# Route 53 Resolver forwarding direction for Atlas private SRV chains > Source-anchored research for Route 53 Resolver forwarding direction for Atlas private SRV chains. Run status: COMPLETED. Parent: [DNS and SRV Records](https://llms-explorer.com/tree/dns-and-srv-records/) · 4 facets · 8 facts · page: https://llms-explorer.com/tree/route-53-resolver-forwarding-direction-for-atlas-private-srv-chains/ ## How it works - When on-premises DNS must obtain the VPC Resolver view for Atlas-related names, configure forwarding on the on-premises DNS server to a default Resolver inbound endpoint. AWS defines inbound as network-to-VPC; an outbound endpoint is not the receiver for this path. (high confidence) — [source](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-network-to-vpc.html) ## How-to and procedures - Avoid associating a forwarding rule with the same VPC as the inbound endpoint to which that rule sends queries, including paths through on-premises DNS. AWS warns that this can circulate a query between inbound and outbound endpoints. For an Atlas conditional-forwarding design, check the return path before adding an outbound rule for a namespace already forwarded into that VPC. (low confidence) — [source](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/best-practices-resolver-endpoints.html) ## Problems, failure modes and limitations - A community report of cross-account Route 53 resolution says adding forwarding for the returned CNAME fixed a failure that had not appeared with A records. This is corroborating evidence to inspect target-name forwarding, not evidence of an Atlas incident or a universal requirement to forward every CNAME suffix. (low confidence) — [source](https://www.reddit.com/r/aws/comments/1d48qfv) ## Facts and statements - An outbound endpoint serves the converse path: VPC Resolver forwards selected queries to DNS servers on the external network. AWS-side forwarding rules specify destination resolver IP addresses and must be associated with the VPCs that need this forwarding; they do not replace the on-premises forwarding configuration for inbound queries. (high confidence) — [source](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-network-to-vpc.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-vpc-to-network-using-rules.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-forwarding-outbound-queries.html) - For AWS-side rule selection, VPC Resolver chooses the most specific matching domain. Forwarding rules cover the named domain and its subdomains; a more specific system rule lets VPC Resolver resolve a subdomain that a broader forwarding rule would otherwise send to external DNS. (high confidence) — [source](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-vpc-to-network-using-rules.html) - Atlas-specific design inference: retain the supplied private-endpoint connection hostname and arrange resolution for both the SRV lookup and its returned target hostname. A default inbound endpoint can supply the VPC's internal or recursive public answers; the documented Atlas AWS target then follows a CNAME to an endpoint-specific AWS name. A forwarder matching only the SRV owner is insufficient if later target queries otherwise take an unusable DNS path. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md?allTabs=true) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-network-to-vpc.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-vpc-to-network-using-rules.html) - An Atlas private endpoint-aware SRV chain does not by itself prove that an inbound Resolver endpoint is required. MongoDB documents an endpoint-specific regional AWS CNAME destination, and AWS documents that interface-endpoint DNS records are public and return private endpoint IP addresses even to queries from outside the VPC. Inference: first determine whether the actual names need a VPC-only DNS view or whether the existing recursive resolver can resolve the chain. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/troubleshoot-private-endpoints.md?allTabs=true) · [also](https://docs.aws.amazon.com/vpc/latest/privatelink/privatelink-access-aws-services.html) - Do not configure an on-premises conditional forwarder to a VPC CIDR-plus-two resolver address. AWS explicitly says forwarding private DNS queries to that address from on-premises or other VPC DNS servers is unsupported and can be unstable; use an inbound endpoint as the supported ingress path instead. (high confidence) — [source](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-DSN-queries-to-vpc.html) · [also](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-overview-forward-network-to-vpc.html)