Best Practices for Advanced DNS Security
Follow these best practices when deploying Advanced DNS Security on Amazon Route 53 Resolver DNS Firewall to maximize threat coverage and minimize operational impact.
- Test with ALERT before blocking—Before deploying to production, use ALERT mode to perform a dry run. Review alert logs to validate that rules are matching expected traffic, then switch to BLOCK once validated.
- Assign different actions per category—Each security category creates a separate rule entry. You can assign BLOCK to high-confidence categories (such as Command and Control Domains and Malware Domains) while using ALERT for categories that may require investigation (such as Newly Registered Domains).
- Ensure VPC association—After adding rules, confirm the rule group is associated with a VPC. Rules do not take effect until the rule group is associated.
- Use AWS Firewall Manager for multi-account deployments—Use the "Associate with an AWS Firewall Manager policy" option to apply rule groups containing Palo Alto Networks rules across your entire organization.
- Combine with AWS Managed Domain Lists—You can include both Palo Alto Networks partner managed rules and AWS Managed Domain Lists in the same rule group for layered DNS protection.
