Setting Up DNS Forwarding and Conditional Forwarding

Welcome students!

In this article, we explore DNS forwarding and conditional forwarding in detail. Previously, we provided an overview of inbound and outbound DNS resolvers. Now, we'll delve deeper into how these resolvers function and how you can configure them to meet your network's needs.

Resolvers can be configured as AWS authoritative or external DNS authoritative servers. The query direction for endpoints is flexible, allowing you to set up resolvers to handle inbound traffic only, outbound traffic only, or both. For instance, you can configure DNS servers to manage both inbound and outbound traffic:

Because the resolver is deployed within a VPC, the configuration is straightforward. You simply select the resolver type and set the corresponding rules.

Outbound Endpoint

The outbound endpoint configuration enables your resolver to use an external source for resolving DNS queries. Below is an overview of the steps required:

Follow these steps to configure the outbound endpoint:

1. Select the VPC where the resolver endpoint will reside.
2. Choose one or more subnets to ensure high availability.
3. Attach an appropriate security group to the network interface. Ensure that port 53 is permitted for outbound traffic.
4. Confirm that the endpoint is assigned an internal or public IP address based on your setup.

For example, when queries originating within your VPC—for instance, for jo.example.com—need to be resolved externally, you must establish rules to forward these DNS queries to a target IP address. This target might be reached via VPN or Direct Connect. The forwarding rules direct the DNS queries from your VPC to an external network.

There are three types of resolvers to keep in mind:

• Inbound and outbound resolver (handles both directions)
• Outbound resolver only
• Inbound resolver only

Inbound Endpoint

Next, consider the inbound endpoint, which allows an external DNS server to forward queries for specific domain names to an AWS DNS resolver endpoint.

To set up an inbound endpoint, follow these guidelines:

1. Deploy the inbound endpoint within your chosen VPC.
2. Select one or more subnets to maintain high availability.
3. Attach a security group that permits the required traffic (typically port 53).
4. Ensure that DNS queries from your on-premises network—forwarded over VPN, Direct Connect, or through a public connection (if configured)—are routed to this AWS endpoint.

Consider a scenario where your corporate DNS server forwards queries for certain domains into your VPC. The diagram below illustrates how an inbound endpoint is set up in the us-west-1 region to achieve this.

Conditional Forwarding

Conditional forwarding provides an additional layer of flexibility by allowing you to apply different forwarding rules based on specific conditions. This means you can forward DNS queries outbound to a corporate network or inbound to AWS depending on the domain name or chosen DNS server.

Here’s how conditional forwarding works:

• Define a rule that specifies conditions (for example, matching a particular domain name or IP address) for the DNS queries.
• If the condition is satisfied, forward the query to the designated target DNS server—this may be on-premises or in another network.
• If the condition is not met, the default forwarding behavior is used.

For instance, in a conditional forwarding scenario with an outbound endpoint:

In this configuration, DNS queries originating from your VPC are selectively forwarded based on the established rules. Often, a corporate DNS server is configured to be authoritative when using an outbound endpoint, while an inbound endpoint treats AWS as the authoritative source.

Watch the demo, complete the lab exercises, and practice these configurations to reinforce your knowledge.

Catch you in the next article!