Task Statement 1.2: Design DNS solutions that meet public, private, and hybrid requirements.
📘AWS Certified Advanced Networking – Specialty
1. What is Amazon Route 53 (Simple Explanation)
Amazon Route 53 is AWS’s DNS (Domain Name System) service.
DNS answers one simple question:
“When a user types a name, where should the request go?”
Route 53:
- Translates domain names into IP addresses
- Works for public internet, private AWS networks, and hybrid environments
- Integrates deeply with VPC, load balancers, CloudFront, and on-premises networks
For the exam, you must understand how Route 53 works differently in public, private, and hybrid designs and how it integrates with AWS networking services.
2. Core Route 53 Components (Must Know)
2.1 Hosted Zones
A hosted zone is where DNS records are stored.
There are two types:
Public Hosted Zone
- Used for internet-facing resources
- DNS records are resolvable from the public internet
- Commonly used for:
- Public websites
- Public APIs
- Internet-facing load balancers
Private Hosted Zone
- Used only inside one or more VPCs
- DNS records are not visible on the internet
- Used for:
- Internal applications
- Private services
- Microservices communication
📌 Exam rule:
Public hosted zones → Internet DNS
Private hosted zones → VPC-only DNS
2.2 DNS Records (Basic Types)
Route 53 supports standard DNS records. For the exam, focus on:
- A record – Maps name to IPv4 address
- AAAA record – Maps name to IPv6 address
- CNAME – Alias to another DNS name
- Alias record (AWS-specific) – Alias to AWS resources
📌 Important:
Alias records are preferred over CNAME for AWS services because:
- No extra DNS query cost
- Works at the root domain
- AWS automatically tracks IP changes
3. Integration of Route 53 with Amazon VPC
This is the most important part of this topic.
3.1 Route 53 Private Hosted Zones + VPC
A private hosted zone is directly associated with one or more VPCs.
How it works:
- DNS records exist inside Route 53
- Only resources inside associated VPCs can resolve those names
- No internet access is required
Key points:
- One private hosted zone can be associated with multiple VPCs
- VPCs can be in different AWS accounts (with authorization)
- Used for internal service discovery
📌 Exam focus:
- Internal DNS resolution
- Multi-VPC architectures
- Cross-account DNS access
3.2 AmazonProvidedDNS in VPC
Every VPC has a built-in DNS resolver called AmazonProvidedDNS.
It:
- Resolves public DNS names
- Resolves private hosted zone names
- Handles AWS service DNS names automatically
Requirements:
enableDnsSupport = trueenableDnsHostnames = true
📌 If DNS is not resolving inside a VPC, check these settings first.
3.3 Route 53 Resolver (Critical for Hybrid)
Route 53 Resolver allows DNS queries to move between AWS and on-premises networks.
There are two components:
Inbound Resolver Endpoint
- Allows on-premises DNS to resolve:
- Private hosted zones in AWS
- Private service names in VPCs
Outbound Resolver Endpoint
- Allows AWS resources to resolve:
- On-premises DNS names
- Internal corporate domains
📌 Exam rule:
- Inbound → On-prem → AWS
- Outbound → AWS → On-prem
4. Route 53 Integration with Load Balancing Services
4.1 Application Load Balancer (ALB)
Route 53 integrates tightly with ALB using Alias records.
Benefits:
- Automatically handles IP changes
- Supports health-based routing
- Works for public and internal ALBs
Typical use:
- DNS name points to ALB
- ALB distributes traffic to targets inside VPC
📌 Exam tip:
- Use Alias record, not CNAME
- Works for both public and private ALBs
4.2 Network Load Balancer (NLB)
Route 53 can route traffic to NLBs.
Key points:
- NLBs have static IPs or Elastic IPs
- Alias records still recommended
- Commonly used for TCP/UDP workloads
5. Route 53 Integration with CloudFront
CloudFront is a global edge service.
Integration points:
- Route 53 alias record points to CloudFront distribution
- CloudFront serves content from edge locations
- Improves global performance
Important exam note:
- CloudFront always uses public DNS
- Even if the origin is private
6. Route 53 and Hybrid DNS Architectures
Hybrid DNS is very important for this exam.
6.1 Typical Hybrid DNS Design
Components:
- On-premises DNS servers
- AWS Route 53 private hosted zones
- Route 53 Resolver inbound and outbound endpoints
- VPN or Direct Connect connectivity
DNS flow:
- On-prem DNS forwards AWS queries to inbound endpoint
- AWS DNS forwards on-prem queries to outbound endpoint
📌 Key exam goal:
Enable bidirectional DNS resolution.
6.2 Conditional Forwarding
Conditional forwarding means:
- DNS queries for specific domains go to specific DNS servers
Used when:
- Some domains exist in AWS
- Some domains exist on-premises
This avoids:
- DNS conflicts
- Unnecessary DNS lookups
7. Route 53 Routing Policies (Exam Relevant)
Route 53 supports multiple routing policies. You must know when to use each.
Common Policies:
- Simple – Single record
- Weighted – Split traffic by percentage
- Latency-based – Route to lowest latency region
- Failover – Active/passive setup
- Geolocation – Route based on user location
- Geoproximity – Route based on resource location
📌 Exam focus:
- Latency-based for global apps
- Failover for high availability
- Weighted for gradual traffic shift
8. Health Checks Integration
Route 53 can monitor:
- Public endpoints
- Load balancers
- Application health URLs
Health checks are used with:
- Failover routing
- Weighted routing
- Multi-region designs
📌 Important:
Route 53 health checks are outside AWS regions and test from multiple locations.
9. Security Considerations (Exam Points)
- Private hosted zones are not internet accessible
- Route 53 Resolver endpoints are protected by:
- Security Groups
- Network ACLs
- IAM controls who can:
- Create hosted zones
- Modify DNS records
10. Key Exam Summary (Very Important)
For AWS Certified Advanced Networking – Specialty, remember:
- Route 53 supports public, private, and hybrid DNS
- Private hosted zones integrate directly with VPC
- Route 53 Resolver enables hybrid DNS
- Alias records are preferred for AWS services
- Integration with:
- VPC
- ALB / NLB
- CloudFront
- VPN / Direct Connect
- DNS design must support:
- High availability
- Low latency
- Secure name resolution
