AWS Route53 documentation change
Summary
Restructured documentation by removing redundant sections, adding details about inbound endpoint types (default/delegation) and rule types (forward/system/delegation), updating links to related resources, and condensing content into referenced articles.
Security assessment
Changes focus on documentation organization and clarifying resolver functionality (e.g., delegation endpoints, rule types). No explicit mention of security vulnerabilities, patches, or incident responses. Protocol encryption details (DoH/DoH-FIPS) were removed rather than added.
Diff
diff --git a/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.md b/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.md index 9fb5e72a3..93d234cea 100644 --- a//Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.md +++ b//Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.md @@ -5,2 +4,0 @@ -How DNS resolvers on your network forward DNS queries to Route 53 Resolver endpointsHow Route 53 Resolver endpoint forwards DNS queries from your VPCs to your networkConsiderations when creating inbound and outbound endpoints - @@ -31 +29 @@ Before you start to forward queries, you create Resolver inbound and/or outbound -This allows your DNS resolvers to easily resolve domain names for AWS resources such as EC2 instances or records in a Route 53 private hosted zone. For more information, see How DNS resolvers on your network forward DNS queries to Route 53 Resolver endpoints. +There are two types of inbound endpoints, a **default inbound endpoint** that forwards to IP addresses, and a **delegation inbound endpoint** that delegates the authority for a subdomain hosted in Route 53 private hosted Zone to the Route 53 Resolver. Inbound endpoints allow your DNS resolvers to easily resolve domain names for AWS resources such as EC2 instances or records in a Route 53 private hosted zone. For more information, see [How DNS resolvers on your network forward DNS queries to Route 53 Resolver endpoints](./resolver-overview-forward-network-to-vpc.html). @@ -36 +34 @@ This allows your DNS resolvers to easily resolve domain names for AWS resources -To forward selected queries, you create Resolver rules that specify the domain names for the DNS queries that you want to forward (such as example.com), and the IP addresses of the DNS resolvers on your network that you want to forward the queries to. If a query matches multiple rules (example.com, acme.example.com), Resolver chooses the rule with the most specific match (acme.example.com) and forwards the query to the IP addresses that you specified in that rule. For more information, see How Route 53 Resolver endpoint forwards DNS queries from your VPCs to your network. +To forward selected queries, you create Resolver rules that specify the domain names for the DNS queries that you want to forward (such as example.com), and the IP addresses of the DNS resolvers on your network that you want to forward the queries to. If a query matches multiple rules (example.com, acme.example.com), Resolver chooses the rule with the most specific match (acme.example.com) and forwards the query to the IP addresses that you specified in that rule. There are three types of rules, **forward** , **system** , and **delegation**. For more information, see [How Route 53 Resolver endpoint forwards DNS queries from your VPCs to your network](./resolver-overview-forward-vpc-to-network.html). @@ -44 +42 @@ You can't create Resolver endpoints in a VPC that you don't own. Only the VPC ow -When you create a Resolver endpoint, you can't specify a VPC that has the instance tenancy attribute set to `dedicated`. For more information, see Using Resolver in VPCs that are configured for dedicated instance tenancy. +When you create a Resolver endpoint, you can't specify a VPC that has the instance tenancy attribute set to `dedicated`. For more information, see [Using Resolver in VPCs that are configured for dedicated instance tenancy](./resolver-choose-vpc.html#resolver-considerations-dedicated-instance-tenancy). @@ -46 +44 @@ When you create a Resolver endpoint, you can't specify a VPC that has the instan -To use inbound or outbound forwarding, you create a Resolver endpoint in your VPC. As part of the definition of an endpoint, you specify the IP addresses that you want to forward inbound DNS queries to or the IP addresses that you want outbound queries to originate from. For each IP address that you specify, Resolver automatically creates a VPC elastic network interface. +To use inbound or outbound forwarding, you create a Resolver endpoint in your VPC. As part of the definition of an endpoint, you specify the IP addresses, or DNS delegation, that you want to forward inbound DNS queries to or the IP addresses that you want outbound queries to originate from. For each IP address and delegation that you specify, Resolver automatically creates a VPC elastic network interface. @@ -52 +50 @@ The following diagram shows the path of a DNS query from a DNS resolver on your -The following diagram shows the path of a DNS query from an EC2 instance in one of your VPCs to a DNS resolver on your network. +The following diagram shows the path of a DNS query from an EC2 instance in one of your VPCs to a DNS resolver on your network. The jyo.example.com domain uses a