Configuring appropriate DNS records

Task Statement 2.3: Implement complex hybrid and multi-account DNS architectures.

📘AWS Certified Advanced Networking – Specialty

---

1. What Are DNS Records?

DNS (Domain Name System) records are like the instructions that tell the internet how to find resources (servers, services, applications) using human-readable names. Instead of remembering IP addresses, DNS records map names to IP addresses, services, or other resources.

In AWS hybrid or multi-account environments, DNS records are crucial for connecting internal (private) and external (public) services, as well as resources across different accounts or VPCs.

---

2. Common Types of DNS Records in AWS

For the exam, you need to know the main DNS record types and their uses in AWS networks.

A Record (Address Record)

• Maps a domain name to an IPv4 address.
• Example use:
  • app.internal.example.com → 10.0.1.15 (a server inside a VPC)
• Key for private VPC DNS.

AAAA Record

• Maps a domain name to an IPv6 address.
• Example use:
  • api.example.com → 2600:1f18:abcd:1234::1
• Important if your network uses IPv6.

CNAME (Canonical Name)

• Creates an alias for another domain name.
• Example use:
  • service.example.com → app.example.com
• Useful when pointing to AWS services like CloudFront or S3 endpoints.
• Limitation: Cannot use CNAME at the root of a hosted zone (use Alias instead).

Alias Record (AWS-specific)

• Similar to CNAME, but AWS allows it at the root domain.
• Points to AWS resources directly:
  • ELB (Elastic Load Balancer)
  • CloudFront distributions
  • S3 buckets (static website)
• Example:
  • example.com → myloadbalancer-123456.us-east-1.elb.amazonaws.com

MX Record (Mail Exchange)

• Directs email to mail servers for a domain.
• Example:
  • example.com MX 10 mail1.example.com

PTR Record (Reverse DNS)

• Maps IP address → domain name (opposite of A/AAAA).
• Important for hybrid networks if your services or monitoring requires reverse lookups.
• Example:
  • 10.0.1.15 → app.internal.example.com

TXT Record

• Stores text information for a domain.
• Common uses:
  • SPF/DKIM for email verification
  • Domain ownership verification
  • Custom internal metadata for IT automation
• Example:
  • example.com TXT "v=spf1 include:amazonses.com ~all"

SRV Record

• Specifies services available on a domain with ports and priorities.
• Example use:
  • Used by Active Directory or SIP services inside a VPC:
  • _ldap._tcp.example.com → 10.0.1.20:389

---

3. How DNS Records Work in Hybrid and Multi-Account AWS Networks

Private Hosted Zones

• AWS Route 53 private hosted zones allow DNS records only inside specific VPCs.
• Example:
  • Private DNS for internal APIs across multiple accounts.
  • api.internal.example.com → 10.0.2.25
• Important exam point: Private zones can be shared across accounts using AWS RAM.

Public Hosted Zones

• For public-facing services.
• Example:
  • www.example.com → CloudFront or ALB
• Use Alias records to point to AWS resources without exposing IPs.

Conditional Forwarding

• In hybrid networks (on-prem + AWS), configure DNS to forward specific domains to the correct DNS resolver.
• Example:
  • internal.example.com → AWS Route 53 Resolver endpoint
  • external.example.com → On-prem DNS server

---

4. Best Practices for Configuring DNS Records in AWS Exams

1. Use Alias records for AWS resources instead of CNAMEs when possible.
2. Separate private and public zones to avoid accidental exposure.
3. Use private hosted zones for VPC-to-VPC or hybrid communication.
4. Share private zones carefully across accounts with AWS RAM.
5. Use PTR records for hybrid networks requiring reverse DNS lookups.
6. Keep DNS TTLs appropriate:
   • Short TTL for dynamic resources (like auto-scaled servers)
   • Longer TTL for static resources (like static S3 websites)

---

5. Exam Tips

• Know which record type maps to which AWS service.
• Remember CNAME vs Alias differences.
• Understand private hosted zones and sharing via AWS RAM.
• Conditional forwarding is key in hybrid setups.
• Be familiar with reverse DNS and TXT records for verification/security.

---

✅ Quick Cheat Sheet

Record	Maps	AWS Use
A	Name → IPv4	Private servers, internal APIs
AAAA	Name → IPv6	IPv6-enabled services
CNAME	Alias → domain	CloudFront, S3, ELB (non-root)
Alias	Alias → AWS resource	CloudFront, S3, ELB (root or subdomain)
MX	Email servers	Mail routing
PTR	IP → Name	Reverse DNS lookups
TXT	Text info	Verification, SPF, DKIM
SRV	Service → port	AD, SIP, internal services