Question

A financial services company runs a large VPC hosting thousands of EC2 instances that generate a very high volume of DNS queries to the Amazon-provided VPC resolver (the .2 address). During peak trading hours, application teams report intermittent DNS resolution failures and timeouts, but CloudWatch shows CPU and network utilization on the instances is normal. The instances are spread across three Availability Zones. What is the MOST likely cause of the DNS failures, and how should the network team address it?

Accepted Answer

The VPC resolver enforces a limit of 1,024 packets per second per network interface toward the .2 address; distribute the query load across the ENIs in each AZ and consider caching or a local resolver fleet to reduce per-ENI query volume

Answer

The Route 53 private hosted zone has reached its record limit; split the zone into multiple hosted zones and associate each with the VPC

Answer

Route 53 Resolver outbound endpoints are throttling queries; increase the number of outbound endpoint IP addresses to raise the queries-per-second ceiling

Answer

The VPC DHCP option set is misconfigured to point at an on-premises DNS server; change it back to AmazonProvidedDNS to restore capacity