Question

A financial services company must ensure that all DNS responses resolved by workloads in a production VPC are cryptographically validated to prevent DNS spoofing and cache poisoning. The workloads query both public domains and an internal Route 53 private hosted zone. The security team requires that any response failing validation be rejected rather than returned to the client. What should the network engineer implement to meet this requirement with the least operational overhead?

Accepted Answer

Enable DNSSEC validation on the Route 53 Resolver for the VPC so the Resolver validates signed responses and returns SERVFAIL for records that fail validation.

Answer

Enable DNSSEC signing on the Route 53 private hosted zone and configure a Route 53 Resolver outbound endpoint to forward public queries to a validating on-premises resolver.

Answer

Deploy a Route 53 Resolver DNS Firewall rule group that blocks domains whose responses cannot be validated against a trust anchor.

Answer

Configure the VPC DHCP options set to point to a custom validating resolver running on EC2 instances that perform DNSSEC validation for all queries.