On October 21, 2026 AWS introduced Route 53 Resolved IP Validation for AWS Network Firewall, a zero‑cost capability that links DNS responses from the VPC‑local Route 53 Resolver to outbound firewall checks. By correlating the destination IP of a new connection with the cached DNS answer that produced it, the firewall can now enforce domain‑based rules for any protocol, including SSH, SFTP, and TLS, without needing TLS inspection.
How the Validation Works
The workflow consists of three tightly coupled components:
- A workload queries the VPC Resolver at
10.0.0.2for a name such asfiles.partner.example.com. - The Resolver’s DNS Firewall rule group evaluates the query; an empty group lets it pass.
- The Resolver returns an address (e.g.,
203.0.113.10) and stores the name‑to‑IP mapping in a resolved‑IP cache. - When the workload opens a connection to that IP, the first packet hits the Network Firewall endpoint.
- The firewall’s policy setting checks the cache. If the IP matches a cached entry, the connection proceeds to the normal stateful rule set; otherwise the configured action (Alert, Drop, or Reject) is applied.
- Stateful rules that include resolved‑domain criteria can match the original domain name, allowing consistent policy across all protocols.
All traffic that traverses the firewall generates flow‑log and alert‑log entries with the new fields, providing visibility into which domain resolved each IP.
Key Configuration Steps
- DNS Firewall rule group: Define the scope of domains whose answers should be cached. The group can be empty, or it can contain rules that block known‑bad lookups.
- Network Firewall policy setting: Enable the validation feature and choose an action for mismatched lookups. Starting in alert mode is recommended to verify behavior before enforcing drops.
- Resolved‑domain rules: Add these to stateful rule groups to match traffic by the originating domain name rather than by IP.
Operational and Security Implications
Practitioners gain a reliable way to enforce domain‑level controls for protocols that previously required static IP allowlists. This reduces operational churn caused by DNS‑driven IP changes. Because the firewall now validates the resolver’s answer, attempts to manipulate Server Name Indication (SNI) in TLS handshakes are blocked without enabling full TLS inspection, lowering processing overhead and simplifying compliance.
Enabling the feature also introduces new log fields that can be integrated into SIEM pipelines for alerting on unexpected outbound destinations. Running in alert mode first lets teams confirm that legitimate traffic is correctly cached before moving to a drop or reject stance.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Adopt the validation feature by attaching a DNS Firewall rule group to the VPC, turning on the policy setting in Network Firewall, and adding resolved‑domain criteria to existing stateful rules. Begin with alert mode to establish a baseline, then evaluate false‑positive rates before tightening to drop or reject. Monitor the enriched flow logs for any connections that fall outside the cache, as they indicate either misconfiguration or traffic that bypasses the resolver. This approach provides domain‑aware outbound protection across all protocols while avoiding the complexity of full TLS decryption.