[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloudops-engineer-associate-networking-content-delivery-dns-and-content-delivery-route53-routing-policies-en":4,"next-aws-certified-cloudops-engineer-associate-networking-content-delivery-dns-and-content-delivery-route53-routing-policies-en":1121,"lesson-aws-certified-cloudops-engineer-associate-networking-content-delivery-dns-and-content-delivery-route53-routing-policies-en":1136},null,{"locked":5,"reason":3,"meta":6,"item":19},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"Route 53 DNS and Resolver","A name that resolves from your laptop and returns NXDOMAIN inside a VPC is not a broken record, it is a different resolver answering. This lesson covers hosted zones, alias records, private hosted zones, and the inbound and outbound Resolver endpoints that make hybrid name resolution work.",true,28,"intermediate",[13,14,15,16,17,18],"Explain what a hosted zone is and distinguish a public hosted zone from a private hosted zone","Choose between an alias record and a CNAME record for a given target, including at the zone apex","Configure a private hosted zone, including the 2 VPC attributes it depends on, and predict the NXDOMAIN behavior of overlapping namespaces","Describe how the VPC Resolver at VPC+2 answers queries for local names, private hosted zones, and public names","Select an inbound or outbound Resolver endpoint for a given direction of hybrid DNS traffic","Compare public DNS query logging with Resolver query logging and pick the right one for an investigation",{"id":20,"title":7,"body":21,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":1024,"infographics":1025,"isFree":9,"learningObjectives":1042,"meta":1043,"navigation":9,"path":1044,"quiz":1045,"seo":1118,"stem":1119,"__hash__":1120},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/03-dns-and-content-delivery/01-route53-dns-and-resolver.md",{"type":22,"value":23,"toc":1011},"minimark",[24,33,36,41,53,56,72,75,85,88,92,107,110,121,125,135,142,233,236,243,247,250,257,269,346,349,352,356,366,384,387,413,416,432,436,451,454,468,471,478,485,489,500,503,532,537,540,552,689,696,700,709,715,718,722,725,816,819,825,828,838,842,952,956,995,1007],[25,26,27,28,32],"p",{},"A Lambda function in your VPC calls ",[29,30,31],"code",{},"payments.corp.internal"," and gets NXDOMAIN. The same name resolves in 30 milliseconds from your laptop over the corporate VPN. Nothing in the application changed, the record exists, and DNS is \"working\" by every check you can think of.",[25,34,35],{},"The record is fine. What changed is which resolver answered. A name inside a VPC can be resolved by 3 different things, and they do not consult each other. Learning where a query goes is most of Route 53 troubleshooting, and it is what the exam actually tests in this area.",[37,38,40],"h2",{"id":39},"hosted-zones-the-container-route-53-answers-from","Hosted zones: the container Route 53 answers from",[25,42,43,44,48,49,52],{},"A ",[45,46,47],"strong",{},"hosted zone"," holds the records for one domain and its subdomains. Create a hosted zone for ",[29,50,51],{},"example.com"," and you get a container that Route 53 will answer queries from, plus the name servers that make that answering official.",[25,54,55],{},"There are 2 kinds, and the difference is who can ask:",[57,58,59,66],"ul",{},[60,61,43,62,65],"li",{},[45,63,64],{},"public hosted zone"," answers queries from the internet. Route 53 assigns 4 name servers, and you point your domain registrar at them with NS records. That delegation is what makes Route 53 authoritative for the domain.",[60,67,43,68,71],{},[45,69,70],{},"private hosted zone"," answers queries only from VPCs you associate with it. It is not reachable from the internet, and its records never appear in public DNS.",[25,73,74],{},"Private hosted zones do get NS records, because the DNS protocol requires every zone to have them, and they are always the same 4 reserved names:",[76,77,82],"pre",{"className":78,"code":80,"language":81},[79],"language-text","ns-0.awsdns-00.com\nns-512.awsdns-00.net\nns-1024.awsdns-00.org\nns-1536.awsdns-00.co.uk\n","text",[29,83,80],{"__ignoreMap":84},"",[25,86,87],{},"Those names are visible on the internet, but querying them directly returns nothing about your zone. The VPC Resolver never contacts them either. It recognizes that a query falls inside a private namespace from the VPC-to-hosted-zone association and reaches the private data directly. So \"the name servers are public\" is true and harmless.",[37,89,91],{"id":90},"records-ttl-and-the-query-you-never-see","Records, TTL, and the query you never see",[25,93,94,95,98,99,102,103,106],{},"A record maps a name and a type to a value: ",[29,96,97],{},"www.example.com"," type A to ",[29,100,101],{},"203.0.113.10",". Each record carries a ",[45,104,105],{},"TTL",", the number of seconds a DNS resolver may cache the answer before asking again.",[25,108,109],{},"The TTL is the single