AWS Route 53 Support
Route 53 private hosted zones and Resolver endpoints.
Private DNS across VPCs, accounts and an on-premises network is where many designs break. We set up private hosted zones, associate them correctly and use Resolver inbound and outbound endpoints with rules so names resolve in both directions.
When You Need This
The situations where this work pays for itself.
Signs it is time
- Internal service names must resolve inside VPCs but not on the internet
- A second VPC or account cannot resolve a private zone
- On-premises systems need to resolve AWS private names, or the reverse
- Split-horizon DNS returns the wrong answer inside the VPC
- Private DNS for VPC endpoints is not resolving as expected
What you get
- Zones, associations, endpoints and rules in infrastructure as code
- A DNS design diagram covering hybrid and multi-account flows
- Resolver query logging configured
- A tested resolution matrix by source and destination
How we do it
A clear, safe process you can follow along with.
1. Check VPC DNS settings
Private hosted zones need enableDnsSupport and enableDnsHostnames on each associated VPC. We confirm these first because they cause many silent failures.
2. Create and associate zones
We create the private zone and associate it with every VPC that must resolve it. For VPCs in other accounts we authorize the association and complete it through the API, since the console cannot do cross-account.
3. Design split-horizon deliberately
If a public and private zone share a name, the private zone answers inside associated VPCs for all names under it, so every public record needed internally must also exist in the private zone.
4. Build inbound resolution
For on-premises to AWS, we create a Resolver inbound endpoint with IP addresses in at least two AZs, allow DNS on UDP and TCP 53 in its security group and configure on-premises DNS to forward the zone to those addresses.
5. Build outbound resolution
For AWS to on-premises, we create an outbound endpoint and forwarding rules per domain, associate rules with VPCs and share them across accounts with AWS Resource Access Manager.
6. Test from both sides
We resolve names with dig from instances and from on-premises hosts, check Resolver query logs for failures and add alarms on endpoint health.
Mistakes we help you avoid
Common ways this goes wrong, and what we do instead.
Only one AZ for Resolver endpoints
Use at least two for availability.
Forgetting to associate a VPC
A zone is invisible to any VPC not associated with it.
Forwarding loops
Forwarding rules that point back at each other cause timeouts. We map the full path.
Blocking port 53 TCP
Large responses fall back to TCP and fail if only UDP is open.
Frequently Asked Questions
What is a Route 53 private hosted zone?
It is a hosted zone whose records resolve only inside VPCs you associate with it, which keeps internal names off the public internet.
What is the difference between inbound and outbound Resolver endpoints?
Inbound endpoints let outside networks query AWS private DNS. Outbound endpoints let your VPCs forward queries for chosen domains to another DNS server.
How do I share a private zone across accounts?
Authorize the VPC association from the zone-owning account, then associate the VPC from the other account. For Resolver rules, we share them with AWS RAM.
Want Help With Route 53 private hosted zones and Resolver endpoints?
Schedule an appointment. Tell us about your environment and we will outline the safest, highest-value approach.
Schedule Appointment › No commitment required