- Newest
- Most votes
- Most comments
Just to clarify Route53 is an authoritative DNS service and not recursive. It is a subtle detail, but important. i.e. if you go to Route53 directly (query name servers with NS records) and try to resolve DNS name other than R53 hosted DNS zone it will refuse. In addition private hosted zone with R53, can be associated with VPC and in that case resources with in VPC may be able to resolve DNS name for private hosted zone via VPC CIDR (2nd IP address) or (169.254.169.253 on EC2 host in that VPC).
It the latter that provides DNS recursion and able to resolve R53 private hosted DNS zone or any DNS names such as www.amazon.com. I don't think there is a lot of control on this part, other than simply switch off/on (VPC DNS options enableDnsHostnames, enableDnsSupport set to true/false).
One option could be to setup bunch of DNS forwarders on EC2 instances and use those for forwarding/route DNS queries. Change DHCP option set for VPC and by default it points to EC2 DNS forwarders rather than (VPC CIDR; 2nd IP address). Forward DNS queries such as R53 hosted zone, queries for Amazon DNS domains such as .amazonaws.com (this is used for RDS, ELB etc) to VPC CIDR (2nd IP address) and rest to their own recursive DNS servers(or deny), if possible.
This doesn't prevent for someone with in VPC to go directly to VPC CIDR (2nd IP address) or (169.254.169.253 on EC2) and try recursive queries, as long as enableDnsHostnames,enableDnsSupport:true for VPC. So it is obfuscation at best.
You could create a "." private hosted zone. You would then need to explicitly create the zones or resolved rules. Route53 resolver uses a best-match-wins approach. The most specific domain name match will be returned.
Relevant content
- asked 2 years ago
- asked 2 years ago
- asked 4 years ago
AWS OFFICIALUpdated 3 years ago- AWS OFFICIALUpdated 2 years ago
- AWS OFFICIALUpdated 2 years ago
This response may need some clarification. The response seems to suggest a private hosted zone can exist without having a VPC associated. As per AWS developer guide: When you create a private hosted zone, you must associate a VPC with the hosted zone, and the VPC that you specify must have been created by using the same account that you're using to create the hosted zone. So at least one VPC will always be associated with a private hosted zone. Going directly to R53 endpoints (assuming that is what meant by direct) R53 still resolves names such as amazon.com that are not part of the private zone(s).