DNS in the Cloud

Public and private zones

• A public hosted zone answers for your domain on the internet (Route 53, Azure DNS, Cloud DNS).
• A private hosted zone answers only inside the networks you associate it with: db.internal.example.com resolves to 10.20.3.15 in the VPC and doesn't exist anywhere else.

Using the same name in both, with different answers inside and outside, is split-horizon DNS.

The built-in resolver

Every VPC has a resolver: on AWS it's at the VPC range's base address plus two (10.20.0.2 for 10.20.0.0/16, also reachable at 169.254.169.253), on Azure at 168.63.129.16, and on Google Cloud at the metadata server 169.254.169.254. It answers private zones, cloud service names and internet names.

import ipaddress

def aws_resolver(vpc_cidr):
    return ipaddress.ip_network(vpc_cidr).network_address + 2

for cidr in ["10.20.0.0/16", "172.31.0.0/16", "10.0.64.0/18"]:
    print(f"VPC {cidr:14} -> resolver {aws_resolver(cidr)}")

PRIVATE_ZONE = {"db.internal.example.com": "10.20.3.15"}
PUBLIC_ZONE = {"www.example.com": "93.184.215.14"}
def answer(name, inside_vpc):
    zone = {**PUBLIC_ZONE, **PRIVATE_ZONE} if inside_vpc else PUBLIC_ZONE
    return zone.get(name, "NXDOMAIN")
print("inside: ", answer("db.internal.example.com", inside_vpc=True))
print("outside:", answer("db.internal.example.com", inside_vpc=False))

VPC 10.20.0.0/16   -> resolver 10.20.0.2
VPC 172.31.0.0/16  -> resolver 172.31.0.2
VPC 10.0.64.0/18   -> resolver 10.0.64.2
inside:  10.20.3.15
outside: NXDOMAIN

Hybrid DNS

Offices and cloud networks usually need each other's private names. Use inbound and outbound resolver endpoints with forwarding rules (Route 53 Resolver, Azure DNS Private Resolver, Cloud DNS forwarding zones): "send corp.example.com queries to the office DNS servers" and "let the office resolve aws.example.com".

Routing with DNS

Cloud DNS can also steer traffic: weighted answers for gradual migrations, latency-based or geolocation answers for multi-region apps, and failover answers driven by health checks.