forwarding rule, whereas the ric.example.com subdomain has delegated the forwarding authority to Route 53 Resolver. @@ -60,439 +58 @@ For an overview of VPC network interfaces, see [Elastic network interfaces](http - * How DNS resolvers on your network forward DNS queries to Route 53 Resolver endpoints - - * How Route 53 Resolver endpoint forwards DNS queries from your VPCs to your network - - * Considerations when creating inbound and outbound endpoints - - - - -## How DNS resolvers on your network forward DNS queries to Route 53 Resolver endpoints - -When you want to forward DNS queries from your network to Route 53 Resolver endpoints in an AWS Region, you perform the following steps: - - 1. You create a Route 53 Resolver inbound endpoint in a VPC and specify the IP addresses that the resolvers on your network forward DNS queries to. - -For each IP address that you specify for the inbound endpoint, Resolver creates a VPC elastic network interface in the VPC where you created the inbound endpoint. - - 2. You configure resolvers on your network to forward DNS queries for the applicable domain names to the IP addresses that you specified in the inbound endpoint. For more information, see Considerations when creating inbound and outbound endpoints. - - - - -Here's how Resolver resolves DNS queries that originate on your network: - - 1. A web browser or another application on your network submits a DNS query for a domain name that you forwarded to Resolver. - - 2. A resolver on your network forwards the query to the IP addresses in your inbound endpoint. - - 3. The inbound endpoint forwards the query to Resolver. - - 4. Resolver gets the applicable value for the domain name in the DNS query, either internally or by performing a recursive lookup against public name servers. - - 5. Resolver returns the value to the inbound endpoint. - - 6. The inbound endpoint returns the value to the resolver on your network. - - 7. The resolver on your network returns the value to the application. - - 8. Using the value that was returned by Resolver, the application submits an HTTP request, for example, a request for an object in an Amazon S3 bucket. - - - - -Creating an inbound endpoint doesn't change the behavior of Resolver, it just provides a path from a location outside the AWS network to Resolver. - -## How Route 53 Resolver endpoint forwards DNS queries from your VPCs to your network - -When you want to forward DNS queries from the EC2 instances in one or more VPCs in an AWS Region to your network, you perform the following steps. - - 1. You create a Route 53 Resolver outbound endpoint in a VPC, and you specify several values: - - * The VPC that you want DNS queries to pass through on the way to the resolvers on your network. - - * The IP addresses in your VPC that you want Resolver to forward DNS queries from. To hosts on your network, these are the IP addresses that the DNS queries originate from. - - * A [VPC security group](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) - -For each IP address that you specify for the outbound endpoint, Resolver creates an Amazon VPC elastic network interface in the VPC that you specify. For more information, see Considerations when creating inbound and outbound endpoints. - - 2. You create one or more rules, which specify the domain names of the DNS queries that you want Resolver to forward to resolvers on your network. You also specify the IP addresses of the resolvers. For more information, see Using rules to control which queries are forwarded to your network. - - 3. You associate each rule with the VPCs for which you want to forward DNS queries to your network. - - - - -###### Topics - - * Using rules to control which queries are forwarded to your network - - * How Resolver determines whether the domain name in a query matches any rules - - * How Resolver determines where to forward DNS queries - - * Using rules in multiple Regions - - * Domain names that Resolver creates autodefined system rules for - - - - -### Using rules to control which queries are forwarded to your network - -Rules control which DNS queries Route 53 Resolver endpoint forwards to DNS resolvers on your network and which queries Resolver answers itself. - -You can categorize rules in a couple of ways. One way is by who creates the rules: - - * **Autodefined rules** – Resolver automatically creates autodefined rules and associates the rules with your VPCs. Most of these rules apply to the AWS-specific domain names that Resolver answers queries for. For more information, see Domain names that Resolver creates autodefined system rules for. - - * **Custom rules** – You create custom rules and associate the rules with VPCs. Currently, you can create only one type of custom rule, conditional forwarding rules, also known as forwarding rules. Forwarding rules cause Resolver to forward DNS queries from your VPCs to the IP addresses for DNS resolvers on your network. - -If you create a forwarding rule for the same domain as an autodefined rule, Resolver forwards queries for that domain name to DNS resolvers on your network based on the settings in the forwarding rule. - - - - -Another way to categorize rules is by what they do: - - * **Conditional forwarding rules** – You create conditional forwarding rules (also known as forwarding rules) when you