In cloud computing, every connection between workloads happens in two distinct stages: Domain Name System (DNS) resolution translates a hostname into an IP address, and network layer routing directs packets to that IP address across virtual networks. Cloud providers handle the first stage through a built-in recursive resolver at a reserved internal IP address inside your virtual network, checking private DNS zones before querying the public internet. Once your workload receives the destination IP address, the virtual network evaluates its subnet route table using the longest prefix match algorithm to send each packet to the right next hop.
How do built-in cloud DNS resolvers translate domain names?
When a virtual machine (VM) in a cloud network looks up a domain name, it does not send the query straight to the public internet. Major cloud providers build a local recursive DNS resolver directly into each virtual network at a fixed internal or link-local IP address. Your VM’s operating system queries that local address first whenever an application tries to connect to a hostname.
Each cloud platform reserves specific internal addresses for its built-in resolver:
- In Amazon Web Services (AWS), the Route 53 Resolver (also called AmazonProvidedDNS) listens at the IPv4 link-local address 169.254.169.253, the IPv6 address fd00:ec2::253, and the primary IPv4 CIDR base address of the Virtual Private Cloud (VPC) plus two, such as 10.0.0.2 in a 10.0.0.0/16 network, according to Amazon VPC DNS documentation updated in 2026.
- In Google Cloud, every VM must use its local metadata server at 169.254.169.254 as its name server to resolve internal records, according to Google Cloud DNS documentation from November 2026.
- In Microsoft Azure, virtual networks provide internal name resolution through the reserved virtual IP address 168.63.129.16/32 by default, according to Microsoft Learn’s 2026 Azure Virtual Network FAQ.
When a query reaches the cloud resolver, it evaluates private DNS zones and internal cloud hostnames attached to that virtual network before going out to public root and authoritative DNS servers, as explained in AWS’s 2021 networking engineering notes and Google Cloud’s 2026 DNS documentation. This setup lets you run split-horizon DNS, where a single domain name resolves to a private IP address for workloads inside authorized virtual networks while resolving to a public IP address—or returning no record at all—for users on the public internet, according to Microsoft Azure’s 2026 DNS specifications.
How does DNS and network layer routing work across subnets?
Once the recursive resolver returns an IP address to your VM, DNS has finished its job and Layer 3 network routing takes over. Cloud networks, called VPCs in AWS and Google Cloud, and Virtual Networks (VNets) in Azure, carve up private IP address space using Classless Inter-Domain Routing (CIDR) blocks, typically drawn from the RFC 1918 private ranges (10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) or the RFC 6598 shared address space (100.64.0.0/10), according to Azure virtual network routing documentation updated in March 2026.
The number after the slash in a CIDR block tells the router how many leading bits of the 32-bit IPv4 address identify the network prefix. A /24 subnet uses 24 network bits and leaves 8 host bits for 256 total IP addresses, while a /20 block leaves 12 host bits for 4,096 addresses, according to AlgoMaster’s 2026 system design reference.
Every subnet in a cloud network is associated with a route table. Each rule in that table pairs a destination CIDR prefix with a next hop (called a target in AWS), such as local intra-VPC routing, an internet gateway, a Network Address Translation (NAT) gateway, a VPC peering connection, a VPN gateway, or a virtual firewall appliance, according to 2026 AWS VPC route table documentation. When an outbound packet leaves a VM, the virtual router compares the packet’s destination IP address against every row in the subnet’s route table.
If more than one route matches the destination IP address, the cloud router picks the winner using the longest prefix match algorithm. A route with a longer prefix mask is more specific and always takes priority over a shorter prefix mask. If a packet is headed to 10.0.1.25 and the route table contains a 0.0.0.0/0 default route, a 10.0.0.0/16 VPC route, and a 10.0.1.0/24 subnet route, the router selects the /24 route because 24 matching bits beat 16 bits and 0 bits, according to Microsoft Learn (2026) and AlgoMaster (2026).
Platform routing engines differ in how they display and override these defaults. AWS places an explicit local route for your VPC CIDR block at the top of every route table. Azure automatically creates system routes for intra-VNet traffic and RFC 1918 private blocks, and lets you override them by attaching user-defined static routes to a subnet, according to Microsoft Learn (2026). Google Cloud also offers policy-based routes that match packets by source IP address and protocol as well as destination IP; these rules evaluate by explicit priority numbers before standard subnet, static, and dynamic routes ever run longest-prefix matching, according to Google Cloud’s 2026 VPC documentation.
What happens during a real cloud request from browser to database?
Tracing a single web request through an AWS VPC with a 10.0.0.0/16 address block shows how DNS resolution and route tables cooperate at each hop, based on an October 2026 architectural walkthrough from the AWS Builder Center and 2026 AWS VPC documentation:
- A user’s browser queries public DNS for your web application’s domain and receives the public IPv4 address of an Application Load Balancer sitting in a public subnet (10.0.1.0/24).
