Resolver Endpoints

Learn how to use resolver endpoints to listen for, or forward, queries.

Resolver endpoints are attached to a subnet within a VCN. The following types of endpoint are available:

• Listening: A listening resolver endpoint receives queries from these sources: within the VCN, other VCN resolvers, or an on-premises network's DNS. After it's created, no further configuration is needed for a listening endpoint. No listening endpoint is required for Compute instances sending queries to 169.254.169.254.
• Forwarding: A forwarding resolver endpoint forwards DNS queries to a listening resolver endpoint in other peered VCNs or an on-premises network's DNS. Decisions about where to forward queries are based on resolver rules that you define. A DNS forwarding resolver endpoint is required before you can create a corresponding resolver rule.

Resolver endpoints are highly available and backed by availability domains and fault domains of virtual networking. Resolver endpoints are also backed by private endpoints which have a VNIC. Creating a resolver endpoint in your subnet results in a VNIC being created which consumes an IP address. The corresponding private endpoint and VNIC OCIDs are included on the resolver endpoint object so that you can track what resources in your subnet are related to another. The private endpoints with VNICs enable the ingress and egress between your VCN and other networks.

Network security groups (NSGs) act as a virtual firewall for the DNS resolver endpoints. An NSG consists of a set of ingress and egress security rules that apply only to the associated DNS resolver endpoints. Ultimately these are applied to the VNIC related to the resolver endpoint.

We recommend that you change the security list or NSG security rules to allow traffic bound for UDP Port 53 (and optionally TCP Port 53) on the DNS listener resolver endpoints.

You can perform the following resolver endpoint tasks:

• Create a resolver endpoint.
• List the resolver endpoints in a compartment.
• View the details of a resolver endpoint.
• Add and remove Network Security Groups associated with a resolver endpoint.
• Delete a resolver endpoint from a compartment.