>
    Strata Copilot
    Subscribe to Advanced DNS Security
    Focus
    Download PDF
    Focus
    1. Home
    2. Advanced DNS Security Powered by Precision AI®
    3. Advanced DNS Security Integrations
    4. Advanced DNS Security for Route 53
    5. Get Started with Advanced DNS Security
    6. Subscribe to Advanced DNS Security
    Download PDF
    Advanced DNS Security Powered by Precision AI®

    Subscribe to Advanced DNS Security

    Table of Contents

    Subscribe to Advanced DNS Security

    Subscribe to Advanced DNS Security through the DNS Firewall console or AWS Marketplace to enable DNS threat protections for your VPCs.
    Where Can I Use This?What Do I Need?
    • Amazon Route 53 Resolver DNS Firewall
    • AWS account with DNS Firewall access
    • AWS Marketplace purchasing permissions
    You subscribe to Advanced DNS Security directly from the DNS Firewall console (within the Amazon VPC console) through a subscription dialog that displays available offers, pricing, and legal terms. The subscription establishes agreement on pricing and terms between you and Palo Alto Networks, and licenses your account to use Palo Alto Networks-provided DNS threat protections on DNS Firewall rules. You can also subscribe through the AWS Marketplace console or website.
    If you manage multiple AWS accounts, you can use AWS License Manager to distribute Advanced DNS Security subscriptions to your entire organization, specific organizational units (OUs), or individual accounts. AWS License Manager tracks license distribution automatically—activating licenses for new accounts added to the organization and disabling licenses when accounts are removed.
    1. Open the Amazon VPC console.
    2. Select DNS firewallRule groups and select or create a rule group that you want to apply Palo Alto Networks Advanced DNS Security protections.
      If you have not yet created a rule group, select Create rule group from the DNS Firewall landing page. For general configuration of R53 DNS Firewall rule groups, refer to the Amazon R53 documentation.
    3. Under the Rules tab, Add rule to configure a new rule details.
    4. Provide a Name and select Advanced plan to access the advanced filtering rules for DNS queries.
    5. In the Rule configurations window, select the rule type Partner Managed DNS Protection, and the vendor, Palo Alto Networks. After a brief wait, a Subscription required message displays with a prompt to View subscription options.
    6. Select View subscription options for product details.
      The subscription page displays various details about the subscription terms, including any offers, pricing, product details, and the legal agreement between you and Palo Alto Networks. Pricing is typically based on an hourly rate for each rule group (containing one or more Palo Alto Networks rules) associated to a VPC.
    7. Click Subscribe to complete the subscription.
      The subscription process may take several minutes to complete.
      Upon completion, you will see the message "Successfully subscribed to Palo Alto Networks.
    8. Upon enabling the Palo Alto Networks DNS Security protections on your R53 DNS firewall, you must additionally Create DNS Firewall Rules to enforce company policy directives.
    9. Associate the rule group with a VPC to activate DNS threat protections.
      Rules do not take effect until the rule group is associated with at least one VPC. Without this step, DNS queries from your VPCs are not evaluated against your Palo Alto Networks DNS security rules.
    10. (Optional) Distribute licenses to additional accounts.
      To enable other accounts in your organization to use Advanced DNS Security on DNS Firewall, open the AWS License Manager console and distribute the Palo Alto Networks license entitlement to specific accounts, OUs, or your entire organization. You can bulk activate and deactivate licenses across all accounts from License Manager.
    After successful subscription, the DNS security categories dropdown becomes available in the rule configuration form, allowing you to select Palo Alto Networks threat list feeds for rule creation.
    Alternative: Subscribe through AWS Marketplace
    You can also subscribe to Advanced DNS Security directly through the AWS Marketplace console instead of the DNS Firewall rule creation flow:
    1. Open the AWS Marketplace console.
    2. Search for Palo Alto Networks Advanced DNS Security for Amazon Route 53.
    3. Review the product listing, pricing, and terms.
    4. Choose Subscribe.
    5. After subscribing, return to the DNS Firewall console to create rules using the partner managed rule type.
    When subscribing through the Marketplace console, you are redirected to the seller's home page. Visit the Palo Alto Networks home page separately to complete any required registration details.

    © 2026 Palo Alto Networks, Inc. All rights reserved.