most operationally important field on a record, and it is easy to underestimate. Set it to 300 and a resolver that answered a client at 10:00:00 will keep serving that same answer until 10:05:00 without contacting Route 53 at all. That has 3 consequences you will meet again in this topic:",[57,111,112,115,118],{},[60,113,114],{},"A failover or a record change does not take effect for existing clients until their cached copy expires.",[60,116,117],{},"Query logs undercount real traffic, sometimes by orders of magnitude, because cached answers never reach Route 53.",[60,119,120],{},"Lowering the TTL before a planned cutover, then raising it afterwards, is the standard migration technique.",[37,122,124],{"id":123},"alias-records-the-aws-only-shortcut","Alias records: the AWS-only shortcut",[25,126,127,128,130,131,134],{},"You want ",[29,129,51],{}," to reach an Application Load Balancer. The load balancer has a DNS name, not a stable IP address, so an A record with a hardcoded address is wrong the day AWS replaces a node. The obvious answer is a CNAME, and the DNS protocol forbids it: you cannot create a CNAME at the ",[45,132,133],{},"zone apex",", the top node of the namespace.",[25,136,137,138,141],{},"An ",[45,139,140],{},"alias record"," is Route 53's extension that closes this gap. It looks like an A or AAAA record to any client, but its target is an AWS resource that Route 53 resolves at query time.",[143,144,145,160],"table",{},[146,147,148],"thead",{},[149,150,151,154,157],"tr",{},[152,153],"th",{},[152,155,156],{},"Alias record",[152,158,159],{},"CNAME record",[161,162,163,175,186,196,207,218],"tbody",{},[149,164,165,169,172],{},[166,167,168],"td",{},"Target",[166,170,171],{},"Selected AWS resources, or another record in the same hosted zone",[166,173,174],{},"Any DNS name anywhere",[149,176,177,180,183],{},[166,178,179],{},"At the zone apex",[166,181,182],{},"Allowed",[166,184,185],{},"Not allowed",[149,187,188,190,193],{},[166,189,105],{},[166,191,192],{},"Taken from the target resource, not settable by you",[166,194,195],{},"You set it",[149,197,198,201,204],{},[166,199,200],{},"Price",[166,202,203],{},"Free for queries to AWS resources",[166,205,206],{},"Billed, and billed as 2 queries when it points at another Route 53 record",[149,208,209,212,215],{},[166,210,211],{},"Type matching",[166,213,214],{},"Answers only when the query type matches the record type",[166,216,217],{},"Redirects regardless of the type queried",[149,219,220,227,230],{},[166,221,222,223,226],{},"In ",[29,224,225],{},"dig"," output",[166,228,229],{},"Appears as A or AAAA",[166,231,232],{},"Appears as CNAME",[25,234,235],{},"Alias targets you should recognize: Elastic Load Balancing load balancers (Application, Network, and Classic), CloudFront distributions, S3 buckets configured as static websites, API Gateway APIs, VPC interface endpoints, Global Accelerator accelerators, Elastic Beanstalk environments, App Runner services, AppSync domain names, OpenSearch Service domains, and another record of the same type in the same hosted zone.",[25,237,238,239,242],{},"Two practical points. Alias records track the resource on their own, so if the load balancer's addresses change, Route 53 starts answering with the new ones without you touching anything. And alias records can set ",[45,240,241],{},"Evaluate Target Health",", which is how a failover configuration learns that a load balancer is down without you creating a health check for it.",[37,244,246],{"id":245},"private-hosted-zones-and-the-2-vpc-attributes-they-depend-on","Private hosted zones and the 2 VPC attributes they depend on",[25,248,249],{},"Create a private hosted zone, associate a VPC, and add records. Instances in that VPC now resolve those names to private addresses.",[25,251,252,253,256],{},"It fails silently if the VPC is not configured for it. Both of these VPC attributes must be ",[29,254,255],{},"true",":",[57,258,259,264],{},[60,260,261],{},[29,262,263],{},"enableDnsSupport",[60,265,266],{},[29,267,268],{},"enableDnsHostnames",[76,270,274],{"className":271,"code":272,"language":273,"meta":84,"style":84},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","aws ec2 describe-vpc-attribute --vpc-id vpc-0a1b2c3d --attribute enableDnsSupport\naws ec2 describe-vpc-attribute --vpc-id vpc-0a1b2c3d --attribute enableDnsHostnames\n\naws ec2 modify-vpc-attribute --vpc-id vpc-0a1b2c3d --enable-dns-hostnames\n","bash",[29,275,276,305,323,329],{"__ignoreMap":84},[277,278,281,285,289,292,296,299,302],"span",{"class":279,"line":280},"line",1,[277,282,284],{"class":283},"sbgvK","aws",[277,286,288],{"class":287},"s_sjI"," ec2",[277,290,291],{"class":287}," describe-vpc-attribute",[277,293,295],{"class":294},"stzsN"," --vpc-id",[277,297,298],{"class":287}," vpc-0a1b2c3d",[277,300,301],{"class":294}," --attribute",[277,303,304],{"class":287}," enableDnsSupport\n",[277,306,308,310,312,314,316,318,320],{"class":279,"line":307},2,[277,309,284],{"class":283},[277,311,288],{"class":287},[277,313,291],{"class":287},[277,315,295],{"class":294},[277,317,298],{"class":287},[277,319,301],{"class":294},[277,321,322],{"class":287}," enableDnsHostnames\n",[277,324,326],{"class":279,"line":325},3,[277,327,328],{"emptyLinePlaceholder":9},"\n",[277,330,332,334,336,339,341,343],{"class":279,"line":331},4,[277,333,284],{"class":283},[277,335,288],{"class":287},[277,337,338],{"class":287}," modify-vpc-attribute",[277,340,295],{"class":294},[277,342,298],{"class":287},[277,344,345],{"class":294}," --enable-dns-hostnames\n",[25,347,348],{},"A private hosted zone can be associated with up to 300 VPCs, across accounts (the association from another account is a 2-step authorize-then-associate flow). Past 300, Route 53 Profiles is the intended tool rather than a quota increase.",[25,350,351],{},"Health checks behave differently here. In a private hosted zone you can attach health checks only to failover, multivalue answer, weighted, latency, geolocation, and geoproximity records. IP-based routing is not supported in a private hosted zone at all.",[37,353,355],{"id":354},"split-view-dns-and-the-nxdomain-trap","Split-view DNS and the NXDOMAIN trap",[25,357,358,361,362,365],{},[45,359,360],{},"Split-view DNS"," (also called split-horizon) is the pattern where the same domain name resolves differently inside and outside your network. You create a public hosted zone and a private hosted zone with the same name, associate the private one with your VPCs, and populate each with the records appropriate to its audience. Internal callers reach ",[29,363,364],{},"10.0.5.20","; the internet reaches your CloudFront distribution.",[25,367,368,369,371,372,375,376,379,380,383],{},"Here is the part that surprises people. Suppose your private hosted zone is ",[29,370,51],{}," and it contains records for ",[29,373,374],{},"db.example.com"," and ",[29,377,378],{},"cache.example.com",", but nothing for ",[29,381,382],{},"reports.example.com",", which does exist in public DNS.",[25,385,386],{},"The VPC Resolver evaluates in this order:",[388,389,390,403,406],"ol",{},[60,391,392,393,396,397,399,400,402],{},"Does a private hosted zone associated with this VPC match the query name? A match means an identical name, or a name that is a ",[45,394,395],{},"parent"," of the query. ",[29,398,51],{}," is a parent of ",[29,401,382],{},", so yes.",[60,404,405],{},"Search that zone for a record matching the name and type.",[60,407,408,409,412],{},"No match. Return ",[45,410,411],{},"NXDOMAIN",".",[25,414,415],{},"It does not fall back to public DNS. Once a private zone claims the namespace, it owns the whole namespace inside that VPC. This is the second most common private hosted zone incident after the missing VPC attributes, and the symptom is always the same: one name works everywhere except inside the VPC.",[25,417,418,419,375,421,424,425,428,429,431],{},"When 2 private hosted zones overlap, the most specific match wins. With zones for ",[29,420,51],{},[29,422,423],{},"accounting.example.com"," both associated, a query for ",[29,426,427],{},"seattle.accounting.example.com"," is answered from ",[29,430,423],{},", and only from that zone.",[37,433,435],{"id":434},"the-vpc-resolver-at-vpc2","The VPC Resolver at VPC+2",[25,437,438,439,442,443,446,447,450],{},"Every VPC gets a resolver at the base of its CIDR ",[45,440,441],{},"plus two",". A VPC using ",[29,444,445],{},"10.20.0.0/16"," has its resolver at ",[29,448,449],{},"10.20.0.2",". That address is one of the 5 AWS reserves in every subnet, and it is where instances send DNS queries unless a DHCP options set says otherwise.",[25,452,453],{},"The VPC Resolver answers 3 categories:",[57,455,456,462,465],{},[60,457,458,459],{},"Internal EC2 hostnames such as ",[29,460,461],{},"ip-10-20-1-15.ec2.internal",[60,463,464],{},"Records in private hosted zones associated with the VPC",[60,466,467],{},"Public names, by performing recursive lookups against public name servers on your behalf",[25,469,470],{},"That third one matters: instances do not talk to public DNS themselves, the VPC Resolver does the recursion. It can also validate DNSSEC on those recursive answers if you enable DNSSEC validation.",[25,472,473,474,477],{},"If you run your own DNS servers on EC2 instances, they must forward to VPC+2 to reach private hosted zone data. Pointing them at the VPC router (",[29,475,476],{},".1",") does not work.",[25,479,480,481,484],{},"The AWS docs now call this component ",[45,482,483],{},"Route 53 VPC Resolver","; older material and the exam guide call it Route 53 Resolver. They are the same thing.",[37,486,488],{"id":487},"hybrid-dns-inbound-and-outbound-endpoints","Hybrid DNS: inbound and outbound endpoints",[25,490,491,492,495,496,499],{},"The VPC Resolver knows nothing about ",[29,493,494],{},"corp.internal"," running on your on-premises Active Directory servers, and your on-premises resolver knows nothing about your private hosted zones. Resolver ",[45,497,498],{},"endpoints"," bridge the two, and their names are the single most reversed pair of terms in this domain.",[25,501,502],{},"Both names are written from the VPC's point of view:",[57,504,505,522],{},[60,506,137,507,510,511,514,515,518,519,521],{},[45,508,509],{},"outbound endpoint"," sends queries ",[45,512,513],{},"out of"," the VPC to your network. You pair it with ",[45,516,517],{},"forwarding rules",", one per domain name, that say \"queries for ",[29,520,494],{}," go to these target IP addresses.