Route 53 Resolver forwarding direction for Atlas private SRV chains
Parent: DNS and SRV Records · Published reference · snapshot 2026-11-02
↓ Facts as markdownall context files
Source-anchored research for Route 53 Resolver forwarding direction for Atlas private SRV chains. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- When on-premises DNS must obtain the VPC Resolver view for Atlas-related names, configure forwarding on the on-premises DNS server to a default Resolver inbound endpoint. AWS defines inbound as network-to-VPC; an outbound endpoint is not the receiver for this path. (high confidence) [source 1] [source 2]
How-to and procedures
- Avoid associating a forwarding rule with the same VPC as the inbound endpoint to which that rule sends queries, including paths through on-premises DNS. AWS warns that this can circulate a query between inbound and outbound endpoints. For an Atlas conditional-forwarding design, check the return path before adding an outbound rule for a namespace already forwarded into that VPC. (low confidence) [source]
Problems, failure modes and limitations
- A community report of cross-account Route 53 resolution says adding forwarding for the returned CNAME fixed a failure that had not appeared with A records. This is corroborating evidence to inspect target-name forwarding, not evidence of an Atlas incident or a universal requirement to forward every CNAME suffix. (low confidence) [source]
Facts and statements
- An outbound endpoint serves the converse path: VPC Resolver forwards selected queries to DNS servers on the external network. AWS-side forwarding rules specify destination resolver IP addresses and must be associated with the VPCs that need this forwarding; they do not replace the on-premises forwarding configuration for inbound queries. (high confidence) [source 1] [source 2] [source 3] [source 4]
- For AWS-side rule selection, VPC Resolver chooses the most specific matching domain. Forwarding rules cover the named domain and its subdomains; a more specific system rule lets VPC Resolver resolve a subdomain that a broader forwarding rule would otherwise send to external DNS. (high confidence) [source 1] [source 2]
- Atlas-specific design inference: retain the supplied private-endpoint connection hostname and arrange resolution for both the SRV lookup and its returned target hostname. A default inbound endpoint can supply the VPC's internal or recursive public answers; the documented Atlas AWS target then follows a CNAME to an endpoint-specific AWS name. A forwarder matching only the SRV owner is insufficient if later target queries otherwise take an unusable DNS path. (medium confidence) [source 1] [source 2] [source 3]
- An Atlas private endpoint-aware SRV chain does not by itself prove that an inbound Resolver endpoint is required. MongoDB documents an endpoint-specific regional AWS CNAME destination, and AWS documents that interface-endpoint DNS records are public and return private endpoint IP addresses even to queries from outside the VPC. Inference: first determine whether the actual names need a VPC-only DNS view or whether the existing recursive resolver can resolve the chain. (medium confidence) [source 1] [source 2]
- Do not configure an on-premises conditional forwarder to a VPC CIDR-plus-two resolver address. AWS explicitly says forwarding private DNS queries to that address from on-premises or other VPC DNS servers is unsupported and can be unstable; use an inbound endpoint as the supported ingress path instead. (high confidence) [source 1] [source 2]
Children
- No children recorded.