Introducing Route 53 Resolved IP Validation for AWS Network Firewall

What it is

Route 53 Resolved IP Validation is an AWS Network Firewall policy setting, launched 21 October 2026 at no extra charge. Route 53 Resolver records the IP addresses it returns per domain in a resolved IP cache. On the first packet of each new outbound connection, before stateful rules run, Network Firewall checks the destination against that cache. If the address is absent, it applies the action you chose: Alert, Drop or Reject.

How it works

Three parts are needed: a Route 53 Resolver DNS Firewall rule group (it can be empty) associated with the VPCs whose answers count, the policy setting, and resolved-domain rules in stateful rule groups (the aws_route_53_resolved_domain keyword). These rules match the name the destination address was resolved for, so they work for SFTP, SSH, MySQL and other protocols that carry no domain name.

The pass rule for TLS matches the destination address, not the SNI. A client that presents an allowed name but connects to another address is stopped. If the partner's addresses also serve other names (behind a CDN, for example), those names pass too. To require the name as well, add tls.sni; content:"api.partner.example.com"; startswith; endswith; nocase;. Without startswith and endswith, any SNI containing the name matches.

Preconditions / Affected

• DNS must go through Route 53 Resolver. Queries via Resolver endpoints or forwarding rules count.
• Supported deployments are distributed (clients reach a firewall endpoint in their own Availability Zone) and centralized with the firewall natively attached to Transit Gateway. Traffic routed to an endpoint in another AZ fails the check.
• The setting must be on in the same policy before you add resolved-domain rules.
• Validity is shared: an answer returned to any client in an associated VPC passes for every client in scope in the same AZ. Associate the rule group only with the VPCs you intend.

What to do

1. Associate the DNS Firewall rule group with the target VPCs.
2. In the firewall policy (Traffic inspection tab), enable Route 53 Resolved IP validation, set Action to Alert, and select the rule group.
3. Set the DNS expiry exception policy for connections open when their cache entry expires. The post recommends Continue so long sessions such as file transfers are not cut. Drop and Reject are the alternatives.
4. Set source IP ranges. If unset, only clients in the firewall's VPC and additional attached VPCs are checked. Spoke VPCs behind a transit gateway need their CIDRs listed.
5. Add hardcoded-IP destinations to Bypass destination validation IP ranges before enforcing. A stateful pass rule does not exempt them, because the policy check runs first.
6. Stay in alert mode about 24 hours so client DNS caches refresh, then switch to Drop or Reject. Reject sends a TCP reset so clients fail fast.

For the SNI case, use strict rule order, a TLS pass rule on port 443 with the domain, and default actions "Application drop established (server-directed only)" and "Application alert established (server-directed only)".

Monitoring:

• In alert mode the firewall writes no alert of its own. Read the route53_resolved_ip field in flow logs: true means Resolver returned the address, false means enforcement would block it.
• The same field appears in alert records written by rules or the default action.
• After enforcement, blocked connections show in flow logs with false, not in alert logs.
• CloudWatch DnsUnresolvedFlows counts failures. DnsAzUnavailableFlows counts connections from an AZ that lacks the feature.
• Pass rules write no alert log record unless they include alert;.

Caveats

• The check does not block alternate DNS. Block outbound port 53, DoH and DoT on Network Firewall yourself. If any client looks up a public resolver's name such as dns.google, that resolver's addresses pass.
• The cache keeps earlier answers longer than the DNS TTL, so an old address can still pass after a change.
• It validates connections after a lookup, not the queries. Keep DNS Firewall rules for threat domains and tunneling detection. A rule group with no rules incurs no DNS Firewall charge, and standard pricing applies once rules are added.
• Available in commercial Regions where both Network Firewall and DNS Firewall exist, not GovCloud (US) or China.