\"",[60,523,137,524,527,528,531],{},[45,525,526],{},"inbound endpoint"," accepts queries ",[45,529,530],{},"into"," the VPC from your network. You give its IP addresses to your on-premises resolver as a conditional forwarder.",[533,534],"infographic",{"alt":535,"slug":536},"A diagram showing an outbound query leaving an EC2 instance through a forwarding rule and outbound endpoint to an on-premises DNS server, and an inbound query arriving from an on-premises client through an inbound endpoint to the VPC Resolver.","resolver-inbound-vs-outbound-endpoints",[25,538,539],{},"An endpoint is a set of elastic network interfaces placed in subnets you choose, so it consumes private addresses from your VPC. Two consequences follow:",[57,541,542,549],{},[60,543,544,545,548],{},"An outbound endpoint's IP addresses are ",[45,546,547],{},"private",", so the query can only reach your data center over Direct Connect, a Site-to-Site VPN, or a NAT gateway. There is no public path.",[60,550,551],{},"Every target IP address in a rule must be reachable from the endpoint's subnets. When Resolver forwards a query it picks one target IP at random, with no preference, and retries against another random target if the first does not answer. One unreachable target in a list of 3 therefore produces intermittent slow resolution rather than a clean failure.",[76,553,555],{"className":271,"code":554,"language":273,"meta":84,"style":84},"aws route53resolver create-resolver-endpoint \\\n  --name outbound-to-datacenter \\\n  --direction OUTBOUND \\\n  --security-group-ids sg-0a1b2c3d4e5f6a7b8 \\\n  --ip-addresses SubnetId=subnet-0aaa,SubnetId=subnet-0bbb\n\naws route53resolver create-resolver-rule \\\n  --name forward-corp-internal \\\n  --rule-type FORWARD \\\n  --domain-name corp.internal \\\n  --resolver-endpoint-id rslvr-out-0123456789abcdef0 \\\n  --target-ips Ip=192.168.10.53,Port=53 Ip=192.168.20.53,Port=53\n",[29,556,557,571,581,591,601,610,615,627,637,648,659,670],{"__ignoreMap":84},[277,558,559,561,564,567],{"class":279,"line":280},[277,560,284],{"class":283},[277,562,563],{"class":287}," route53resolver",[277,565,566],{"class":287}," create-resolver-endpoint",[277,568,570],{"class":569},"s_hVV"," \\\n",[277,572,573,576,579],{"class":279,"line":307},[277,574,575],{"class":294},"  --name",[277,577,578],{"class":287}," outbound-to-datacenter",[277,580,570],{"class":569},[277,582,583,586,589],{"class":279,"line":325},[277,584,585],{"class":294},"  --direction",[277,587,588],{"class":287}," OUTBOUND",[277,590,570],{"class":569},[277,592,593,596,599],{"class":279,"line":331},[277,594,595],{"class":294},"  --security-group-ids",[277,597,598],{"class":287}," sg-0a1b2c3d4e5f6a7b8",[277,600,570],{"class":569},[277,602,604,607],{"class":279,"line":603},5,[277,605,606],{"class":294},"  --ip-addresses",[277,608,609],{"class":287}," SubnetId=subnet-0aaa,SubnetId=subnet-0bbb\n",[277,611,613],{"class":279,"line":612},6,[277,614,328],{"emptyLinePlaceholder":9},[277,616,618,620,622,625],{"class":279,"line":617},7,[277,619,284],{"class":283},[277,621,563],{"class":287},[277,623,624],{"class":287}," create-resolver-rule",[277,626,570],{"class":569},[277,628,630,632,635],{"class":279,"line":629},8,[277,631,575],{"class":294},[277,633,634],{"class":287}," forward-corp-internal",[277,636,570],{"class":569},[277,638,640,643,646],{"class":279,"line":639},9,[277,641,642],{"class":294},"  --rule-type",[277,644,645],{"class":287}," FORWARD",[277,647,570],{"class":569},[277,649,651,654,657],{"class":279,"line":650},10,[277,652,653],{"class":294},"  --domain-name",[277,655,656],{"class":287}," corp.internal",[277,658,570],{"class":569},[277,660,662,665,668],{"class":279,"line":661},11,[277,663,664],{"class":294},"  --resolver-endpoint-id",[277,666,667],{"class":287}," rslvr-out-0123456789abcdef0",[277,669,570],{"class":569},[277,671,673,676,679,683,686],{"class":279,"line":672},12,[277,674,675],{"class":294},"  --target-ips",[277,677,678],{"class":287}," Ip=192.168.10.53,Port=",[277,680,682],{"class":681},"srdBf","53",[277,684,685],{"class":287}," Ip=192.168.20.53,Port=",[277,687,688],{"class":681},"53\n",[25,690,691,692,695],{},"A rule does nothing until you ",[45,693,694],{},"associate"," it with a VPC. Rules are per-Region resources and can be shared with other accounts through AWS RAM, which is the standard pattern: one networking account owns the outbound endpoint and the rules, and every