Question

A company runs an internal application in a VPC. Developers created a private hosted zone in Route 53 for the domain 'internal.example.com' and added an A record for 'api.internal.example.com' pointing to an internal ALB. EC2 instances in the VPC cannot resolve 'api.internal.example.com' and receive NXDOMAIN, even though the record exists. The VPC has DNS resolution and DNS hostnames enabled. What is the MOST likely cause?

Accepted Answer

The private hosted zone has not been associated with the VPC where the EC2 instances run.

Answer

The instances are missing an inbound security group rule allowing DNS on UDP port 53.

Answer

A network ACL is blocking outbound traffic to the Route 53 resolver at 169.254.169.253.

Answer

The A record must be created as an alias record for Route 53 to resolve it inside a VPC.