AWS Route53 medium security documentation change
Summary
Added an important note clarifying that the trust behavior of DNS Firewall's domain redirection setting only applies within a single DNS query transaction, and that separate queries to redirection target domains require explicit allowance in domain lists.
Security assessment
This change adds critical security documentation about DNS Firewall behavior. It clarifies a potential misconfiguration where redirection target domains might be blocked if not explicitly allowed, which could impact DNS resolution and security. The addition of an 'Important' note suggests this addresses a previously unclear or misunderstood security aspect.
Diff
diff --git a/Route53/latest/DeveloperGuide/resolver-dns-firewall-overview.md b/Route53/latest/DeveloperGuide/resolver-dns-firewall-overview.md index 5d4abf574..d4dcd594f 100644 --- a//Route53/latest/DeveloperGuide/resolver-dns-firewall-overview.md +++ b//Route53/latest/DeveloperGuide/resolver-dns-firewall-overview.md @@ -52,0 +53,4 @@ The domain redirection setting allows you to configure a DNS Firewall rule to in +###### Important + +The trust behavior of the domain redirection setting only applies within a single DNS query transaction. If a DNS client on your host separately queries a domain that appears in a DNS redirection chain (for example, querying the redirection target directly), DNS Firewall evaluates it as an independent query with no trust context from the original query. To allow such queries, add the redirection target domains to your domain list. +