- Newest
- Most votes
- Most comments
Hello.
Route 53 Resolver DNS Firewall examines DNS queries against Route 53 Resolver DNS, so I don't think it can be used if you have a custom DNS server.
In other words, I think you need to use Amazon Provided DNS, which is the default DNS for your VPC.
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dns-firewall-overview.html
Route 53 Resolver DNS Firewall lets you control access to sites and block DNS-level threats for DNS queries going out from your VPC through the Route 53 Resolver. With DNS Firewall, you define domain name filtering rules in rule groups that you associate with your VPCs. You can specify lists of domain names to allow or block, and you can customize the responses for the DNS queries that you block. You can also fine-tune the domain lists to allow certain query types, such as MX-records, through.
Hello JD,
In this scenario, if you use custom DNS servers via the DHCP options set, AWS Route 53 DNS Firewall can still work. However, for the DNS Firewall to provide security benefits, the DNS queries must pass through the Route 53 Resolver. You can achieve this by registering the custom DNS servers with the Route 53 Resolver as outbound endpoints and associating the relevant VPCs with the Route 53 Resolver.
This way, you can use Route 53 Resolver’s DNS Firewall for filtering and security features while using your custom DNS servers for domain resolution. Let me know if you’d like further details on configuring the resolvers or associations.
This version makes it clear that for the AWS DNS Firewall to function, Route 53 Resolver must be involved in handling the DNS queries, even when using custom DNS servers.
Look at this blog : https://aws.amazon.com/blogs/networking-and-content-delivery/how-to-achieve-dns-high-availability-with-route-53-resolver-endpoints/
answered 2 years ago
Relevant content
asked 2 years ago
- AWS OFFICIALUpdated a year ago
Thanks, will this be cost effective ? it will not add the extra cost of endpoint and processing charges? because if i understand correctly, even within VPC name resolution, it will go through outbound end point ?
If you use a custom DNS Server in DHCP you cant use AWS Route53 DNS Firewall
oh, thanks for clarifying this.