VPC DNS resolver
Every VPC comes with a DNS resolver, sometimes called the Amazon-provided DNS server. It is reached at the base of the VPC’s IPv4 CIDR block plus two — for a VPC of 10.0.0.0/16, that is 10.0.0.2 — and also at the link-local address 169.254.169.253.
It is a resolver and forwarder rather than a DNS server that hosts zones of its own.
What it resolves
Section titled “What it resolves”Internal names. EC2 instances receive a private DNS hostname of the form ip-10-0-0-23.eu-west-2.compute.internal, and the resolver answers queries for them from other instances in the same VPC.
Private hosted zones. Route 53 private hosted zones associated with the VPC are resolved here, which is how custom internal names such as db.example.internal work.
AWS service endpoints. Names for S3, RDS and the rest, including the private names created by interface VPC endpoints when private DNS is enabled.
Public names. Queries for names outside the VPC are forwarded to Amazon’s public resolvers. Instances resolve public names through it whether or not they have internet access — resolution and reachability are separate things.
Hybrid resolution. With Route 53 Resolver endpoints, the resolver can forward queries for on-premises domains to on-premises DNS servers (outbound endpoints), and answer queries arriving from on-premises for AWS-hosted names (inbound endpoints). Without endpoints, on-premises systems cannot reach the resolver — it has no address they can route to.
Across peering connections. DNS resolution over a VPC peering connection works when the peering connection has DNS resolution enabled on both sides.
VPC attributes it depends on
Section titled “VPC attributes it depends on”Two VPC attributes control it:
enableDnsSupport— whether the resolver answers at all. Off, and instances get no DNS from AWS.enableDnsHostnames— whether instances receive public DNS hostnames as well as private ones.
Both must be enabled for private hosted zones and for interface endpoint private DNS to work. This is the first thing to check when a private name will not resolve.
Properties
Section titled “Properties”- Included with every VPC at no charge.
- It cannot be disabled while
enableDnsSupportis on, but instances need not use it — a custom DHCP options set can point them at your own DNS servers instead. - The address is one of the five reserved addresses in every subnet.
- It is reachable only from within the VPC, or from a network reaching it through a Route 53 Resolver inbound endpoint.
- Traffic to and from the Amazon DNS server cannot be filtered with security groups or network ACLs — port 53 rules aimed at the resolver address have no effect on it. Port 53 rules do matter for a custom DNS server or a Route 53 Resolver endpoint, where DNS uses UDP for most queries and TCP for large responses, and allowing only UDP produces intermittent failures.
- Each resolver has a per-interface query rate limit; very high-volume workloads should cache locally rather than querying it on every request.
Custom DNS
Section titled “Custom DNS”Where an existing DNS infrastructure has to be authoritative, a DHCP options set can point instances at your own servers. Doing so means AWS-internal names and private hosted zones stop resolving unless your servers forward those queries back to 169.254.169.253.
For genuine private DNS hosting inside AWS, use Route 53 private hosted zones associated with the VPC rather than running your own servers — see cross-account private hosted zones.