Host and Service Name Resolution for Applications and Clients

This guide covers the fundamental and advanced concepts of the Domain Name System (DNS) within the context of AWS, specifically focusing on Amazon Route 53, hybrid architectures, and name resolution strategies for the AWS Certified Advanced Networking Specialty (ANS-C01).

Learning Objectives

After studying this guide, you should be able to:

• Design DNS solutions that meet public, private, and hybrid resolution requirements.
• Differentiate between standard DNS records and AWS-specific Alias records.
• Configure Route 53 Resolver endpoints for seamless hybrid connectivity.
• Implement security measures including DNSSEC and DNS Firewall.
• Optimize application availability using advanced routing policies and health checks.

Key Terms & Glossary

• Authoritative Name Server: A DNS server that holds the actual records for a specific domain and can provide definitive answers to queries.
• Recursive Resolver: The server that receives a query from a client and "hunts" through the DNS hierarchy to find the answer.
• FQDN (Fully Qualified Domain Name): The complete domain name for a specific host (e.g., web-01.us-east-1.compute.internal).
• Hosted Zone: A container for records that defines how you want to route traffic for a domain and its subdomains.
• TTL (Time to Live): A numerical value in seconds that tells a DNS resolver how long to cache a record before requesting a fresh copy.
• DNSSEC (DNS Security Extensions): A suite of specifications for securing information provided by DNS by using digital signatures.

The "Big Idea"

DNS is the "Global Phonebook" of the internet. While humans use names (example.com), machines use IP addresses (192.0.2.1). In the AWS ecosystem, Route 53 extends this basic functionality into a Global Traffic Management system, allowing for high availability and low latency by intelligently routing users based on their physical location, network health, and specific application needs.

Formula / Concept Box

Hierarchical Outline

1. DNS Fundamentals
   • Distributed Architecture: Hierarchy from Root (.) $\rightarrow$ TLD (.com) $\rightarrow$ Domain (example.com) $\rightarrow$ Subdomain.
   • Delegation: Records in a parent zone that point to the authoritative servers of a child zone.
2. Amazon Route 53 Implementation
   • Public Hosted Zones: Accessible from the internet.
   • Private Hosted Zones (PHZ): Associated with specific VPCs; resolution is internal to AWS.
   • Alias Records: AWS-specific pointers that map to AWS resources (ELB, S3, CloudFront) without incurring extra DNS query costs.
3. Hybrid DNS Architecture
   • Inbound Endpoints: Allow on-premises networks to resolve VPC-hosted names.
   • Outbound Endpoints: Allow VPC resources to resolve names hosted on-premises via conditional forwarding rules.
4. Advanced Traffic Management
   • Routing Policies: Latency, Geoproximity, Weighted, and Failover.
   • Health Checks: Integrated monitoring that removes unhealthy endpoints from DNS responses.

Visual Anchors

The DNS Hierarchy Flow

Hybrid Resolution Path (On-Prem to VPC)

This diagram illustrates how an on-premises client resolves a private AWS resource name using a Route 53 Inbound Endpoint.

\begin{tikzpicture}[node distance=2cm, font=\small] % Styles \tikzstyle{box} = [rectangle, draw, minimum width=2.5cm, minimum height=1cm, text centered] \tikzstyle{cloud} = [draw, ellipse, minimum width=3cm, minimum height=1.5cm, text centered]

\end{tikzpicture}

Definition-Example Pairs

• SOA (Start of Authority) Record
  • Definition: Contains administrative info about the zone (admin email, primary NS, refresh timers).
  • Example: When a secondary DNS server needs to know how often to check the primary server for updates, it looks at the Refresh value in the SOA record.
• CNAME (Canonical Name)
  • Definition: Maps one domain name (alias) to another (canonical).
  • Example: Mapping www.example.com to example.com. Note: CNAMEs cannot coexist with other records for the same name (like MX records).
• PTR (Pointer) Record
  • Definition: Maps an IP address to a domain name (Reverse DNS).
  • Example: An email server checks the PTR record of an incoming connection's IP to verify it matches the claimed domain name to prevent spam.

Worked Examples

Scenario 1: Resolving "Split-Horizon" DNS

Goal: Use the same domain name (app.internal) but return different IP addresses for internal VPC users versus external internet users.

1. Step 1: Create a Public Hosted Zone for app.internal (though usually, you use a public TLD). Create an A record pointing to the Public IP of the Load Balancer.
2. Step 2: Create a Private Hosted Zone for app.internal and associate it with VPC-A and VPC-B.
3. Step 3: Create an A record in the Private Hosted Zone pointing to the Private IP of the Load Balancer.
4. Outcome: Internal EC2 instances query and receive the 10.x.x.x address; external users query and receive the 54.x.x.x address.

Scenario 2: TTL Impact Calculation

Question: If you update a record that has a TTL of 3600 seconds, how long might a client continue to see the old data?

• Calculation: $3600 seconds / 60 = 60 minutes$.
• Solution: Clients could see stale data for up to one hour. If performing a migration, you should lower the TTL to 60 or 300 seconds well in advance of the change.

Checkpoint Questions

1. What is the maximum byte length of a single DNS label (e.g., the "example" part of example.com)?
2. Which record type is preferred for mapping the root of a domain (example.com) to an AWS Application Load Balancer, and why?
3. True or False: Route 53 Resolvers require a public IP address to function within a VPC.
4. In a hybrid setup, which component allows an AWS Lambda function to resolve a hostname located on an on-premises Windows DNS server?

▶Click to see answers

1. 63 bytes.
2. Alias record; because CNAMEs are not allowed at the zone apex (root).
3. False; Route 53 Resolvers allow resolution without the need for public IPs.
4. Route 53 Resolver Outbound Endpoint (paired with a Forwarding Rule).

Muddy Points & Cross-Refs

• Alias vs. CNAME: Students often confuse these. Remember: Alias is an AWS-specific "smart" pointer that works at the Zone Apex and is free. CNAME is a standard DNS pointer that costs money per query and cannot be at the apex.
• Conditional Forwarding vs. System Rules: System rules in Route 53 Resolver define how the resolver behaves by default (e.g., searching its own PHZs first). Conditional rules (Forwarding) are explicit instructions for specific domains (e.g., "If it ends in .corp, go to 10.0.0.5").
• Cross-Ref: For more on how DNS interacts with global performance, see Unit 1: Edge Networking (CloudFront & Global Accelerator).

Comparison Tables

Public vs. Private Hosted Zones

Record Types Summary