DNS in VPC

Instances need to resolve names to IPs — both public internet names and other AWS resources’ internal DNS names. Building and running your own DNS resolver for this is unnecessary busywork. AWS solves it with the VPC DNS Resolver (formerly “Amazon-provided DNS”), an AWS-managed resolver automatically available inside every VPC, reachable at the base of the VPC CIDR range plus two (e.g. 10.0.0.2 for a 10.0.0.0/16 VPC).

• The VPC Resolver is available to every subnet in the VPC (regional scope) at the same fixed address (CIDR base + 2), not tied to an AZ.
• Two per-VPC settings control DNS behavior: enableDnsSupport (does the VPC resolver work at all) and enableDnsHostnames (do instances get public/private DNS hostnames assigned).
• Route 53 Private Hosted Zones extend this further, letting you resolve custom domain names privately within one or more associated VPCs.

graph LR
EC2["EC2 Instance"] -->|"DNS query"| RES["VPC Resolver (CIDR base + 2)"]
RES -->|"public names"| Internet(("Public DNS"))
RES -->|"private zone names"| PHZ["Route 53 Private Hosted Zone"]
classDef res fill:#f3ecfb,stroke:#8b3de0,stroke-width:3px,color:#3a1a5c

The built-in VPC Resolver is free for standard query volumes. Route 53 Resolver endpoints (used for hybrid DNS with on-premises networks) and Private Hosted Zones have their own separate, modest charges.

• Both enableDnsSupport and enableDnsHostnames must be true for an instance in a public subnet to receive a resolvable public DNS hostname — a very common exam gotcha when a public IP exists but the public hostname doesn’t resolve.
• The default VPC has both settings enabled out of the box; a custom VPC does not always have enableDnsHostnames on by default and it’s worth checking explicitly.
• For hybrid DNS (on-premises resolving AWS private names, or vice versa), you need Route 53 Resolver inbound/outbound endpoints — the built-in VPC resolver alone can’t be reached from outside the VPC.
• A Private Hosted Zone can be associated with multiple VPCs, even across accounts, enabling shared internal DNS namespaces.