# What is Amazon Route 53 on Outposts? AWS Outposts is a fully managed service that extends AWS infrastructures, services, APIs, and tools to customer premises. This allows customers to run AWS services with on-premises workloads by using the same programming interfaces as in AWS Regions. For more information, see [What is AWS Outposts?](https://docs.aws.amazon.com/outposts/latest/userguide/what-is-outposts.html) in the *AWS Outposts User Guide*. Route 53 on Outposts offers two capabilities: + A VPC Resolver that caches all DNS queries that originate from the AWS Outposts. + Hybrid connectivity between an Outpost and an on-premises DNS resolver when you deploy inbound and outbound endpoints. For more information, see [What is Route 53 VPC Resolver?](resolver.md). Additionally, Route 53 on Outposts reduces network latency by allowing queries to be resolved within the Outpost instead of making the round-trip to the nearest AWS Region. + A VPC Resolver that caches all DNS queries that originate from the AWS Outposts. + Hybrid connectivity between an Outpost and an on-premises DNS resolver when you deploy inbound and outbound endpoints. For more information, see [What is Route 53 VPC Resolver?](resolver.md). Additionally, Route 53 on Outposts reduces network latency by allowing queries to be resolved within the Outpost instead of making the round-trip to the nearest AWS Region. **Note** If you have a version of AWS Outposts racks that aren't compatible with Route 53 on Outposts, an AWS account team is notified and will contact you to help you upgrade AWS Outposts. ## Architecture overview Route 53 on Outposts implements a distributed DNS architecture: + **DNS records and hosted zones** remain managed in Amazon Route 53 in the AWS Region + **Resolver functionality** extends to your AWS Outposts rack for local query processing This design optimizes query performance and availability while maintaining centralized DNS record management. DNS records continue to be stored in the AWS Region, not locally on the AWS Outposts rack. ## Amazon Route 53 on Outposts features The following table describes how Route 53 on Outposts features compare with Amazon Route 53 features. **Route 53 on Outposts compared to Route 53** | Feature | Availability in Route 53 on Outposts | | --- | --- | | VPC Resolver | Yes. VPC Resolver maintains a local cache of records for applications hosted on Outpost rack, the peered VPC in the AWS Region, and any publicly accessible host names. | | Health checks | No. Health checks are calculated and reported from the AWS Region. If an Outpost disconnects from the cloud, the endpoints fail open and can't fail over to a backup. | | Resolver endpoints | Yes. Resolver endpoints on Outpost rack allow DNS queries to be forwarded and received from DNS servers on-premises. Only the IPv4 endpoint type is available for endpoints. | | Resolver DNS Firewall | Not available. | | Traffic flow | Not available. | ## VPC Resolver behavior when AWS Outposts is disconnected from the VPC If the AWS Outposts is disconnected from the AWS Region, the Resolver on Outpost behaves as follows: + Control plane changes are not available. + Health checks and DNS failover capability are not available. + DNS queries for resources that are hosted locally on the Outposts are resolved but in some cases the response might be stale if the IP address for the resource was updated while the Outpost was in a disconnected state. + DNS queries for resources hosted on the in-Region VPC are resolvable. However, the resources will not be accessible until the Outpost connection to the AWS Region is restored. + DNS queries for public DNS resources can be resolved if they are available in the VPC Resolver cache on Outpost. # Getting started with VPC Resolver on AWS Outposts After you have ordered your AWS Outposts racks and they have been delivered, as described here: [Create an AWS Outposts](https://docs.aws.amazon.com/outposts/latest/userguide/order-outpost-capacity.html) in the *AWS Outposts guide*, you can set up Resolver on Outpost. **Important** Resolver on Outpost can only be created by the AWS account that owns the AWS Outposts rack. If the AWS Outposts rack is shared with other accounts, those accounts cannot create Resolver on Outpost on the shared rack. You can also use APIs to manage Route 53 on Outposts. For more information, see [Resolver on Outpost actions](https://docs.aws.amazon.com/Route53/latest/APIReference/API-actions-by-function.html#actions-by-function-outpost-resolver). **Important** It can take up to 30-150 minutes to create a VPC Resolver cache on an AWS Outposts. After you have your AWS Outposts racks delivered, you can opt in to Route 53 on Outposts. **To configure Resolver on Outpost** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. On the **Resolver on Outpost** page, choose **Create VPC Resolver**. 