Configuring DNS zones and conditional forwarding

Task Statement 2.3: Implement complex hybrid and multi-account DNS architectures.

📘AWS Certified Advanced Networking – Specialty

1. What is a DNS Zone?

A DNS zone is a portion of the Domain Name System (DNS) namespace that is managed by a specific organization or administrator. Think of it as a container for DNS records.

There are two main types of DNS zones in AWS:

Public Hosted Zone
- This is used when you want your domain (like example.com) to be accessible over the internet.
- AWS Route 53 is the service used to manage public hosted zones.
- Example: You have a website myapp.example.com and you want anyone on the internet to access it.
Private Hosted Zone
- This is used when your domain should only be visible inside a specific network, like an AWS VPC or on-premises network connected via VPN/Direct Connect.
- Example: You have internal servers like db.internal.example.com that should never be exposed publicly.

Exam Tip: Know the difference between public and private hosted zones and when to use each.

2. Configuring DNS Zones in AWS

When you create a DNS zone, you configure DNS records for that domain. These records tell DNS queries how to route traffic.

Steps for configuring a hosted zone in AWS:

Choose type: Public or Private.
Enter domain name: For example, example.com.
Link to VPCs (only for private zones): Specify which VPCs can use this private zone.
Add DNS records:
- A record → maps a domain to an IPv4 address
- AAAA record → maps a domain to an IPv6 address
- CNAME record → maps a domain to another domain
- MX record → email server information

Key AWS Exam Concept:

Private Hosted Zones can only be resolved by VPCs you associate with the zone.
Public Hosted Zones are globally resolvable.

3. What is Conditional Forwarding?

Conditional forwarding is when a DNS server forwards queries for a specific domain to another DNS server instead of resolving it itself.

Example in IT context:

You have two networks:
- VPC A with private domain internal-a.example.com
- VPC B with private domain internal-b.example.com
If a server in VPC A wants to resolve host.internal-b.example.com, you configure conditional forwarding so that:
- Queries for internal-b.example.com are sent to VPC B’s DNS resolver.
- All other queries (like example.com) are resolved normally by VPC A’s DNS.

Exam Tip: AWS allows Route 53 Resolver rules to implement conditional forwarding for hybrid environments (VPCs + on-premises networks).

4. How Conditional Forwarding Works in AWS

AWS uses Route 53 Resolver for conditional forwarding in hybrid networks. Here’s what you need to know:

Inbound Endpoints:
- Allow on-premises DNS servers to query Route 53 private hosted zones.
- Example: Your on-premises IT network can query internal.example.com in AWS.
Outbound Endpoints:
- Allow AWS resources to forward DNS queries to external DNS servers, like your on-premises DNS or another VPC’s DNS.
Resolver Rules:
- Specify which domain name to forward and which IP addresses to send the queries to.
- Example:
  - Domain: corp.example.com
  - Forward to IP: 10.0.0.5 (on-premises DNS server)
Rule Types:
- Forward: Forward queries for a domain to specific IPs.
- System: Default AWS behavior.
- Disable: Prevent certain domains from being resolved.

Key Exam Points:

Conditional forwarding is essential for multi-account or hybrid architectures.
You need to know how to combine private hosted zones + Route 53 Resolver rules + VPC associations.

5. Multi-Account & Hybrid Considerations

When working with multiple AWS accounts or hybrid setups:

Private hosted zones can be shared between accounts using AWS RAM.
Conditional forwarding rules allow centralized DNS management.
You can create hub-and-spoke DNS architectures, where one VPC or account resolves queries for multiple other accounts or on-prem networks.

Exam Tip: Understand hub-and-spoke DNS setup, private zone sharing, and conditional forwarding rules. AWS often tests hybrid network scenarios.

6. Example Flow in an IT Environment

Your company has a VPC with private hosted zone corp.internal.com.
On-premises DNS wants to resolve AWS hostnames.
You create a Route 53 inbound endpoint in AWS.
On-premises DNS forwards queries for *.corp.internal.com to the inbound endpoint.
AWS resolves queries for private resources.
Any other domain (like google.com) is resolved normally through public DNS.

This shows zones + conditional forwarding working together.

7. Exam Checklist

To be exam-ready, remember:

✅ Types of hosted zones: Public vs Private
✅ DNS records in hosted zones: A, AAAA, CNAME, MX, TXT
✅ VPC associations for private hosted zones
✅ Conditional forwarding concepts: forward queries for specific domains
✅ AWS Route 53 Resolver: inbound/outbound endpoints, resolver rules
✅ Hybrid and multi-account scenarios: sharing private zones via RAM
✅ Hub-and-spoke DNS architectures