# DNS Inside a VPC — Cloud Networking: VPCs, Subnets & Peering

Source: https://www.skillbyai.com/en/cloud-networking/cn-vpc-dns

> Use the VPC resolver and private hosted zones so services find each other by name rather than by IP.

## Names that only exist inside your network

Hard-coding IPs breaks as soon as an instance is replaced, so services should find each other by name. Every AWS VPC has a built-in **DNS resolver** (Route 53 Resolver) reachable at the VPC's base address plus two, for example `10.0.0.2` in `10.0.0.0/16`, and also at `169.254.169.253`. It answers public names as well as private names. Two VPC attributes control it: `enableDnsSupport` turns the resolver on, and `enableDnsHostnames` gives instances DNS hostnames. A **private hosted zone** lets you define your own domain, such as `internal.example.com`, visible only to the VPCs you associate with it. So `db.internal.example.com` can resolve to a database's private IP inside the VPC while being unresolvable from the internet. For hybrid networks, **Resolver endpoints** forward queries between the VPC and on-premises DNS servers. Google Cloud offers private Cloud DNS zones and Azure private DNS zones with the same idea.

## Checking resolution from inside the VPC

Run on an instance in the VPC. The answer is a private address because the private hosted zone is associated with this VPC; the same query from your laptop would fail.

```bash
# Which resolver is the instance using?
cat /etc/resolv.conf

# Query the private name
dig +short db.internal.example.com
```

## Split-horizon surprises

If a private zone and a public zone share a name, VPC clients see only the private zone's records for that domain. A missing private record therefore returns 'not found' inside the VPC even though the public record exists.

**Quiz:** In a VPC with CIDR 10.30.0.0/16, at which address is the AWS-provided DNS resolver reachable (besides 169.254.169.253)?

- [ ] 10.30.0.1
- [ ] 10.30.255.255
- [ ] 10.30.0.53
- [x] 10.30.0.2

*Answer:* 10.30.0.2. The resolver is at the VPC's primary CIDR base plus two. The base plus one is the VPC router.