Route53 Resolver Diagnostics

Amazon Route 53 Resolver Diagnostics

When to use

Any Route 53 Resolver investigation — resolver endpoint creation, endpoint connectivity, forwarding rules, DNS Firewall, query logging, inbound/outbound endpoints, RAM sharing, VPC associations, or DNSSEC validation.

Investigation workflow

Step 1 — Collect and triage

aws route53resolver list-resolver-endpoints --query 'ResolverEndpoints[*].{Id:Id,Name:Name,Direction:Direction,Status:Status,IpCount:IpAddressCount}'
aws route53resolver list-resolver-rules --query 'ResolverRules[*].{Id:Id,Name:Name,DomainName:DomainName,Status:Status,RuleType:RuleType}'
aws route53resolver list-firewall-rule-groups --query 'FirewallRuleGroups[*].{Id:Id,Name:Name,ShareStatus:ShareStatus}'

Step 2 — Domain deep dive

aws route53resolver get-resolver-endpoint --resolver-endpoint-id <endpoint-id>
aws route53resolver list-resolver-endpoint-ip-addresses --resolver-endpoint-id <endpoint-id>
aws route53resolver get-firewall-rule-group --firewall-rule-group-id <group-id>

Step 3 — Detailed investigation

aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=route53resolver.amazonaws.com --max-results 20
aws route53resolver list-resolver-query-log-configs --query 'ResolverQueryLogConfigs[*].{Id:Id,Name:Name,Status:Status,AssociationCount:AssociationCount}'
aws route53resolver list-resolver-dnssec-configs --query 'ResolverDnssecConfigs[*].{Id:Id,OwnerId:OwnerId,ResourceId:ResourceId,ValidationStatus:ValidationStatus}'

Read references/guardrails.md before concluding on any Route 53 Resolver issue.

Tool quick reference

Gotchas: Route 53 Resolver

• Resolver endpoints require at least 2 IP addresses in different AZs for high availability. Single-AZ endpoints are a single point of failure.
• Inbound endpoints receive DNS queries FROM on-premises networks. Outbound endpoints send DNS queries TO on-premises or external DNS servers. The naming is from the VPC's perspective.
• DNS Firewall rules are evaluated in priority order (lowest number first). A BLOCK rule at priority 100 overrides an ALLOW rule at priority 200.
• Forwarding rules are associated with VPCs, not endpoints. A rule can be associated with multiple VPCs. System rules (for AWS internal domains) take precedence over custom rules.
• Query logging captures ALL DNS queries in the VPC, not just those going through resolver endpoints. This includes queries to the VPC DNS resolver (AmazonProvidedDNS).
• DNSSEC validation is per-VPC. Enabling it causes queries for domains with invalid DNSSEC signatures to return SERVFAIL. This can break resolution for misconfigured domains.
• RAM sharing of rules and firewall groups is cross-account only within the same AWS Organization by default. Sharing outside the organization requires enabling external sharing.

Anti-hallucination rules

1. Always cite specific endpoint IDs, rule IDs, or API responses as evidence.
2. Inbound endpoints receive queries; outbound endpoints send queries. Never reverse the direction.
3. DNS Firewall and forwarding rules are different features. Never conflate them.
4. DNSSEC validation can break DNS resolution for misconfigured domains. Never enable without testing.
5. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.

14 runbooks