Home / AWS

AWSTroubleshootingIntermediate

Route 53 private hosted zone not resolving: VPC association, resolver rules and hybrid DNS

Fix names that resolve publicly instead of privately, or not at all, by checking zone-VPC associations, VPC DNS attributes, overlapping zones and Resolver endpoints.

Deepak Bhardwaj2 min read

Applies toAmazon Route 53 private hosted zones, Route 53 Resolver, VPC

Test from the right place

Run the test from an instance in the VPC. Your laptop uses different resolvers.

dig +short app.internal.contoso.com
dig +short app.internal.contoso.com @169.254.169.253   # the VPC resolver (also VPC CIDR base +2)
cat /etc/resolv.conf

Checklist

  • The private hosted zone is associated with this VPC:
    aws route53 get-hosted-zone --id Z0123456789 --query "VPCs"
  • The VPC has enableDnsSupport and enableDnsHostnames set to true:
    aws ec2 describe-vpc-attribute --vpc-id vpc-0abc --attribute enableDnsSupport
aws ec2 describe-vpc-attribute --vpc-id vpc-0abc --attribute enableDnsHostnames
  • The instance uses the VPC resolver. A custom DHCP options set pointing at your own DNS servers bypasses Route 53, unless those servers forward to it.
  • The record exists in this zone. Watch for overlapping zones: if contoso.com and internal.contoso.com are both private and associated, the most specific zone answers, and a name missing from it returns NXDOMAIN rather than falling back to the parent.
  • If a Resolver forwarding rule for the domain is associated with the VPC, queries go to the rule's targets instead of the private zone. Forwarding rules take precedence for matching names.

Cross-account association

The zone owner authorizes it, then the VPC owner associates it:

# in the zone's account
aws route53 create-vpc-association-authorization --hosted-zone-id Z0123456789 --vpc VPCRegion=ap-south-1,VPCId=vpc-0abc
# in the VPC's account
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z0123456789 --vpc VPCRegion=ap-south-1,VPCId=vpc-0abc

Hybrid DNS

Direction Component
On-premises → AWS private zone Inbound Resolver endpoint. On-premises DNS forwards internal.contoso.com to the endpoint IPs.
AWS → on-premises domain Outbound Resolver endpoint plus a forwarding rule for corp.contoso.local
  • The endpoint security groups allow TCP and UDP 53 from or to the right sources.
  • Rules are shared (RAM) and associated with each VPC that needs them.
aws route53resolver list-resolver-rules --query "ResolverRules[].{name:Name,domain:DomainName,type:RuleType}" --output table
aws route53resolver list-resolver-rule-associations --query "ResolverRuleAssociations[].{rule:ResolverRuleId,vpc:VPCId,status:Status}" --output table

Caching

After you fix a record, clients may hold the old answer for the record's TTL, and negative answers for the SOA minimum. Lower TTLs before planned changes. To flush the cache: sudo resolvectl flush-caches (Linux) or ipconfig /flushdns (Windows).

Tip

Turn on Resolver query logging for the VPC during troubleshooting. It shows every query, its answer, and whether a rule or a zone handled it.

Related fixes