Lecture 36: Introduction to Route53 DNS Resolver Endpoints (Hybrid DNS)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:06
- 来源：Udemy Lecture 26072746
- Slide 数量：5
- 画面切换：00:28、02:33、02:54、03:41
扫描说明
按 Udemy Transcript 的 67 个时间点逐一定位并比较视频画面，确认章节标题、混合 DNS 问题、Resolver Endpoint 概览、入站架构和出站架构共 5 个 Slide。同页箭头和端点组件的逐步出现视为动画构建，截图保留最终稳定状态。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Introduction to Route 53 Resolver Endpoints
时间范围：00:00–00:28
总结 / Summary
中文
本讲介绍 Route 53 Resolver 端点（Resolver Endpoints）如何解决混合 DNS（Hybrid DNS）场景的问题；这里只给出概览，详细配置与实操将在 Route 53 章节展开。
English
This lecture introduces how Route 53 Resolver endpoints solve hybrid DNS problems. It provides an overview here, with detailed configuration and hands-on work deferred to the Route 53 section.
Transcript
00:00 Hi.
00:00 So before we wrap up this section, I wanted to quickly talk about route 53 resolver Endpoints, which
00:07 is a relatively new feature of Amazon provided DNS server.
00:11 And there is a purpose why AWS launched this feature.
00:15 So let's try to understand that.
00:17 And then we are going to dive deep into resolver endpoints into the route 53 section.
00:24 So what are these resolver endpoints.
00:26 So before that let's understand the problem.
2. The Hybrid DNS Connectivity Problem
时间范围：00:28–02:33
总结 / Summary
中文
企业同时运行本地数据中心（On-Premises Data Center）和 VPC 时，可能让 VPC 查询本地 DNS、让本地查询 Route 53 私有托管区域（Private Hosted Zone），或实现双向解析。即使两端已有 VPN 或 AWS Direct Connect，VPC 的 .2 Route 53 解析器（Route 53 Resolver）默认也不能直接从本地网络访问；这是 Resolver 端点（Resolver Endpoints）要解决的核心问题。
English
When an organization operates both an on-premises data center and a VPC, it may need VPC-to-on-premises DNS, on-premises-to-Route 53 private DNS, or bidirectional resolution. Even with VPN or AWS Direct Connect connectivity, the VPC .2 Route 53 Resolver is not directly reachable from the on-premises network by default. Resolver endpoints solve that gap.
Transcript
00:28 So we already saw the right side of this picture where we have the VPC and then private DNS.
00:35 And then this route 53 DNS resolver can resolve the DNS queries which comes from the EC2 instances inside
00:41 the VPC.
00:43 But as you know, in the real world, you might be operating across your on premise data center and
00:48 the VPC.
00:49 So some servers could be in data center, some servers are in the VPC, and you would want to have a
00:55 common DNS records to assign the domain name for all these servers.
01:01 So there could be three scenarios.
01:03 First, maybe you want to have your DNS server on premises.
01:07 So all the DNS queries from these EC2 instances should go to your on premises DNS server.
01:13 Or second, you want to manage that in Amazon route 53 private hosted zone, for example, and all the
01:21 DNS queries from on premises are forwarded to Amazon route 53.
01:25 And third, it could be bidirectional, so you might have some part of the DNS hosted in AWS and some
01:32 part in on premise data center.
01:34 Now, if that is the case, you might be assuming that if both these networks are connected over a VPN
01:40 or a direct connect, then very well.
01:42 This DNS server can reach to your route 53 DNS resolver and then everything will work.
01:48 But that's not the case.
01:50 By default.
01:51 This route 53 DNS server is not accessible from your on premises network.
01:57 And that was the problem.
01:58 And exactly to solve this problem, AWS launched route 53 DNS resolver endpoints.
02:05 And these endpoints can be accessed over from this corporate data center.
02:11 Because these endpoints have the Enis elastic network interfaces which are created inside your VPC.
02:18 So let's understand what these endpoints are and what problems they solve.
02:24 So in almost 2018 or 19, the dot two resolver was officially named as route 53 resolver.
3. Route 53 Resolver Endpoint Types
时间范围：02:33–02:54
总结 / Summary
中文
Route 53 Resolver 端点通过 VPC 子网中的弹性网络接口（Elastic Network Interface, ENI）提供可路由 IP。入站端点（Inbound Endpoint）接收来自本地网络的 DNS 查询；出站端点（Outbound Endpoint）把 AWS 内的匹配查询转发到本地 DNS，通常配合条件转发规则（Conditional Forwarding Rule）。
English
Route 53 Resolver endpoints expose routable IPs through Elastic Network Interfaces in VPC subnets. Inbound endpoints receive DNS queries from on-premises networks, while outbound endpoints forward matching AWS-side queries to on-premises DNS, typically through conditional forwarding rules.
