Question

A company runs workloads across three VPCs connected via a Transit Gateway. They operate an on-premises Active Directory domain (corp.example.internal) reachable over a Site-to-Site VPN. EC2 instances in all VPCs must resolve records in corp.example.internal by querying the on-premises DNS servers (10.100.0.10 and 10.100.0.11), while continuing to resolve public domains and AWS internal names normally. Which implementation meets these requirements with the least ongoing administrative effort?

Accepted Answer

Create a Route 53 Resolver outbound endpoint in one VPC, define a forwarding rule for corp.example.internal targeting the two on-premises DNS IPs, and associate the rule with all three VPCs using AWS RAM or direct associations.

Answer

Create a Route 53 Resolver inbound endpoint in each VPC and configure the on-premises DNS servers to conditionally forward AWS queries to those endpoints.

Answer

Deploy custom DNS forwarder EC2 instances in each VPC, set them as the DHCP option set DNS servers, and configure them to forward corp.example.internal queries on-premises.

Answer

Create a private hosted zone for corp.example.internal in Route 53, associate it with all three VPCs, and import the on-premises records manually.