DNS
6 posts tagged DNS.
A DNS Firewall allowlist blocks the name you allowed, because the CNAME behind it was never on the list
Route 53 Resolver DNS Firewall inspects every name in a redirection chain by default. Allow app.example.com, and the query is still blocked when that record is a CNAME to a CDN hostname the list does not mention. The default fail mode is closed, the block response can be made to look like a missing record, and the fix is one setting whose two values mean opposite things.
Networking9 minThe one network limit that does not grow when you scale up
Every instance can send 1,024 packets per second to the VPC resolver, per network interface, and the number is the same on a t3.nano and a u-24tb1.metal. Throttled queries never reach anything that logs, so the symptom is intermittent DNS failure with no evidence anywhere — and scaling up, the instinctive fix, changes nothing.
Networking5 minA custom DNS server in your DHCP options turns off private DNS for every endpoint in the VPC
Private hosted zones, interface endpoint private DNS, and Route 53 Resolver rules all live in one place: the VPC resolver at .2. Point the DHCP option set at your own DNS servers and every instance stops asking it. Nothing is deleted, nothing is disabled, and every one of those features quietly stops applying.
Networking5 minThe network failures that present as success
Most AWS networking incidents announce themselves with a timeout. A smaller set return a valid answer and do the wrong thing, and every diagnostic instinct that works on the first kind has nothing to grab on the second.
Networking5 minA Resolver rule outranks your private hosted zone, and the zone is never consulted
Two DNS sources can claim the same domain in one VPC. The Resolver rule wins at equal specificity and the hosted zone is never read — and nothing in the answer reliably tells you which source served it, so the check has to be a configuration check.
Networking6 minAn interface endpoint with private DNS off is a bill with no benefit
It costs the same per hour as one that works, reaches available, passes every reachability check, and nothing routes to it. The Terraform default is false, which is most of why this ships.
Networking5 min