- The packet enters the VPC through an attached internet gateway, and the load balancer forwards the HTTP request to an EC2 application server at 10.0.2.15 in a private subnet (10.0.2.0/24). That hop succeeds because the public subnet’s route table has a 10.0.0.0/16 local route covering all subnets in the VPC.
- The application server needs customer records from an Amazon RDS database and queries the VPC’s built-in Route 53 Resolver at 10.0.0.2 (or 169.254.169.253). Because the RDS hostname belongs to an internal AWS zone, the resolver returns a private IP address in the database subnet, such as 10.0.3.40.
- When the application server sends the SQL packet to 10.0.3.40, the private subnet’s route table evaluates two matching entries: 10.0.0.0/16 (target: local) and 0.0.0.0/0 (target: NAT gateway). Longest prefix match picks 10.0.0.0/16 over 0.0.0.0/0, keeping the database traffic entirely inside the private network.
- Next, the application server calls an external payment API. The local resolver at 10.0.0.2 resolves the payment provider’s domain to a public IPv4 address outside 10.0.0.0/16. Because the 10.0.0.0/16 local route no longer matches, the route table falls back to the 0.0.0.0/0 route, sending the packet to a NAT gateway in the public subnet, which translates the source IP and sends the traffic out through the internet gateway.
What mistakes break cloud DNS and route table configurations?
Even experienced cloud engineers run into outages when they treat cloud virtual networks like physical data center switches. Watch out for four common configuration traps verified in provider documentation.
First, do not try to filter or block built-in cloud DNS queries using network access control lists (NACLs) or security groups. In AWS, queries sent to 169.254.169.253 or the VPC CIDR plus two address travel over a private link-local path that is invisible on the network and exempt from security group and NACL rules, according to AWS VPC documentation (2026). To block malicious domain lookups on AWS, enable Route 53 Resolver DNS Firewall and configure rule actions such as NXDOMAIN, NODATA, or OVERRIDE, as detailed in the 2026 AWS multi-VPC DNS whitepaper.
Second, never point VMs in a spoke VPC directly to an outbound DNS resolver endpoint IP address in their operating system network settings. In both AWS and Google Cloud, VMs must keep their local VPC resolver (169.254.169.253 or CIDR plus two on AWS, and 169.254.169.254 on Google Cloud) as their primary name server in /etc/resolv.conf so private zones and forwarding rules evaluate in the proper order, according to the AWS multi-VPC whitepaper (2026) and Google Cloud DNS troubleshooting documentation (2026). Google Cloud also prohibits using 169.254.0.0/16 or 192.0.0.0/24 addresses as custom DNS forwarding targets and does not allow transitive DNS forwarding across peered VPCs.
Third, be careful when replacing default DNS servers in custom DHCP option sets. On AWS, distributed computing services built on Apache Hadoop, such as Amazon EMR, require every cluster node to resolve its own internal AWS hostname ending in region-name.compute.internal. If you point DHCP options to a custom DNS server without setting up a conditional forwarder back to the Amazon DNS server for internal domains, cluster nodes will fail to communicate, according to AWS VPC DNS documentation (2026).
Fourth, assigning a public IPv4 address to a cloud VM does not automatically make it reachable from the internet. According to the AWS Builder Center (2026), direct inbound IPv4 internet connectivity requires four separate components working together: an internet gateway attached to the VPC, a subnet route table entry directing 0.0.0.0/0 to that internet gateway, a public IPv4 address assigned to the VM, and security group and NACL rules that permit the inbound port.
Frequently asked questions
Why is the default AWS DNS server located at the .2 address of a VPC?
AWS reserves the base IPv4 address of your VPC’s primary CIDR block plus two (such as 10.0.0.2 in a 10.0.0.0/16 VPC) as a local gateway endpoint that routes queries to zonal fleets of Route 53 Resolver instances, alongside the fixed link-local address 169.254.169.253, according to AWS networking documentation (2021, 2026).
Can a single private DNS zone resolve names across multiple virtual networks?
Yes. AWS Route 53 private hosted zones, Azure DNS Private Zones, and Google Cloud DNS private zones can all be associated with multiple VPCs or virtual networks at the same time, allowing workloads in separate networks to resolve shared internal domain names without exposing those records to public DNS servers, according to 2026 documentation from all three providers.
How do I verify if a Google Cloud VM is using the built-in Cloud DNS resolver?
Check the guest operating system’s /etc/resolv.conf file or run a dig or nslookup test from the instance to confirm that queries are answered by the metadata server IP address 169.254.169.254, which Google Cloud requires for evaluating VPC private and forwarding zones, according to Google Cloud’s 2026 DNS troubleshooting guide.