Introducing Route 53 Resolved IP Validation for AWS Network Firewall

This article introduces Route 53 Resolved IP Validation for AWS Network Firewall, a feature that validates outbound connections against DNS answers from Route 53 Resolver at no additional charge.

• Route 53 Resolver shares resolved IP addresses with Network Firewall to validate connection destinations against cached DNS answers
• Enables filtering of non-web protocols like SFTP and SSH by domain name instead of IP addresses
• Prevents SNI spoofing on TLS traffic without requiring TLS inspection
• Feature includes DNS Firewall rule groups, policy settings, and resolved-domain rules for stateful filtering
• Start in alert mode to allow DNS caches to refresh before enforcing the validation
• Available in all commercial AWS Regions at no additional charge

Route 53 Resolved IP Validation simplifies network security by allowing domain-based firewall rules for all protocols and preventing DNS-based attacks without decryption overhead.