Skip to content

Connectivity Issues with Specific AWS Route53 NS Records (ns-512 to ns-1023.awsdns-XX.net)

0

I'm experiencing connectivity issues with specific AWS Route53 nameservers and would appreciate any guidance from the community.

Issue Details

  • Affected nameservers: ns-512 through ns-1023 (specifically those with .net TLD)
  • Affected IP ranges:
    • 205.251.194.0/23 (IPv4)
    • 2600:9000:5302::/48 (IPv6)
    • 2600:9000:5303::/48 (IPv6)
  • The issue affects both IPv4 and IPv6 connectivity from various networks
  • On my network, IPv4 works but IPv6 connectivity fails completely
  • Other Route53 nameservers outside this range work perfectly fine
  • AWS Health Dashboard shows no related incidents

Current Observations

When creating a new Route53 zone, four nameservers are assigned (one each from .com, .net, .org, and .co.uk TLDs). At least one problematic nameserver (from the affected range) is consistently included in the assignment.

I've verified the connectivity issues using multiple external tools:

  • IPv4 testing: check-host.net/check-ping
  • IPv6 testing: tools.keycdn.com/ipv6-ping

These tests clearly show the connectivity disparity between affected and unaffected nameservers. Some networks are unable to reach the nameservers in the specified IP ranges.

Critical Impact

I'm currently using Route53 for reverse DNS zones, and JPNIC has issued a warning about lame delegation for the affected nameserver. If this issue isn't resolved, JPNIC may forcibly remove the nameserver delegation.

Questions

  1. Has anyone else experienced similar connectivity issues with these specific nameservers?
  2. Are there any known workarounds or solutions?
  3. Is there a way to request different nameserver assignments that avoid the affected range?

Any insights or assistance would be greatly appreciated.

asked 2 years ago136 views

1 Answer
0

Thank you for providing such detailed information about the connectivity issues you're experiencing with specific AWS Route 53 nameservers. While I don't have direct information about widespread issues affecting these specific nameservers, I can provide some insights based on how Route 53 private hosted zones work, which may be relevant to your situation.

In Route 53 private hosted zones, a set of specific nameservers are always used. These are:

  • ns-0.awsdns-00.com
  • ns-512.awsdns-00.net
  • ns-1024.awsdns-00.org
  • ns-1536.awsdns-00.co.uk

These nameservers are reserved for private hosted zones and are never used by Route 53 public hosted zones. It's important to note that while these nameservers are visible on the internet, Route 53 Resolver doesn't actually connect to these nameserver addresses for private hosted zones. Instead, it uses direct, private connectivity to reach the private DNS servers based on VPC to hosted zone associations.

Given that you're experiencing issues with nameservers in the range ns-512 through ns-1023 (specifically those with .net TLD), it's possible that there might be some confusion or overlap between private and public hosted zone configurations.

Regarding your questions:

  1. While I don't have information about widespread issues, the behavior you're describing is not typical for Route 53 public hosted zones.

  2. As a potential workaround, you could try creating a new hosted zone to see if you get assigned different nameservers. However, this may not be a practical solution if you have many existing records.

  3. Unfortunately, there isn't a way to manually request specific nameserver assignments in Route 53. The nameservers are automatically assigned when you create a hosted zone.

Given the critical impact on your reverse DNS zones and the warning from JPNIC, I would strongly recommend contacting AWS Support directly. They will have access to more detailed information about your specific configuration and any potential issues affecting the nameservers in question. They may also be able to assist with reassigning nameservers if necessary.

In the meantime, ensure that your VPC configurations and Route 53 Resolver settings are correctly set up, especially if you're using both public and private hosted zones. Also, double-check that there are no conflicting firewall rules or network ACLs that might be blocking traffic to specific nameserver IP ranges.
Sources
Working with private hosted zones - Amazon Route 53

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.