workload account associates the shared rules with its VPCs.",[37,697,699],{"id":698},"when-a-rule-and-a-private-hosted-zone-disagree","When a rule and a private hosted zone disagree",[25,701,702,703,705,706,708],{},"You have a private hosted zone for ",[29,704,494],{}," and someone adds a forwarding rule for ",[29,707,494],{}," on the same VPC. Which answers?",[25,710,711,714],{},[45,712,713],{},"The Resolver rule wins."," Queries are forwarded to your network, and the records sitting in the private hosted zone are never consulted.",[25,716,717],{},"This is worth naming out loud because the failure is invisible from the Route 53 console: the zone is there, the records are there, the association is there, and none of it is used. If you need both, scope the rule to a narrower name than the zone, or drop the association.",[37,719,721],{"id":720},"query-logging-2-different-logs","Query logging: 2 different logs",[25,723,724],{},"Skill 5.2.2 names query logging directly, and there are 2 separate features with the same word in the name. Picking the wrong one wastes an investigation.",[143,726,727,739],{},[146,728,729],{},[149,730,731,733,736],{},[152,732],{},[152,734,735],{},"Public DNS query logging",[152,737,738],{},"Resolver query logging",[161,740,741,752,763,777,788,805],{},[149,742,743,746,749],{},[166,744,745],{},"What it captures",[166,747,748],{},"Queries that DNS resolvers send to Route 53 for a public hosted zone you own",[166,750,751],{},"Queries originating in VPCs you specify, queries arriving through an inbound endpoint, queries leaving through an outbound endpoint, and DNS Firewall rule actions",[149,753,754,757,760],{},[166,755,756],{},"Scope",[166,758,759],{},"Per public hosted zone, 1 configuration each",[166,761,762],{},"Per VPC, associated to a configuration",[149,764,765,768,774],{},[166,766,767],{},"Destination",[166,769,770,771],{},"CloudWatch Logs only, and the log group ",[45,772,773],{},"must be in us-east-1",[166,775,776],{},"CloudWatch Logs, an S3 bucket, or a Firehose delivery stream",[149,778,779,782,785],{},[166,780,781],{},"Identifies the client",[166,783,784],{},"The resolver's IP address, plus a truncated EDNS client subnet when the resolver sends one",[166,786,787],{},"The VPC ID, the instance ID, and the instance's IP address",[149,789,790,793,802],{},[166,791,792],{},"Log stream naming",[166,794,795,798,799],{},[29,796,797],{},"{hosted-zone-id}/{edge-location-id}",", for example ",[29,800,801],{},"Z1D633PJN98FT9/DFW3",[166,803,804],{},"Standard CloudWatch Logs streams",[149,806,807,810,813],{},[166,808,809],{},"Route 53 charge",[166,811,812],{},"None (you pay CloudWatch Logs)",[166,814,815],{},"None (you pay the destination)",[25,817,818],{},"A public query log entry looks like this:",[76,820,823],{"className":821,"code":822,"language":81},[79],"1.0 2026-08-11T08:16:02.130Z Z123412341234 example.com A NOERROR UDP DFW3 192.0.2.10 198.51.100.0/24\n",[29,824,822],{"__ignoreMap":84},[25,826,827],{},"Version, timestamp, hosted zone ID, query name, query type, response code, layer 4 protocol, edge location, resolver IP, EDNS client subnet.",[25,829,830,831,834,835,837],{},"Both logs are shaped by caching, and both undercount for the same reason. Public query logs miss everything a downstream resolver served from its own cache. Resolver query logs record only ",[45,832,833],{},"unique"," queries: if an instance asks for ",[29,836,423],{}," twice inside the VPC Resolver's cache TTL, the second lookup never appears. Reading either log as a request counter will mislead you.",[37,839,841],{"id":840},"quotas-worth-remembering","Quotas worth remembering",[143,843,844,854],{},[146,845,846],{},[149,847,848,851],{},[152,849,850],{},"Limit",[152,852,853],{},"Value",[161,855,856,864,872,880,888,896,904,912,920,928,936,944],{},[149,857,858,861],{},[166,859,860],{},"Hosted zones per account",[166,862,863],{},"500 (adjustable)",[149,865,866,869],{},[166,867,868],{},"Records per hosted zone",[166,870,871],{},"10,000 (adjustable, extra charge above 10,000)",[149,873,874,877],{},[166,875,876],{},"VPCs associated with one private hosted zone",[166,878,879],{},"300",[149,881,882,885],{},[166,883,884],{},"Active health checks per account",[166,886,887],{},"200 (adjustable)",[149,889,890,893],{},[166,891,892],{},"Child health checks per calculated health check",[166,894,895],{},"255",[149,897,898,901],{},[166,899,900],{},"Resolver endpoints per Region",[166,902,903],{},"4 per account (adjustable)",[149,905,906,909],{},[166,907,908],{},"IP addresses per Resolver endpoint",[166,910,911],{},"6 (adjustable)",[149,913,914,917],{},[166,915,916],{},"Target IP addresses per Resolver rule",[166,918,919],{},"6",[149,921,922,925],{},[166,923,924],{},"Resolver rules per Region",[166,926,927],{},"1,000 (adjustable)",[149,929,930,933],{},[166,931,932],{},"Rule-to-VPC associations per Region",[166,934,935],{},"2,000 (adjustable)",[149,937,938,941],{},[166,939,940],{},"UDP queries per