AWS has introduced Route 53 Resolved IP Validation for AWS Network Firewall.
Previously, for protocols like SSH and SFTP, domain names were not present in the traffic; clients used the name only for DNS lookup before connecting directly to an IP address. Consequently, Network Firewall rules for these protocols relied on IP addresses, which are subject to change. Furthermore, Network Firewall lacked visibility into the DNS resolver's responses for both web and non-web traffic due to a gap in shared visibility between DNS and the firewall.
On October 21, 2026, this feature was released at no additional cost. Amazon Route 53 Resolver now shares the IP addresses it returns for each domain name with Network Firewall. Network Firewall then verifies every new outbound connection against this shared cache. This capability allows for filtering non-web traffic by domain name and prevents Server Name Indication (SNI) manipulation on TLS traffic without requiring TLS inspection.
The mechanism involves Amazon Route 53 Resolver answering DNS queries from resources within a Virtual Private Cloud (VPC) configured for its use. Route 53 Resolver maintains a resolved IP cache containing the IP addresses returned for each domain name. When a new outbound connection initiates, Network Firewall compares the destination address against this cache.
The feature comprises three components. First, an Amazon Route 53 Resolver DNS Firewall rule group defines the scope, causing Route 53 Resolver to place returned answers into the resolved IP cache for associated VPCs. This rule group can also filter DNS queries, such as blocking lookups for known threat domains. Second, the Network Firewall policy setting mandates that, before stateful rules execute on a new connection's first packet, Network Firewall checks if Route 53 Resolver provided the destination address for a domain name. Third, resolved-domain rules within stateful rule groups enable matching a connection based on the domain name for which its destination address was resolved, making them applicable across all protocols.
The policy setting applies to all connections, not just web traffic. A connection destined for an IP address not resolved by Route 53 Resolver—such as a hardcoded address—will fail the check. Operators must add such IP addresses to Bypass destination validation IP ranges before enforcing the validation, as the policy check runs prior to stateful rules. The check is performed per address; when any client in an associated VPC queries a name, its addresses pass the check for every client in scope within the same Availability Zone.
To implement this, prerequisites include having DNS through Amazon Route 53 Resolver, associating a Route 53 Resolver DNS Firewall rule group with the relevant VPCs, and enabling the policy setting before adding resolved-domain rules. The feature supports both distributed deployments, where clients reach a firewall endpoint in their own Availability Zone, and centralized deployments attached natively to AWS Transit Gateway.
Deployment must begin in alert mode because clients may still utilize previously cached DNS answers. Alert mode allows observation without blocking traffic, giving approximately 24 hours for clients to refresh their caches. The process requires creating or utilizing a DNS Firewall rule group, enabling Route 53 Resolved IP validation in the firewall policy, and selecting Alert for the Action.
In alert mode, Network Firewall does not block a failing connection but records the result in flow logs in the route53_resolved_ip field. A value of true indicates Route 53 Resolver returned the address, while false indicates it did not. The DnsUnresolvedFlows metric in Amazon CloudWatch tracks connections that fail this check.
This capability aligns with the broader industry trend toward deeper visibility into application layer protocols, moving beyond simple IP address filtering to understand the intent of network traffic based on domain names. Market participants can now enforce domain-based controls across various protocols using the existing infrastructure of AWS Network Firewall.