1. On the **Create VPC Resolver** page: + Under **AWS Outposts** select an AWS Outposts you want to create the VPC Resolver on. + Type in a name for the VPC Resolver in the **VPC Resolver name** text box. + After the **Recommended instance types for VPC Resolver** populates with Amazon EC2 instances, choose one. For more information about the instance types, see [Quotas on Resolver on Outpost](DNSLimitations.md#limits-api-entities-resolver-on-outposts). + For **Number of instances**, choose the number of elastic interface instances for the VPC VPC Resolver. The default value is 4. If your AWS Outposts doesn't have an instance type that supports VPC Resolver, you won't be able to create a VPC Resolver. 1. Choose **Create VPC Resolver**. You can monitor the VPC Resolver creation on the **Resolver on Outpost** page. # Creating inbound endpoints After you have created a Resolver on Outpost, you can add both inbound and outbound endpoints to resolve DNS queries to and from your on-premises network. **To configure inbound endpoints for Resolver on Outpost** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operational state and choose **View details**. 1. On the **Inbound endpoints** table, choose **Create inbound endpoint**. 1. On the **Create inbound endpoint** page, enter the applicable values. For more information, see [Values that you specify when you create or edit inbound endpoints on an Outpost](#resolver-forwarding-inbound-queries-values-outpost). 1. Choose **Create endpoint**. ## Values that you specify when you create or edit inbound endpoints on an Outpost When you create or edit an inbound endpoint, you specify the following values: **Outpost ID** If you are creating the endpoint for a VPC Resolver on an AWS Outposts VPC, this is the AWS Outposts ID. **Endpoint name** A friendly name that lets you easily find an inbound endpoint on the dashboard. **VPC in the *region-name* Region** All inbound DNS queries from your network pass through this VPC on the way to VPC Resolver. **Security group for this endpoint** The ID of one or more security groups that you want to use to control access to this inbound endpoint. The security group that you specify must include one or more inbound rules. Inbound rules must allow TCP and UDP access on port 53. You can't change this value after you create the endpoint. For more information, see [Security groups for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) in the *Amazon VPC User Guide*. **IP addresses** The IP addresses that you want to assign to the inbound endpoints. We require you to specify a minimum of two IP addresses for redundancy. Note the following: **IP addresses and Amazon VPC elastic network interfaces** For each combination of Availability Zone, Subnet, and IP address that you specify, VPC Resolver creates an Amazon VPC elastic network interface. For the current maximum number of DNS queries per second per IP address in an endpoint, see [Quotas on Route 53 VPC Resolver](DNSLimitations.md#limits-api-entities-resolver). For information about pricing for each elastic network interface, see Amazon Route 53 on the [Amazon Route 53 pricing page](https://aws.amazon.com/route53/pricing/). Resolver endpoint has a private IP address. These IP addresses will not change through the course of an endpoint's life. For each IP address, specify the following values. Each IP address must be in an Availability Zone in the VPC that you specified in **VPC in the *region-name* Region**. **Availability Zone** The Availability Zone that you want DNS queries to pass through on the way to your VPC. The Availability Zone that you specify must be configured with a subnet. **Subnet** The subnet that contains the IP address that you want to forward DNS queries to. The subnet must have an available IP address. Specify the subnet for an IPv4 address. IPv6 is not supported. **IP address** The IP address that you want to forward DNS queries to. Choose whether you want VPC Resolver to choose an IP address for you from among the available IP addresses in the specified subnet, or you want to specify the IP address yourself. If you choose to specify the IP address yourself, enter an IPv4 address. IPv6 is not supported. **Tags** Specify one or more keys and the corresponding values. For example, you might specify **Cost center** for **Key** and specify **456** for **Value**. These are the tags that AWS Billing and Cost Management provides for organizing your AWS bill; you can use tags for other purposes as well. For more information about using tags for cost allocation, see [Using cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the *AWS Billing User Guide*. # Creating outbound endpoints After you have opted in and configured a VPC Resolver, you can also add both inbound and outbound endpoints to resolve DNS queries to your on-premises network. **Note** When you configure outbound endpoints, VPC Resolver caches DNS responses so that queries can still be resolved if your Outpost becomes disconnected from the Region. Maintaining this cache might increase DNS requests to your on-premises resolvers. **To configure outbound endpoints for Resolver on Outpost** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the checkmark next to the VPC Resolver that is in operational state and choose **View details**. 1. On the **Outbound endpoints** table, choose **Create outbound endpoint**. 1. On the **Create outbound endpoint** page, enter the applicable values. For more information, see [Values that you specify when you create or edit outbound endpoints in an AWS Outposts](#resolver-forwarding-outbound-queries-endpoint-values-outpost). 1. Choose **Create endpoint**. ## Values that you specify when you create or edit outbound endpoints in an AWS Outposts When you create or edit an outbound endpoint, you specify the following values: **Outpost ID** If you are creating the endpoint for a VPC Resolver on an AWS Outposts VPC, this is the AWS Outposts ID. **Endpoint name** A friendly name that lets you easily find an outbound endpoint on the dashboard. **VPC in the *region-name* Region** All outbound DNS queries from your VPC pass through this VPC on the way to your network. **Security group for this endpoint** The ID of one or more security groups that you want to use to control access to this VPC. The security group that you specify must include one or more outbound rules. Outbound rules must allow TCP and UDP access on the port that you're using for DNS queries on your network. You can't change this value after you create the endpoint. For more information, see [Security groups for your VPC](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) in the *Amazon VPC User Guide*. **IP addresses** The IP addresses that you want to assign to the outbound endpoints. We require you to specify a minimum of two IP addresses for redundancy. Note the following: **IP addresses and Amazon VPC elastic network interfaces** For each combination of Availability Zone, Subnet, and IP address that you specify, VPC Resolver creates an Amazon VPC elastic network interface. For the current maximum number of DNS queries per second per IP address in an endpoint, see [Quotas on Route 53 VPC Resolver](DNSLimitations.md#limits-api-entities-resolver). For information about pricing for each elastic network interface, see "Amazon Route 53" on the [Amazon Route 53 pricing page](https://aws.amazon.com/route53/pricing/). Resolver endpoint has a private IP address. These IP addresses will not change through the course of an endpoint's life. For each IP address, specify the following values. Each IP address must be in an Availability Zone in the VPC that you specified in **VPC in the *region-name* Region**. **Availability Zone** The Availability Zone that you want DNS queries to pass through on the way from your VPC. The Availability Zone that you specify must be configured with a subnet. **Subnet** The subnet that contains the IP address that you want to forward DNS queries from. The subnet must have an available IP address. Specify the subnet for an IPv4 address. IPv6 is not supported. **IP address** The IP address that you want to assign to the outbound endpoints. Choose whether you want VPC Resolver to choose an IP address for you from among the available IP addresses in the specified subnet, or you want to specify the IP address yourself. If you choose to specify the IP address yourself, enter an IPv4 address. IPv6 is not supported. **Tags** Specify one or more keys and the corresponding values. For example, you might specify **Cost center** for **Key** and specify **456** for **Value**. These are the tags that AWS Billing and Cost Management provides for organizing your AWS bill; you can use also tags for other purposes. For more information about using tags for cost allocation, see [Using cost allocation tags](https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/cost-alloc-tags.html) in the *AWS Billing User Guide*. ## Creating forwarding rules for outbound endpoints You can also create forwarding rules for outbound endpoints. For more information, see [To create forwarding rules and associate the rules with one or more VPCs](resolver-forwarding-outbound-queries-configuring.md#resolver-forwarding-outbound-queries-configuring-create-rule-procedure) # Managing Resolver on Outpost To manage Resolver on Outpost, perform the applicable procedure. **Topics** + [ ## Editing Resolver on Outpost ](#outpost-edit-resolver) + [ ## Viewing Resolver on Outpost status ](#outpost-view-resolver-status) + [ ## Deleting Resolver on Outpost ](#outpost-delete-resolver) ## Editing Resolver on Outpost To edit a Resolver on Outpost, perform the following procedure. **To edit a Resolver on Outpost** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the checkmark next to the VPC Resolver that is in operational state and choose **Edit**. 