve and whether it's hosted in Route 53 or on-premises.
  Note: If hosted on-premises, then make sure that the you correctly configured the outbound resolver endpoint used to forward the query to the on-premises DNS. If hosted in a Route 53 private hosted zone, then verify that you associated the source VPC to the private hosted zone. The source VPC is the location from where you're trying to resolve the custom domain name.
• Make sure the fully qualified domain name (FQDN) that you're trying to resolve has a record created in the private hosted zone.