Hybrid DNS Resolution with Amazon Route 53 Resolver Endpoints (Dual-Stack)
Publication date: January 17, 2025 (Diagram history)
This architecture shows how to resolve DNS queries bidirectionally between a corporate data center and an Amazon VPC using Amazon Route 53 Resolver inbound and outbound endpoints in a dual-stack configuration. Connectivity is provided through AWS Transit Gateway or AWS Cloud WAN with AWS Direct Connect or AWS Site-to-Site VPN.
For more information about IPv6 and dual-stack architectures, see the Dual Stack and IPv6-only Amazon VPC Reference Architectures guide in this series.
For hybrid environments, see IPv6 requirements for AWS Site-to-Site VPN and AWS Direct Connect virtual interfaces.
Hybrid DNS resolution architecture (dual-stack)
The following steps describe the data flow in this architecture:
-
An Amazon Elastic Compute Cloud (Amazon EC2) instance in a dual-stack subnet makes an AAAA DNS query for app.corp.internal and sends it to the Route 53 Resolver in the VPC.
-
A Route 53 forwarding rule is configured to forward any DNS query for corp.internal to the corporate data center. The DNS query is sent to the IPv6 addresses of the Route 53 Resolver outbound endpoint.
-
The Route 53 Resolver outbound endpoint forwards the query to the on-premises DNS resolver. As per VPC routing and AWS Transit Gateway or AWS Cloud WAN routing configuration, the query is sent to the corporate data center through the hybrid connection, using either AWS Direct Connect or AWS Site-to-Site VPN.
-
DNS resolution for corp.internal domain names is carried out by the DNS resolver located in the corporate data center.
-
A client located in the corporate data center makes an AAAA DNS query for aws.example100.internal and sends it to its on-premises DNS resolver. The DNS resolver has a conditional forwarder that forwards all DNS queries for example100.internal to the IPv6 addresses of the Route 53 Resolver inbound endpoint.
-
The forwarded query arrives at the Route 53 Resolver inbound endpoint through the hybrid connection and AWS Transit Gateway or AWS Cloud WAN. The inbound endpoint sends the query to the Route 53 Resolver within the VPC.
-
The private hosted zone associated with the VPC holds the DNS records for aws.example100.internal, so the Route 53 Resolver can resolve the query.
Further reading
For additional information, see the following resources:
Diagram history
To be notified about updates to this reference architecture diagram, subscribe to the RSS feed.
| Change | Description | Date |
|---|---|---|
Reference architecture diagram first published. | January 17, 2025 | |
Initial publication | Reference architecture diagram first published. | January 17, 2025 |
Reference architecture diagram first published. | January 17, 2025 | |
Reference architecture diagram first published. | January 17, 2025 |
Note
To subscribe to RSS updates, you must have an RSS plugin enabled for the browser you are using.