1. You can edit the following information: + The VPC Resolver name + The instance type + The number of instances 1. After you are done editing, choose **Save changes**. ## Viewing Resolver on Outpost status To view the status for Resolver on Outpost, perform the following procedure. **To view the status for an inbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the checkmark next to the VPC Resolver that is in operational state and choose **View details**. 1. The **Status** column in the **Resolver on Outpost** page, contains one of the following values: **Creating** The Resolver on Outpost is in the process of being created. **Operational** The Resolver on Outpost is correctly configured. **Updating** The Resolver on Outpost is updating instance types. **Action needed** This VPC Resolver is unhealthy and can't be automatically recovered. To resolve the problem, we recommend that you make sure the instance AWS Outposts can support Resolver on Outpost. **Deleting** The Resolver on Outpost is in the process of being deleted. **Failed creation** The creation of Resolver on Outpost failed. **Failed deletion** The deletion of Resolver on Outpost failed. To fix this issue, try again in a few minutes. ## Deleting Resolver on Outpost **Note** Before you can delete a Resolver on Outpost, you must first delete any endpoints associated with it. To delete a Resolver on Outpost, perform the following procedure. **To delete a Resolver on Outpost** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operational state and choose **Delete**. 1. In the **Delete VPC Resolver** dialog box, enter **delete** in the text box, and choose **Delete**. # Managing inbound endpoints on Resolver on Outpost To manage inbound endpoints on Resolver on Outpost, perform the applicable procedure. **Topics** + [ ## Viewing and editing inbound endpoints ](#resolver-forwarding-inbound-queries-managing-viewing-outpost) + [ ## Viewing the status for inbound endpoints ](#resolver-forwarding-inbound-queries-managing-viewing-status-outpost) + [ ## Deleting inbound endpoints ](#resolver-forwarding-inbound-queries-managing-deleting-outpost) ## Viewing and editing inbound endpoints To view and edit settings for an inbound endpoint, perform the following procedure. **To view and edit settings for an inbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operational state and choose **View details**. 1. In the **Inbound endpoints** list, choose the option for the endpoint that you want to view settings for or want to edit. 1. Choose **View details** or **Edit**. For information about the values for inbound endpoints, see [Values that you specify when you create or edit outbound endpoints in an AWS Outposts](outpost-resolver-add-outbound-endpoints.md#resolver-forwarding-outbound-queries-endpoint-values-outpost). 1. If you chose **Edit**, enter the applicable values, and choose **Save**. ## Viewing the status for inbound endpoints To view the status for an inbound endpoint, perform the following procedure. **To view the status for an inbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operation state and choose **View details**. 1. The **Status** column of the **inbound endpoints** list contains one of the following values: **Creating** VPC Resolver is creating and configuring one or more Amazon VPC network interfaces for this endpoint. **Operational** The Amazon VPC network interfaces for this endpoint are correctly configured and able to pass inbound or outbound DNS queries between your network and VPC Resolver. **Updating** Resolver is associating or disassociating one or more network interfaces with this endpoint. **Auto recovering** VPC Resolver is trying to recover one or more of the network interfaces that are associated with this endpoint. During the recovery process, the endpoint functions with limited capacity because of the limit on the number of DNS queries per IP address (per network interface). For the current limit, see [Quotas on Route 53 VPC Resolver](DNSLimitations.md#limits-api-entities-resolver). **Action needed** This endpoint is unhealthy, and VPC Resolver can't automatically recover it. To resolve the problem, we recommend that you check each IP address that you associated with the endpoint. For each IP address that isn't available, add another IP address and then delete the IP address that isn't available. An endpoint must always include at least two IP addresses. A status of **Action needed** can have a variety of causes. Here are two common causes: + One or more of the network interfaces that are associated with the endpoint were deleted using Amazon VPC. + The network interface couldn't be created for some reason that's outside the control of VPC Resolver. **Deleting** Resolver is deleting this endpoint and the associated network interfaces. ## Deleting inbound endpoints To delete an inbound endpoint, perform the following procedure. **Important** If you delete an inbound endpoint, DNS queries from your network are no longer forwarded to VPC Resolver in the VPC that you specified in the endpoint. **To delete an inbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operation state and choose **View details**. 