How do I troubleshoot DNS resolution issues with Route 53 Resolver endpoints?
Last updated: 2021-05-20
I'm unable to resolve DNS records using an inbound or outbound endpoint in Amazon Route 53. How can I troubleshoot these DNS resolution failures?
Troubleshooting issues with inbound endpoints
Complete the following steps to be sure that DNS resolvers on your network can forward DNS queries to Route 53 Resolver using your inbound endpoint.
- If you need your on-premises DNS server to forward DNS queries to the inbound endpoint for your domains, then you must create a conditional forwarding rule on your on-premises DNS server. This configuration applies to private hosted zones and public domains.
- Confirm that you have connectivity to the inbound resolver endpoint IP addresses over the AWS Direct Connect connection or VPN. This step validates whether you can reach the inbound resolver endpoint IP address from your on-premises network. Use the following telnet command to test connectivity between the inbound endpoint resolver IP address on port 53: telnet <inbound endpoint resolver IP address> 53.
- Check the security group associated with the inbound resolver endpoint. The security group must allow traffic on TCP and UDP port 53 from your on-premises DNS server IP address.
- If you're using custom network access control lists (network ACLs) with the subnet where the inbound endpoint was created, confirm that the network ACLs allow:
- Inbound UPD and TCP traffic from the on-premises DNS server on port 53.
- Outbound UDP and TCP traffic to the on-premises DNS server on destination port range 1024-65535.
- Confirm that the route table associated with the subnet where the inbound endpoint resolver was created includes a route to the on-premises network. You can configure the route through a Direct Connect connection or VPN. This route allows the inbound endpoint resolver to return a DNS query response.
- To validate the domain resolution, complete a domain name lookup from the on-premises DNS server or local host.
- For Windows: nslookup <private hosted zone domain name>
- For Linux or macOS: dig <private hosted zone domain name>
- If the previous commands fail to return a record, then you can bypass your on-premises DNS server. Send the DNS query directly to the inbound resolver endpoint IP address using the following commands.
- For Windows: nslookup <private hosted zone domain name> @ <inbound endpoint IP address>
- For Linux or macOS: dig <private hosted zone domain name> @ <inbound endpoint IP address>
- Confirm that your on-premises DNS server sends only recursive queries. Route 53 inbound resolver doesn't support iterative queries.
- If you're resolving records in a private hosted zone, then confirm that your inbound resolver endpoints and private hosted zone are associated with the correct VPC.
Troubleshooting issues with outbound endpoints
Complete the following steps to be sure that Route 53 Resolver conditionally forwards queries to resolvers on your network using your outbound endpoint.
- Confirm that you're using an Amazon provided DNS. If you're using custom DNS servers on an instance in your VPC, then you must configure the DNS servers to route private DNS queries to the IP address of the Amazon provided DNS servers of your VPC. This IP address is the IP address at the base of the VPC network range plus two.
- Confirm that the egress rule of the security group associated with the outbound resolver endpoint allows UDP and TCP port 53 traffic to the IP addresses of your on-premises DNS server.
- If you have custom rules for network ACLs corresponding to the subnets where the outbound endpoint interfaces were created, then confirm that the rules allow:
- Outbound UDP and TCP traffic to the on-premises DNS server on port 53.
- Inbound UDP and TCP traffic from the on-premises DNS server on ephemeral port range 1024-65535.
- Confirm that the route table associated with the subnet of the outbound resolver endpoint has a route to your on-premises DNS server. The route can be configured through a Direct Connect connection or VPN.
- Determine whether your on-premises DNS servers are protected by a firewall. If the servers are protected by a firewall, then confirm that the firewall allows traffic from the outbound resolver endpoint IP addresses.
- Note that if you have a private hosted zone and a Resolver rule that routes traffic to your network for the same domain name, the Resolve rule takes precedence.
- Note that Resolver routes outbound DNS queries using the rule that contains the most specific domain name. For more information, see How Resolver determines whether the domain name in a query matches any rules.
- If you're using a shared rule, confirm that the shared rule is associated with your VPC.
- Use VPC Flow Logs to capture flow information on the network interfaces used by the resolvers. Filter by the resolver's name to view logs for the resolver's elastic network interface.