Palo Alto Networks® Advanced DNS Security on Amazon Route 53 Resolver DNS Firewall delivers cloud-native DNS threat protection for your Amazon VPCs without requiring you to deploy separate firewalls or reconfigure VPC settings to redirect DNS query traffic. The integration provides 30+ DNS threat detections—including command-and-control (C2), domain generation algorithms (DGA), DNS tunneling, fast flux, and newly registered domains—through the high-availability infrastructure of Route 53 DNS Firewall. See Supported AWS Regions for availability.

Advanced DNS Security on Route 53 DNS Firewall uses three types of threat detection models that work together to identify malicious domains. Inline detectors evaluate DNS queries in the path of resolution and provide instant verdicts for known threats and DGA patterns. Real-time detectors monitor queries off-path and generate signals within seconds for threats such as tunneling and rebinding. Offline detectors passively analyze domain patterns to identify domain squatting, strategically-aged domains, phishing, and ransomware domains. When any model identifies a malicious domain, the finding is applied to one or more DNS security categories that you select when creating DNS Firewall rules.

The integration uses a fail-open architecture for DGA detection—if a threat verdict is delayed beyond a 4-millisecond timeout, DNS queries continue without disruption. Other detection categories have no timeout. You can combine Palo Alto Networks DNS security rules with AWS Managed Domain Lists in the same rule group for layered protection that covers both Palo Alto Networks threat intelligence and AWS-native DNS protections.

Configuring Advanced DNS Security on Route 53 DNS Firewall involves four steps:

Before deploying to production, review the best practices.