1. Choose the check box next to the endpoint that you want to delete. 1. Choose **Delete**. 1. To confirm that you want to delete the endpoint, enter the name of the endpoint and choose **Submit**. # Managing outbound endpoints on Resolver on Outpost To manage outbound endpoints on Resolver on Outpost, perform the applicable procedure. **Topics** + [ ## Viewing and editing outbound endpoints ](#resolver-forwarding-outbound-queries-managing-viewing-outpost) + [ ## Viewing the status for outbound endpoints ](#resolver-forwarding-outbound-queries-managing-viewing-status-outpost) + [ ## Deleting outbound endpoints ](#resolver-forwarding-outbound-queries-managing-deleting-outpost) ## Viewing and editing outbound endpoints To view and edit settings for an outbound endpoint, perform the following procedure. **To view and edit settings for an outbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operation state and choose **View details**. 1. In the **Outbound endpoints** list, choose the check box next to the endpoint that you want to view settings for or want to edit. 1. Choose **View details** or **Edit**. For information about the values for outbound endpoints, see [Values that you specify when you create or edit outbound endpoints in an AWS Outposts](outpost-resolver-add-outbound-endpoints.md#resolver-forwarding-outbound-queries-endpoint-values-outpost). 1. If you chose **Edit**, enter the applicable values, and then choose **Save**. ## Viewing the status for outbound endpoints To view the status for an outbound endpoint, perform the following procedure. **To view the status for an outbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. On the navigation bar, choose the Region where your AWS Outposts is located. 1. Select the check box next to the VPC Resolver that is in operation state and choose **View details**. 1. In the **Outbound endpoints** list, the **Status** column contains one of the following values: **Creating** VPC Resolver is creating and configuring one or more Amazon VPC network interfaces for this endpoint. **Operational** The Amazon VPC network interfaces for this endpoint are correctly configured and able to pass inbound or outbound DNS queries between your network and VPC Resolver. **Updating** Resolver is associating or disassociating one or more network interfaces with this endpoint. **Auto recovering** VPC Resolver is trying to recover one or more of the network interfaces that are associated with this endpoint. During the recovery process, the endpoint functions with limited capacity because of the limit on the number of DNS queries per IP address (per network interface). For the current limit, see [Quotas on Route 53 VPC Resolver](DNSLimitations.md#limits-api-entities-resolver). **Action needed** This endpoint is unhealthy, and VPC Resolver can't automatically recover it. To resolve the problem, we recommend that you check each IP address that you associated with the endpoint. For each IP address that isn't available, add another IP address and then delete the IP address that isn't available. (An endpoint must always include at least two IP addresses.) A status of **Action needed** can have a variety of causes. Here are two common causes: + One or more of the network interfaces that are associated with the endpoint were deleted using Amazon VPC. + The network interface couldn't be created for some reason that's outside the control of VPC Resolver. **Deleting** Resolver is deleting this endpoint and the associated network interfaces. ## Deleting outbound endpoints Before you can delete an endpoint, you must first delete any rules that are associated to a VPC. To delete an outbound endpoint, perform the following procedure. **Important** If you delete an outbound endpoint, VPC Resolver stops forwarding DNS queries from your VPC to your network for rules that specify the deleted outbound endpoint. **To delete an outbound endpoint** 1. Sign in to the AWS Management Console and open the Route 53 console at [https://console.aws.amazon.com/route53/](https://console.aws.amazon.com/route53/). 1. In the left navigation pane, expand **Resolver**, and then navigate to **Outposts**. 1. Select the check box next to the VPC Resolver that is in operation state and choose **View details**. 1. In the **Outbound endpoints** list choose the option for the endpoint that you want to delete. 1. Choose **Delete**. 1. To confirm that you want to delete the endpoint, enter the name of the endpoint, and then choose **Submit**.