Amazon Route 53 Resolver DNS Firewall operates at the regional level—rules, rule groups, and VPC associations are configured independently in each AWS region. Palo Alto Networks partner managed DNS threat protection is available in the following regions:

You must create and configure Palo Alto Networks DNS Firewall rules in each region where you want to enforce DNS threat protections. VPCs in regions not listed above cannot use Palo Alto Networks partner managed DNS threat protection rules. If you operate VPCs across multiple supported regions, create rule groups and associate them with VPCs in each region independently.