I was trying to migrate an A record from a public DNS to an internal DNS in Route 53. I figured something like this would be fairly straightforward:

  1. Remove A record for server foo.bar.net (Public DNS).
  2. Add A record for server foo.internalbar.net (Internal DNS).
  3. Modify Bastion host's resolv.conf to search for internalbar.net (both Bastion host and foo are in the same VPC). Only difference is that foo is part of a private subnet attached to a NATd Gateway.

After this is done, I cannot resolve foo when running host in the bastion host. I was getting:

host foo
Host foo.internalbar.net not found: 3(NXDOMAIN)

According to documentation, Route 53 would work within 60 seconds. I waited for about 10 minutes until I decided to revert the change. For what it's worth, the bastion host was a part of the public DNS. I even went as far as adding the bastion host to the internal DNS (it's private IP). Can anyone tell me what may have been the issue with me adding foo to the internal DNS server?

  • Is nscd in play here, doing caching ? – steve Jul 7 '17 at 21:14
  • Im using Route53. I dont think R53 does caching, or atleast havent seen an option for it.. – ryekayo Jul 7 '17 at 21:16
  • What about your bastion host, where the resolution is presenting problems ? Do you have nscd running here ps -ef|grep nscd ? It does both positive and negative caching, if running.... – steve Jul 7 '17 at 21:28
  • 1
    Doesnt have nscd. But if your guessing that it has to do with DNS caching, it makes sense. I have a DNS entry for the bastion host on bind.. – ryekayo Jul 7 '17 at 21:29
  • Only thing is how would it be relevant to me trying to switch an R53 entry from a public DNS to an internal DNS? – ryekayo Jul 7 '17 at 21:34

I'm going to make a couple of assumptions about your current setup:

  • You are using a VPC that has DNS resolution enabled. If it's not, visit your VPC dashboard and enable it for the VPC in question.
  • The EC2 instance in question is in the VPC above. The subnet and routes in this case are irrelevant, as long as local routing is in tact.
  • The Route53 hosted zone for internalbar.net is a "private hosted zone" (based on your comment about "internally" hosted DNS).
  • A record foo exists in the above zone.

So, now for the answer! Your DNS sever in /etc/resolv.conf should be the 2nd usable address in your VPC's CIDR block. For example, if your VPC's CIDR is, then the resolver would be

Once you do that, it will resolve.

Reference for reserved VPC addresses: VPC Subnets

| improve this answer | |
  • As per your answer, /etc/resolve.conf has the same value but still the dns is not getting resolved and showing same error msg posted in the question. Any thoughts? – S.K. Venkat Jun 27 '18 at 10:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.