Transcript
02:33 And this provides both inbound and outbound endpoints.
02:38 And of course, as the name suggests, the inbound endpoint receives the DNS queries from your on premises
02:44 network, and outbound endpoint is used to send the DNS queries from the VPC or from the AWS to the
02:52 on premise network.
4. Inbound Resolver Endpoint
时间范围：02:54–03:41
总结 / Summary
中文
入站 Resolver 端点（Inbound Resolver Endpoint）在多个子网创建 ENI 以实现高可用性（High Availability）。本地 DNS 把 AWS 域名查询转发到这些 ENI 私有 IP，端点再把请求交给 Route 53 解析器（Route 53 Resolver），后者可解析私有托管区域、公有托管区域和互联网公有 DNS。DNS 权威数据在 AWS 一侧管理。
English
An inbound Resolver endpoint creates ENIs in multiple subnets for high availability. On-premises DNS forwards AWS-domain queries to those private ENI addresses, and the endpoint passes them to the Route 53 Resolver, which can resolve private hosted zones, public hosted zones, and public Internet DNS. The DNS data is managed on the AWS side.
Transcript
02:54 So with respect to the architecture, this is the architecture for inbound endpoints where you have
03:00 the DNS resolver, but additionally you are configuring the inbound endpoints which creates the Enis
03:07 in multiple subnets for high availability.
03:10 And then all the DNS queries from your on premises network can be forwarded to these IP addresses which
03:17 these Enis have.
03:18 And then these Enis will ultimately send it to route 53 DNS resolver, which can of course resolve the
03:25 DNS queries from public or private hosted zone or public DNS.
03:29 So here you are managing your DNS in the AWS.
03:34 Similarly, if you have the DNS management on the corporate data center side, then you will have outbound
5. Outbound Resolver Endpoint
时间范围：03:41–05:06
总结 / Summary
中文
出站 Resolver 端点（Outbound Resolver Endpoint）用于把 VPC 中的特定域名查询发送到本地 DNS。EC2 查询先到 AmazonProvidedDNS；若规则匹配本地域名，条件转发器（Conditional Forwarder）把请求交给出站 ENI，再经 VPN/DX 路径到企业 DNS。相比直接在 DHCP 选项集（DHCP Option Set）里替换所有名称服务器，Resolver 端点能同时保留 AWS 解析并按域名选择性转发，更适合现代混合 DNS。
English
An outbound Resolver endpoint sends selected VPC queries to on-premises DNS. EC2 queries first reach AmazonProvidedDNS; when a rule matches an on-premises domain, conditional forwarding passes the request to outbound ENIs and across the VPN or Direct Connect path to corporate DNS. Unlike replacing every name server through DHCP options, Resolver endpoints preserve AWS resolution while selectively forwarding domains, making them the preferred modern hybrid-DNS pattern.
Transcript
03:41 resolver endpoints configured in the VPC.
03:43 And then any request that comes from the EC2 instances will first go to the Amazon provided DNS server.
03:50 And there it will see if it matches any of the private hosted zone.
03:55 If not, it will send it to the outbound resolver.
03:58 Or you can also configure the conditional forwarder, which checks what is the domain name is, and
04:04 accordingly it will send that request to this outbound Eni.
04:08 And this outbound Eni will send the request to the on premises DNS server.
04:13 So that is the other way around.
04:15 So I would say this is the latest way in which you should think of hybrid DNS in AWS.
04:20 Now earlier we saw that we could have Dhcp option set in which you can configure the IP address of your
04:27 own DNS server.
04:29 But with this route 53 resolver endpoints this is much simplified.
04:34 Now you can have both inbound and outbound DNS connectivity if you use this endpoint.
04:41 So at this moment that's it about this resolver endpoints.
04:45 And as I said we will cover this in very detail.
04:49 And we will also do some exercises in the route 53 section.
04:53 So I hope that is clear.
04:55 And with that we will wrap up this section with quick exam tips.
05:00 And we will move to the next section.
05:02 So thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
Route 53 Resolver 端点（Resolver Endpoints）把原本只在 VPC 内可用的 .2 解析服务扩展到混合网络：入站端点让本地网络解析 AWS 名称，出站端点让 AWS 资源解析本地域名；两者都通过多子网 ENI 和现有的 VPN/DX 连通路径工作。
English
Route 53 Resolver endpoints extend the VPC-local .2 resolver into hybrid networks. Inbound endpoints let on-premises systems resolve AWS names, while outbound endpoints let AWS resources resolve on-premises domains. Both use subnet ENIs and the existing VPN or Direct Connect path.