second per endpoint IP address",[166,942,943],{},"10,000, dropping to as low as 1,500 when connection tracking is enforced or queries arrive through a Network Load Balancer",[149,945,946,949],{},[166,947,948],{},"Query logging configurations per hosted zone",[166,950,951],{},"1",[37,953,955],{"id":954},"exam-tips","Exam tips",[57,957,958,961,964,972,975,986,989,992],{},[60,959,960],{},"\"Point the apex at a load balancer, a CloudFront distribution, or an S3 website bucket\" is always an alias record. A CNAME at the apex is never a valid answer.",[60,962,963],{},"Alias queries to AWS resources are free; CNAME queries are billed, and a CNAME pointing at another Route 53 record is billed twice. Cost-flavored DNS questions usually resolve to alias.",[60,965,966,967,375,969,971],{},"A private hosted zone that resolves nothing means ",[29,968,263],{},[29,970,268],{},". Check them before anything else.",[60,973,974],{},"\"Works everywhere except inside the VPC, and the name is a subdomain of a private hosted zone\" is the NXDOMAIN trap. There is no fallback to public DNS.",[60,976,977,978,981,982,985],{},"Inbound and outbound are named from the VPC's perspective. On-premises clients resolving AWS names need an ",[45,979,980],{},"inbound"," endpoint. AWS instances resolving on-premises names need an ",[45,983,984],{},"outbound"," endpoint plus a forwarding rule.",[60,987,988],{},"A Resolver rule beats a private hosted zone for the same domain name.",[60,990,991],{},"Public query logging is us-east-1 only and covers public hosted zones. Attributing a lookup to an instance requires Resolver query logging.",[60,993,994],{},"VPC+2 is the resolver address. VPC+1 is the router. Custom DNS servers forward to +2.",[25,996,997,998,1002,1003,1006],{},"The rule to carry forward: before you debug a record, work out which resolver answered. A private hosted zone, a Resolver rule, and public DNS all claim names, they win in that reverse order (rule, then zone, then public), and none of them falls back to the next once it has claimed the namespace. With that settled, the next lesson changes the question from ",[999,1000,1001],"em",{},"who answers"," to ",[999,1004,1005],{},"which of several answers you get",", which is what routing policies decide.",[1008,1009,1010],"style",{},"html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":84,"searchDepth":325,"depth":325,"links":1012},[1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023],{"id":39,"depth":307,"text":40},{"id":90,"depth":307,"text":91},{"id":123,"depth":307,"text":124},{"id":245,"depth":307,"text":246},{"id":354,"depth":307,"text":355},{"id":434,"depth":307,"text":435},{"id":487,"depth":307,"text":488},{"id":698,"depth":307,"text":699},{"id":720,"depth":307,"text":721},{"id":840,"depth":307,"text":841},{"id":954,"depth":307,"text":955},"md",[1026],{"slug":536,"concept":1027,"style":1028,"aspectRatio":1029,"labels":1030},"A single wide diagram with the VPC on the left, the on-premises data center on the right, and a private connection (Direct Connect or VPN) drawn between them. Two clearly separated arrows cross that connection in opposite directions: an outbound path starting at an EC2 instance, passing through the VPC+2 resolver, matching a forwarding rule, exiting through the outbound endpoint to the on-premises DNS server; and an inbound path starting at an on-premises client, hitting the on-premises resolver's conditional forwarder, entering through the inbound endpoint, and being answered by the VPC Resolver from a private hosted zone. Direction is the whole point, so the 2 arrows must be visually unmistakable and each step labeled in order. A footer strip states the naming rule that resolves the confusion.","diagram","16:9",[1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041],"Outbound endpoint: queries leaving the VPC","1. EC2 instance asks for db.corp.internal","2. VPC+2 resolver matches a forwarding rule for corp.internal","3. Outbound endpoint sends the query over Direct Connect or VPN","4. On-premises DNS server answers","Inbound endpoint: queries entering the VPC","a. On-premises client asks for app.aws.example.com","b. On-premises resolver forwards to the inbound endpoint IP addresses","c. Inbound endpoint hands the query to the VPC Resolver","d. VPC Resolver answers from the private hosted zone","Both names are written from the VPC's point of view: outbound leaves the VPC, inbound enters it",[13,14,15,16,17,18],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/03-dns-and-content-delivery/01-route53-dns-and-resolver",{"passingScore":1046,"questions":1047},70,[1048,1057,1065,1073,1081,1088,1096,1104,1110],{"question":1049,"type":1050,"options":1051,"correctAnswer":1055,"explanation":1056},"You register example.com and want the apex name example.com to point at an Application Load Balancer. Which record do you create?","single",[1052,1053,1054,1055],"A CNAME record for example.com pointing at the load balancer