Hands-On Cloud Architecture

Internal DNS Resolution with Amazon Route 53

Build your own private cloud naming authority. Learn how to map internal IP addresses to human-readable names and create alias chains using Route 53 Private Hosted Zones. Best of all: you do not need to register or purchase a domain name.

Start Lab Contact Author

0 Required Prerequisites & Lab Environment

Make sure you have these building blocks ready in your AWS console before implementing the DNS zones.

AWS Account

Free Tier Eligible

Target VPC

Default or Custom VPC

No Domain Cost

Custom Names Allowed

Linux Client

For dig & nslookup

1 Verify VPC DNS Resolution Settings

Route 53 Private Hosted Zones require the Amazon VPC built-in DNS resolver (the Route 53 Resolver at the network baseline) to be active. Double-check these settings before configuring records.

VPC Configuration Checklist

Open the Amazon VPC Console and choose Your VPCs.
Select your target VPC (your default VPC is fine for this lab).
Click Actions > Edit VPC settings.
Under DNS settings, ensure both options are checked:
- Enable DNS resolution
- Enable DNS hostnames
Click Save changes.

Architectural Insight

When DNS resolution is enabled, instances in your VPC send queries to the reserved VPC DNS server (at your CIDR base + 2, e.g., 10.0.0.2 or 169.254.169.253). That resolver automatically checks your associated Private Hosted Zones first!

2 Launch Test Client (Bastion / EC2 Instance)

Because a Private Hosted Zone cannot be reached over the public internet, you need an EC2 instance sitting in the exact same VPC to run tests.

Open the EC2 Console and click Launch instances.
Set Name to DNS-Bastion-Host.
Choose Amazon Linux 2023 AMI (or Ubuntu 24.04 LTS).
Choose t2.micro or t3.micro (Free Tier).
Under Network settings, pick your verified VPC, select a public subnet, and enable Auto-assign public IP so you can connect via EC2 Instance Connect.
Click Launch instance.

3 Create the Route 53 Private Hosted Zone

Now build the isolated DNS container. Because this hosted zone is private and linked directly to your VPC, you can name it whatever you like without purchasing or registering the domain.

In the AWS Console search bar, search for and open Route 53.
In the left sidebar, click Hosted zones and then click Create hosted zone.
Set Domain name to: internal.news.org.
Select Private hosted zone under Type.
Under VPCs to associate with the hosted zone:
- Select your AWS Region (e.g., ap-south-1 or us-east-1).
- Select the VPC where your Bastion instance was launched.
Click Create hosted zone.

4 Create the Target A Record

An A Record (Address Record) maps a fully qualified domain name to an IPv4 address. In this step, we map our primary internal application to our server IP.

Inside the internal.news.org hosted zone details, click Create record.
Set Record name to: thewhitepaper (Full record becomes thewhitepaper.internal.news.org).
Leave Record type as: A - Routes traffic to an IPv4 address and some AWS resources.
Set Value to: 10.10.0.10 (or your actual target EC2 Private IP).
Set TTL (Seconds) to 60 for quick lab testing.
Keep Routing policy as Simple routing and click Create records.

5 Create the CNAME Record (The Alias Goal)

A CNAME Record (Canonical Name) acts as an alias, pointing one domain name to another domain name rather than an IP address. We will point our database endpoint to the primary web hostname.

Click Create record inside your hosted zone.
Set Record name to: database.thewhitepaper (Full record becomes database.thewhitepaper.internal.news.org).
Change Record type to: CNAME - Routes traffic to another domain name and to some AWS resources.
Ensure Alias is toggled Off.
Set Value to:
thewhitepaper.internal.news.org
Set TTL (Seconds) to 60.
Click Create records.

6 Verification & DNS Query Testing

Connect to your test EC2 instance using EC2 Instance Connect or SSM (Session Manager) and verify that DNS queries resolve accurately through the VPC resolver.

Terminal: Install DNS Utilities

# On Amazon Linux 2023:
sudo dnf install -y bind-utils

# On Ubuntu 24.04 / 22.04:
# sudo apt-get update && sudo apt-get install -y dnsutils

A. Test the A Record

Terminal: Lookup thewhitepaper

nslookup thewhitepaper.internal.news.org

# Expected Output:

Server: 10.0.0.2

Address: 10.0.0.2#53

Name: thewhitepaper.internal.news.org

Address: 10.10.0.10

B. Test the CNAME Alias Record

Terminal: Lookup database alias

nslookup database.thewhitepaper.internal.news.org