DNS as an attack surface
Lesson 3 of 3 in Hybrid and Private Connectivity.
DNS is the one protocol almost every environment allows out without thinking about it, which is exactly why attackers like it. It is the first step of nearly every outbound connection, so blocking a name blocks the connection before a single packet of payload moves. And it is a channel: data encoded into query labels leaves a network that has no other egress, and a compromised host beacons to its operator by resolving a new name every few minutes.
So DNS is two things to a security engineer — a control point and a detection surface — and AWS gives you one service for each.
Route 53 Resolver DNS Firewall filters queries that VPC resources send to the Route 53 Resolver. You build rule groups containing rules that reference domain lists — your own, or AWS managed domain lists covering malware and command-and-control domains — associate the rule group with VPCs, and give each rule a priority that determines evaluation order. Three actions: ALLOW (permit the query), ALERT (permit it and log it), and BLOCK. What a block returns is your choice, and it matters operationally: NODATA (the query succeeded, there is no record — which looks like a timeout to the client), NXDOMAIN (the name does not exist), or OVERRIDE, which answers with a CNAME you specify so you can point the client at a sinkhole you monitor.
Resolver query logging is the detection half: every query from the VPC, with the name, the type, the response code, and which instance asked, delivered to CloudWatch Logs, S3 or Amazon Data Firehose. Nothing else in your telemetry answers "which host asked for that domain, and when" as cheaply.
Rule group priority, and Firewall Manager at organization scale
Within a rule group, rules are evaluated by priority, lowest first; across rule groups associated with a VPC, the association priority decides. A Firewall Manager DNS Firewall policy distributes rule groups across an organization and lets you place them as first or last rule groups relative to whatever accounts have configured locally — first when your central rules must win, last when you are transitioning away from team-owned rules.
Allow-list or block-list?
A block-list (allow everything, block known-bad) is what most environments run and what the managed threat lists are built for. An allow-list (block everything, permit named domains) is dramatically stronger and is realistic for workload subnets where you know every destination — the DNS counterpart of a Network Firewall domain allow-list. The two services complement each other: DNS Firewall stops the lookup, Network Firewall stops the connection, and keeping both lists aligned is the documented recommendation.
DNSSEC: two different things
DNSSEC validation on the Route 53 Resolver makes the resolver verify the signatures on signed responses, so a forged answer is rejected rather than cached — it is off by default and you turn it on per VPC. DNSSEC signing is the other side: signing your own public hosted zone so other resolvers can validate your records. One protects what your workloads believe; the other protects what the world believes about you.
What DNS Firewall does not see
Resources that bypass the VPC resolver — a host configured to use a public DNS resolver directly, or DNS over HTTPS to an external provider — are not filtered, because the queries never reach the checkpoint. Close that with egress controls: block outbound port 53 to anything but the resolver, and use Network Firewall to stop DNS-over-HTTPS endpoints you have not approved. A checkpoint you can walk around is a suggestion.
Key terms: Route 53 Resolver DNS Firewall, Resolver query logging, DNSSEC validation, Firewall Manager policy
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.