How do I configure Route 53 Resolver to integrate with on-premises DNS servers and resolve hybrid DNS resolution issues?

Resolution

Set up a hybrid architecture

Use Route 53 Resolver endpoints and forwarding rules to forward traffic between Amazon Virtual Private Cloud (Amazon VPC) and your on-premises data center. When workloads use both VPCs and on-premises resources, you can resolve DNS records that you host on-premises. Your on-premises resources can also resolve names that you host on Route 53.

For more information, see Resolving DNS queries between VPCs and your network.

Note: Route 53 Resolver endpoints and forwarding rules resolve DNS records in a hybrid architecture without additional DNS servers.

To set up the hybrid architecture, take the following actions:

• Configure inbound Resolver endpoints to forward DNS queries to your VPC from your on-premises network or another VPC. The default Amazon DNS server allows requests only from within the VPC CIDR range.
• Configure outbound Resolver endpoints to forward DNS queries from your VPC to your on-premises network or another VPC. 
• Create one forwarding rule for each domain name, and then associate the forwarding rules with a VPC. To share the rules across multiple AWS accounts, see Sharing Resolver rules with other AWS accounts and using shared rules.

For more information see, Forwarding inbound DNS queries to your VPCs and Forwarding outbound DNS queries to your network.

Troubleshoot DNS resolution issues within the hybrid architecture

Take the following actions:

• For DNS resolution issues across inbound and outbound endpoints, see How do I troubleshoot DNS resolution issues with Route 53 Resolver endpoints?
• Route 53 inbound endpoints can handle only recursive queries. If your on-premises DNS server makes an authoritative query to the inbound endpoint, then your DNS resolution from on-premises resources fails. To resolve this issue, see How do I troubleshoot DNS resolution issues in my Route 53 private hosted zone?
• Route 53 endpoints have a quota of 10,000 queries per second for each IP address in an elastic network interface. If you experience DNS query loss and occasional timeouts, then use Amazon CloudWatch to check the InboundQueryVolume and OutboundQueryAggregateVolume metrics. If your endpoints exceed 50% of the capacity for a network, then configure additional network interfaces for the endpoint.
• If you forward Canonical Name Record (CNAME) queries between a VPC and an on-premises environment, then check your forwarding rules. You must have forwarding rules for the both the CNAME and the CNAME value. To resolve this issue, see How do I troubleshoot CNAME record resolution issues when I use a conditional forwarder in my Windows DNS server?
• If you associated multiple Resolver rules and private hosted zones with a VPC, then you might experience unexpected DNS resolution behavior. For information about how Route 53 Resolver evaluates rules, see How Resolver determines whether the domain name in a query matches any rules.