DNS name","An A record with the load balancer's current IP addresses, updated by a scheduled job","An NS record delegating example.com to the load balancer","An alias A record for example.com with the load balancer as the target","The DNS protocol does not allow a CNAME at the zone apex, which is exactly the gap alias records fill: an alias record can sit at the apex and still point at an AWS resource. Hardcoding load balancer IP addresses breaks the moment Elastic Load Balancing replaces a node, because those addresses are not stable. Route 53 also does not charge for alias queries to AWS resources, while CNAME queries are billable.",{"question":1058,"type":1050,"options":1059,"correctAnswer":1060,"explanation":1064},"A private hosted zone named example.com is associated with your VPC. An instance queries reports.example.com, which has no record in that zone, and a public record for reports.example.com does exist. What does the instance get back?",[1060,1061,1062,1063],"NXDOMAIN, because a matching private hosted zone stops the query from going to public DNS","The public record, because the VPC Resolver falls back to the internet when the private zone has no match","A SERVFAIL error, because the private hosted zone is authoritative but incomplete","The public record, but only if DNS hostnames are enabled on the VPC","Once the VPC Resolver finds a private hosted zone whose name matches or is a parent of the query, it searches only that zone and returns NXDOMAIN if no record matches the name and type. There is no fallback to public DNS at that point, which is why a partially populated private zone silently blackholes every subdomain it does not define. This is the classic split-view failure, and the fix is to add the missing record to the private zone.",{"question":1066,"type":1050,"options":1067,"correctAnswer":1069,"explanation":1072},"Your on-premises DNS servers need to resolve names held in a private hosted zone in AWS. Which Resolver component do you create?",[1068,1069,1070,1071],"An outbound endpoint, plus a forwarding rule for the private zone's domain","An inbound endpoint, and point the on-premises resolver's conditional forwarder at its IP addresses","A public hosted zone with the same records, restricted by IP","A Resolver rule of type System associated with the VPC","Endpoint names are written from the VPC's point of view: an inbound endpoint accepts queries coming into the VPC, which is what an on-premises resolver needs. An outbound endpoint does the reverse, sending VPC-originated queries to your network. Duplicating the records in a public zone would publish internal names on the internet, which is the thing a private hosted zone exists to avoid.",{"question":1074,"type":1075,"options":1076,"correctAnswers":1079,"explanation":1080},"You created a private hosted zone and associated it with a VPC, but instances in that VPC do not resolve its records. Which VPC settings should you check first?","multiple",[263,268,1077,1078],"The VPC's DHCP options set domain-name value","Instance tenancy",[263,268],"Private hosted zones require both enableDnsSupport and enableDnsHostnames to be true on the VPC, and the failure is silent when either is off. The DHCP options set changes the default search domain and can make short names behave oddly, but it does not disable private zone resolution. Instance tenancy is unrelated to DNS, though dedicated tenancy does block Client VPN subnet association elsewhere in this domain.",{"question":1082,"type":1050,"options":1083,"correctAnswer":449,"explanation":1087},"A VPC has the CIDR 10.20.0.0/16. What is the IP address of the VPC Resolver that instances send DNS queries to?",[1084,1085,449,1086],"10.20.0.1","10.20.0.3","10.20.255.254","The VPC Resolver answers at the base of the VPC CIDR plus two, so 10.20.0.0/16 gives 10.20.0.2. The .1 address is the VPC router and .3 is reserved by AWS for future use, which is why custom DNS servers running on instances must forward to .2 and not to .1. This is also why every subnet loses its first 4 addresses.",{"question":1089,"type":1050,"options":1090,"correctAnswer":1091,"explanation":1095},"You have a private hosted zone for corp.internal associated with a VPC, and you also create a Resolver forwarding rule for corp.internal associated with the same VPC. Which one answers queries?",[1091,1092,1093,1094],"The Resolver rule, because rules take precedence over private hosted zones for the same domain name","The private hosted zone, because it is authoritative inside the VPC","Whichever was created first","Both, with the resolver merging the answer sets","When a Resolver rule and a private hosted zone cover the same domain, the rule wins and queries are forwarded to your network instead of being answered from the zone's records. This produces a confusing outage: the records are visibly present in Route 53 and never used. The fix is to scope the rule to a narrower subdomain or remove the