Question

A company runs a hybrid environment with several VPCs attached to a central inspection/shared-services VPC via Transit Gateway. On-premises DNS servers are authoritative for corp.example.internal, while a partner's private DNS servers (reachable only over an existing Direct Connect connection) are authoritative for partner.example.net. Application VPCs must resolve AWS private hosted zones, corp.example.internal names via on-premises DNS, and partner.example.net names via the partner DNS servers. All other queries must resolve normally via AWS. The team wants a centralized, low-maintenance design. Which approach meets these requirements?

Accepted Answer

Deploy a Route 53 Resolver outbound endpoint in the shared-services VPC and create two forwarding rules — one for corp.example.internal targeting on-premises DNS and one for partner.example.net targeting the partner DNS servers — then share both rules via AWS RAM and associate them with the application VPCs.

Answer

Create a single conditional forwarding rule for '.' (all domains) pointing to the on-premises DNS servers, and let on-premises DNS recursively forward partner and AWS queries.

Answer

Deploy a Route 53 Resolver inbound endpoint in each application VPC and configure the on-premises and partner DNS servers to forward queries into AWS.

Answer

Configure the VPC DHCP option set in each application VPC to point directly at the on-premises DNS server IP addresses so all queries are forwarded there.