DNS Inside a VPC

Names that only exist inside your network

Hard-coding IPs breaks as soon as an instance is replaced, so services should find each other by name. Every AWS VPC has a built-in DNS resolver (Route 53 Resolver) reachable at the VPC's base address plus two, for example 10.0.0.2 in 10.0.0.0/16, and also at 169.254.169.253. It answers public names as well as private names. Two VPC attributes control it: enableDnsSupport turns the resolver on, and enableDnsHostnames gives instances DNS hostnames. A private hosted zone lets you define your own domain, such as internal.example.com, visible only to the VPCs you associate with it. So db.internal.example.com can resolve to a database's private IP inside the VPC while being unresolvable from the internet. For hybrid networks, Resolver endpoints forward queries between the VPC and on-premises DNS servers. Google Cloud offers private Cloud DNS zones and Azure private DNS zones with the same idea.

Checking resolution from inside the VPC

Run on an instance in the VPC. The answer is a private address because the private hosted zone is associated with this VPC; the same query from your laptop would fail.

# Which resolver is the instance using?
cat /etc/resolv.conf

# Query the private name
dig +short db.internal.example.com

Split-horizon surprises

If a private zone and a public zone share a name, VPC clients see only the private zone's records for that domain. A missing private record therefore returns 'not found' inside the VPC even though the public record exists.

त्वरित जाँच: In a VPC with CIDR 10.30.0.0/16, at which address is the AWS-provided DNS resolver reachable (besides 169.254.169.253)?

• 10.30.0.1
• 10.30.255.255
• 10.30.0.53
• 10.30.0.2