association.",{"question":1097,"type":1050,"options":1098,"correctAnswer":1101,"explanation":1103},"You enabled public DNS query logging on a hosted zone but see far fewer entries than your application's request volume suggests. What explains this?",[1099,1100,1101,1102],"Query logging samples 1 query in every 1000 by default","The log group retention period is deleting entries","Only queries that reach Route 53 are logged, and resolvers answer most queries from their cache until the record TTL expires","Alias queries are never logged","Query logs record what DNS resolvers actually send to Route 53, not what clients ask for. A resolver that has cached your record keeps serving it locally for the length of the TTL, so a record with a 300 second TTL can hide thousands of client lookups behind a single logged query. Lowering the TTL raises the log volume, at the cost of more queries and slower client-side resolution.",{"question":1105,"type":1050,"options":1106,"correctAnswer":1108,"explanation":1109},"True or False: a public DNS query logging configuration can send logs to a CloudWatch Logs log group in any AWS Region.",[1107,1108],"True","False","The log group for Route 53 public DNS query logging must be in US East (N. Virginia), because Route 53 is a global service whose control plane lives in us-east-1. Resolver query logging is different: it is Regional and can deliver to CloudWatch Logs, an S3 bucket, or a Firehose delivery stream in the Region of the VPC. Confusing the two is a common setup failure.",{"question":1111,"type":1050,"options":1112,"correctAnswer":1113,"explanation":1117},"An investigator asks which EC2 instance looked up a suspicious domain name last Tuesday. Which log answers the question?",[1113,1114,1115,1116],"Resolver query logging, which records the VPC ID, the instance ID, and the source IP address of the query","Public DNS query logging on the hosted zone for that domain","VPC Flow Logs filtered to UDP port 53","CloudTrail data events for Route 53","Resolver query logs capture queries that originate inside your VPCs and include the instance ID and source IP, which is exactly the attribution the question asks for. Public DNS query logging only covers queries that arrive at Route 53 for a hosted zone you own, and it identifies the resolver rather than the client. Flow logs would show traffic to 10.x.x.2 but carry no domain name at all.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/05-networking-content-delivery/03-dns-and-content-delivery/01-route53-dns-and-resolver","Qk2_LJfprMqMpURHuVGd_sceg_B15DsmVIeleuo36fw",{"locked":9,"reason":1122,"meta":1123,"item":3},"paywall",{"title":1124,"description":1125,"isFree":5,"estimatedMinutes":1126,"difficulty":1127,"learningObjectives":1128},"CloudFront Distributions","A CloudFront distribution is a set of rules that decide, at an edge location, whether to answer from cache or ask your origin. This lesson covers cache behaviors and their matching order, the cache key, the TTL rules that override your Cache-Control headers, invalidation, HTTPS with custom domains, and locking the origin down with OAC.",32,"advanced",[1129,1130,1131,1132,1133,1134,1135],"Describe the path a request takes through an edge location, a regional edge cache, and the origin, and name the requests that skip the regional edge cache","Order cache behaviors correctly and predict which one applies to a given request path","Explain what the cache key is and identify the settings that lower a cache hit ratio","Predict the cached duration of an object from the Minimum, Maximum, and Default TTL values and the origin's Cache-Control header","Choose between invalidation and versioned file names for a content update","Configure an alternate domain name with HTTPS, including the Region an ACM certificate must live in","Lock an S3 origin to a distribution with origin access control and explain why OAC replaced OAI",{"locked":9,"reason":1122,"meta":1137,"item":3},{"title":1138,"description":1139,"isFree":5,"estimatedMinutes":1140,"difficulty":11,"learningObjectives":1141},"Route 53 Routing Policies","Eight routing policies answer the same question differently: given this query, which of my endpoints should the caller get? This lesson covers health checks first, then each policy, and the boundaries between the 3 policies that all claim to route by location.",30,[1142,1143,1144,1145,1146,1147],"Describe the 3 health check types and explain the 18% rule that decides whether an endpoint is healthy","Calculate the traffic share of a weighted record and predict what happens when a weight is 0","Distinguish latency, geolocation, geoproximity, and IP-based routing by the input each one actually uses","Configure active-passive failover with failover records and active-active failover with any other policy","Explain what multivalue answer routing returns and why it is not a load balancer","Select the correct routing policy from the constraint stated in a scenario"]