want to forward DNS queries for specified domain names to DNS resolvers on your network. - - * **System rules** – System rules cause Resolver to selectively override the behavior that is defined in a forwarding rule. When you create a system rule, Resolver resolves DNS queries for specified subdomains that would otherwise be resolved by DNS resolvers on your network. - -By default, forwarding rules apply to a domain name and all its subdomains. If you want to forward queries for a domain to a resolver on your network but you don't want to forward queries for some subdomains, you create a system rule for the subdomains. For example, if you create a forwarding rule for example.com but you don't want to forward queries for acme.example.com, you create a system rule and specify acme.example.com for the domain name. - - * **Recursive rule** – Resolver automatically creates a recursive rule named **Internet Resolver**. This rule causes Route 53 Resolver to act as a recursive resolver for any domain names that you didn't create custom rules for and that Resolver didn't create autodefined rules for. For information about how to override this behavior, see "Forwarding All Queries to Your Network" later in this topic. - - - - -You can create custom rules that apply to specific domain names (yours or most AWS domain names), to public AWS domains names, or to all domain names. - -**Forwarding queries for specific domain names to your network** - - -To forward queries for a specific domain name, such as example.com, to your network, you create a rule and specify that domain name. You also specify the IP addresses of the DNS resolvers on your network that you want to forward the queries to. You then associate each rule with the VPCs for which you want to forward DNS queries to your network. For example, you can create separate rules for example.com, example.org, and example.net. Then you can associate the rules with the VPCs in an AWS Region in any combination. - -**Forwarding queries for amazonaws.com to your network** - - -The domain name amazonaws.com is the public domain name for AWS resources such as EC2 instances and S3 buckets. If you want to forward queries for amazonaws.com to your network, create a rule, specify amazonaws.com for the domain name, and specify **Forward** for the rule type. - -###### Note - -Resolver doesn't automatically forward DNS queries for some amazonaws.com subdomains even if you create a forwarding rule for amazonaws.com. For more information, see Domain names that Resolver creates autodefined system rules for. For information about how to override this behavior, see "Forwarding All Queries to Your Network," immediately following. - -**Forwarding all queries to your network** - - -If you want to forward all queries to your network, you create a rule, specify "." (dot) for the domain name, and associate the rule with the VPCs for which you want to forward all DNS queries to your network. Resolver still doesn't forward all DNS queries to your network because using a DNS resolver outside of AWS would break some functionality. For example, some internal AWS domain names have internal IP address ranges that aren't accessible from outside of AWS. For a list of the domain names for which queries aren't forwarded to your network when you create a rule for ".", see Domain names that Resolver creates autodefined system rules for. - -However, autodefined system rules for reverse DNS can be disabled, allowing the "." rule to forward all reverse DNS queries to your network. For more information on how to turn off the autodefined rules, see [Forwarding rules for reverse DNS queries in Resolver](./resolver-automatic-forwarding-rules-reverse-dns.html). - -If you want to try forwarding DNS queries for all domain names to your network, including the domain names that are excluded from forwarding by default, you can create a "." rule and do one of the following: - - * Set the `enableDnsHostnames` flag for the VPC to `false` - - * Create rules for the domain names that are listed in Domain names that Resolver creates autodefined system rules for - - - - -###### Important - -If you forward all domain names to your network, including the domain names that Resolver excludes when you create a "." rule, some features might stop working. - -### How Resolver determines whether the domain name in a query matches any rules - -Route 53 Resolver compares the domain name in the DNS query with the domain name in the rules that are associated with the VPC that the query originated from. Resolver considers the domain names to match in the following cases: - - * The domain names match exactly - - * The domain name in the query is a subdomain of the domain name in the rule - - - - -For example, if the domain name in the rule is acme.example.com, Resolver considers the following domain names in a DNS query to be a match: - - * acme.example.com - - * zenith.acme.example.com - - - - -The following domain names are not a match: - - * example.com - - * nadir.example.com - - - - -If the domain name in a query matches the domain name in more than one rule (such as example.com and www.example.com), Resolver routes outbound DNS queries using the rule that contains the most specific domain name (www.example.com). - -### How Resolver determines where to forward DNS queries