Skip to main content
In this lesson we explain how DNS operates inside an Amazon VPC and how EC2 instances and other resources resolve domain names within that VPC. When you launch an EC2 instance into a subnet, the instance is assigned a private IPv4 address. This is true for instances in both private and public subnets. When the VPC is configured with DNS support and hostnames, AWS also assigns a private DNS name that encodes that private IP address. For example, an instance with private IP 10.0.100.10 typically receives a private DNS name like: ip-10-0-100-10.ec2.internal
Other resources can reach that instance by using either the private IP (10.0.100.10) or its private DNS name.
A slide titled "DNS in VPCs" showing two side-by-side boxes: a Private Subnet (10.0.100.0/24) containing a server and a Public Subnet (10.0.100.10) containing an instance labeled 10.0.100.10.ec2.internal.
How instances resolve those names
  • Instances use the Amazon-provided DNS resolver for name resolution inside the VPC.
  • The resolver is reachable at the second IP address in the VPC CIDR range (CIDR base + 2). Examples:
    • VPC CIDR 10.10.0.0/16 -> resolver at 10.10.0.2
    • VPC CIDR 10.20.0.0/16 -> resolver at 10.20.0.2
  • Most AMIs configure this resolver automatically in /etc/resolv.conf, so the OS and applications use it by default.
Example snippet you might see on a Linux instance:
Summary table — common resolver addresses VPC DNS attributes Two VPC-level attributes control DNS behavior: Putting it together
  • Private IPv4 addresses can be resolved via automatically assigned private DNS names (when enableDnsSupport and enableDnsHostnames permit).
  • The Amazon-provided DNS resolver is normally reachable at the VPC CIDR base + 2 and is configured on instances’ resolv.conf.
  • enableDnsSupport must be true for instances to use the Amazon-provided DNS for name resolution.
  • enableDnsHostnames controls whether instances receive DNS hostnames (including public hostnames for instances with public IPv4 addresses).
Check your VPC attributes if DNS resolution or public hostnames are not behaving as expected. Ensure enableDnsSupport is true for Amazon-provided DNS to work; set enableDnsHostnames to true if you need public DNS hostnames for instances with public IPv4 addresses.
If enableDnsSupport is disabled, the Amazon-provided DNS server will not resolve names for the VPC. This breaks DNS resolution that relies on AWS-managed DNS—verify these attributes before troubleshooting application DNS failures.
Useful links and references Troubleshooting checklist
  • Inspect /etc/resolv.conf on the instance to confirm the resolver IP (should be the VPC base + 2).
  • Verify enableDnsSupport and enableDnsHostnames in the VPC settings.
  • Ensure instances have appropriate network access to the VPC resolver (no custom network ACLs or security group rules blocking DNS).
  • If using custom DNS (DHCP options set), confirm those servers are reachable and correctly configured.

Watch Video