Ec2 Instance often Doing DNS query with Public DNS Resolver.

0

Hi Team. My ec2 instance instance is often communication with public DNS resolvers (google, azure, Cloudflare) instead of AWS VPC's DNS resolver. EC2 instance's Network settings are set to automatic (DHCP) and unchanged. can you please help me find why my ec2 is communication with public DNS resolvers (google, azure, Cloudflare).

Regards, Jayaprakash M

3 Answers
1

What did you see to determine that it is communicating with the public DNS resolver?
Are there any DNS settings in "/etc/resolv.conf" of EC2?

profile picture
EXPERT
answered 10 months ago
  • From Guard duty findings. it is windows instance and we did not change any network settings.

0

As well as Riku Answer something to ask here:-

This can also depend on if your DNS lookups from your EC2's are recursive DNS lookup is where one DNS server communicates with several other DNS servers, contrast to an iterative where the client communicates directly with each DNS server involved in the lookup.

If for example, you are running BIND or Windows DNS Server on your EC2, you most likely will see DNS Lookups accessing the public internet depending on how they are configured. (Forward or not)

Amazon Route 53 is both an Authoritative DNS service and Recursive DNS service. 
Authoritative DNS contains the final answer to a DNS query, generally an IP address. 
Clients (such as mobile devices, applications running in the cloud, or servers in your datacenter) don’t actually talk directly to authoritative DNS services, except in very rare cases.
Instead, clients talk to recursive DNS services (also known as DNS resolvers) which find the correct authoritative answer for any DNS query.
Route 53 Resolver is a recursive DNS service.
profile picture
EXPERT
answered 10 months ago
0

Are you seeing DNS queries being send from your ec2 to other dns servers on a traffic capture? if yes, check if the dns service (bind in linux) is on. Normally an ec2 doesn't know any dns servers other than whats provided from the subnet. if it sending DNS queries to other servers then it somehow knows it. Can you run dig and verify the DNS Server ec2 is using?

Pratap
answered 10 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions