> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tensor9.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Route 53 Resolver

> Route 53 Resolver APIs with Cloud Adapter.

This page describes how Route 53 Resolver maps to services in the environment where the application runs, including backend choices, supported operations and service-specific behavior.

## Supported environments

* Azure
* Google Cloud
* OCI

Check the operation and capability tables for the behavior your application depends on. A supported environment does not imply that every operation of the origin service is available.

## How the backends compare

Each row compares a capability of Route 53 Resolver with its adaptation on each backend.
A dash means this profile does not state the capability for that backend.

### Cloud Adapter

| Capability | Route 53 Resolver | Azure | Google Cloud | OCI |
| - | - | - | - | - |
| Inbound endpoint · on-premises → private names | Yes | Yes - inbound endpoint; Azure assigns the private IP dynamically | Partial - DNS policy enable\_inbound\_forwarding; Google-allocated IPs | Yes - listening resolver endpoint, a VNIC in a subnet |
| Outbound endpoint · private → on-premises names | Yes | Yes - outbound endpoint + DNS forwarding ruleset | Partial - forwarding managed zone; no addressable endpoint | Yes - forwarding resolver endpoint |
| Conditional forwarding · domain → target servers | Yes | Yes - forwarding rule: domain\_name + target\_dns\_servers | Partial - forwarding zone; IPv4 targets only | Yes - resolver rule: qname\_cover\_conditions + destination\_addresses |
| Per-target forwarding port · non-53 targets | Yes | Yes - target\_dns\_servers takes an ip and a port | No - Cloud DNS forwards on 53; a non-53 port is dropped with a build warning | No - OCI forwards on 53; a non-53 port is dropped without a warning |
| DNSSEC validation | Yes | No - zone signing is separate from recursive validation | No - zone signing is separate from recursive validation | No - zone signing is separate from recursive validation |
| DNS Firewall · domain block/allow | Yes | No - not created; set up an Azure DNS security policy yourself | No - not created; set up a Cloud DNS response policy yourself | No - not created; no OCI resolver DNS firewall |
| Query logging | Yes | No - not created; turn on Azure DNS query logs yourself | No - not created; turn on Cloud DNS logging yourself | No - not created; set up OCI Logging yourself |
| API coverage | full | partial | partial | partial |

## On Azure

### Azure DNS

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DNS Firewall (domain lists) | DNS controls | Out of scope | Most usage | DNS Firewall is not supported. Rule groups and their associations are removed at deployment, and no Azure DNS security policy is created. You must set up DNS filtering yourself. |
| DNSSEC validation | DNS controls | Out of scope | Most usage | Zone signing and recursive validation are different operations. This mapping does not translate the Route 53 Resolver validation setting. |
| Conditional forwarding rules | Forwarding | Supported | Common | A FORWARD rule becomes a forwarding rule with the same domain\_name and target servers, including each target's port. The ruleset is linked to the Cloud Adapter deployment's virtual network. A non-literal target\_ip becomes a placeholder address that you must replace, and DNS over HTTPS settings are dropped. |
| Inbound endpoint | Hybrid DNS | Supported | Common | The inbound Resolver endpoint becomes an Azure Private DNS Resolver inbound endpoint in the Cloud Adapter deployment's resolver subnet. Azure always assigns its private IP dynamically; a static ip\_address on the AWS endpoint is not kept. |
| Outbound endpoint | Hybrid DNS | Supported | Common | the outbound Resolver endpoint becomes an Azure outbound endpoint with a DNS forwarding ruleset attached |
| Query logging | Observability | Out of scope | Most usage | Query logging is not supported. The query-log configuration and its association are removed at deployment. You must turn on DNS query logs in Azure yourself, through a DNS resolver policy and its diagnostic settings. |

#### How it works

Tensor9 turns your Route 53 Resolver endpoints and forwarding rules into Azure Private DNS Resolver resources on the customer's virtual network. An inbound endpoint answers private-name queries from connected networks, such as your on-premises resolvers. An outbound endpoint and a forwarding ruleset send queries for chosen domains to the DNS servers you name. Azure operates the resolver, and Tensor9 is not in the DNS query path.

#### Endpoint placement

The endpoints are created in the Cloud Adapter deployment's own virtual network, not in your AWS VPC subnets. Azure requires each endpoint to have its own subnet delegated to `Microsoft.Network/dnsResolvers`. Azure assigns the inbound endpoint a private IP from its subnet. After deployment, point your on-premises conditional forwarders at that IP.

The outbound endpoint sits in a subnet but has no IP address for clients to call; the forwarding ruleset attaches to it. Azure handles the resolver's resilience, so the AWS per-zone network interfaces have no matching set of Azure interfaces. The AWS endpoint security group is not kept: review the target subnet's access controls yourself.

![An on-premises resolver queries the Azure inbound endpoint; the outbound endpoint is not a client-facing IP.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBvbi1wcmVtaXNlcyByZXNvbHZlciBxdWVyaWVzIHRoZSBBenVyZSBpbmJvdW5kIGVuZHBvaW50OyB0aGUgb3V0Ym91bmQgZW5kcG9pbnQgaXMgbm90IGEgY2xpZW50LWZhY2luZyBJUC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT48cmVjdCB4PSIyNCIgeT0iMzAiIHdpZHRoPSIyNDAiIGhlaWdodD0iOTAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjE0NCIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Pbi1wcmVtaXNlcyByZXNvbHZlcjwvdGV4dD48dGV4dCB4PSIxNDQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cHJpdmF0ZS1uYW1lIHF1ZXJ5PC90ZXh0PjxwYXRoIGQ9Ik0yNjcgNzUgaDIyIG0tNiAtNSA2IDUgLTYgNSIgZmlsbD0ibm9uZSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+PHJlY3QgeD0iMjk0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iNDE0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkluYm91bmQgZW5kcG9pbnQ8L3RleHQ+PHRleHQgeD0iNDE0IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM2NDc0OGIiPnByaXZhdGUgSVA7IGRlbGVnYXRlZCBzdWJuZXQ8L3RleHQ+PHBhdGggZD0iTTUzNyA3NSBoMjIgbS02IC01IDYgNSAtNiA1IiBmaWxsPSJub25lIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSI1NjQiIHk9IjMwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjkwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI2ODQiIHk9IjY1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+QXp1cmUgRE5TPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5WTmV0LWxpbmtlZCBwcml2YXRlIHpvbmVzPC90ZXh0Pjwvc3ZnPg==)

![An on-premises resolver queries the Azure inbound endpoint; the outbound endpoint is not a client-facing IP.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBvbi1wcmVtaXNlcyByZXNvbHZlciBxdWVyaWVzIHRoZSBBenVyZSBpbmJvdW5kIGVuZHBvaW50OyB0aGUgb3V0Ym91bmQgZW5kcG9pbnQgaXMgbm90IGEgY2xpZW50LWZhY2luZyBJUC4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT48cmVjdCB4PSIyNCIgeT0iMzAiIHdpZHRoPSIyNDAiIGhlaWdodD0iOTAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjE0NCIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Pbi1wcmVtaXNlcyByZXNvbHZlcjwvdGV4dD48dGV4dCB4PSIxNDQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cHJpdmF0ZS1uYW1lIHF1ZXJ5PC90ZXh0PjxwYXRoIGQ9Ik0yNjcgNzUgaDIyIG0tNiAtNSA2IDUgLTYgNSIgZmlsbD0ibm9uZSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+PHJlY3QgeD0iMjk0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iNDE0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkluYm91bmQgZW5kcG9pbnQ8L3RleHQ+PHRleHQgeD0iNDE0IiB5PSI5MiIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDExcHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICM5NGEzYjgiPnByaXZhdGUgSVA7IGRlbGVnYXRlZCBzdWJuZXQ8L3RleHQ+PHBhdGggZD0iTTUzNyA3NSBoMjIgbS02IC01IDYgNSAtNiA1IiBmaWxsPSJub25lIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSI1NjQiIHk9IjMwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjkwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI2ODQiIHk9IjY1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+QXp1cmUgRE5TPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5WTmV0LWxpbmtlZCBwcml2YXRlIHpvbmVzPC90ZXh0Pjwvc3ZnPg==)

The arrows show the direction of the DNS query.

#### Conditional forwarding

Each `FORWARD` rule becomes a rule in the forwarding ruleset, with the same `domain_name` and target DNS servers (`target_dns_servers`). Each target keeps its IP and port, including a port other than 53. The ruleset is linked to the virtual network, which turns forwarding on for that network.

Each domain can have its own rule. Disabling a rule stops it forwarding; removing the virtual-network link stops the whole ruleset applying to that network. Check that the network can reach every target DNS server.

#### DNS filtering

Tensor9 does not create DNS Firewall rules on Azure. The Azure counterpart is a DNS security policy: domain lists and traffic rules whose Allow, Block and Alert actions apply to queries from linked virtual networks. Your custom domain lists can be copied into it. AWS-managed lists have no copy, so choose a replacement explicitly. Microsoft's threat-intelligence list is a different list, even where it has the same purpose.

#### Limitations

Where Route 53 Resolver and this target differ

* **You must set up DNS filtering and query logging yourself.** The deployment creates the endpoints and forwarding rules only. Route 53 Resolver DNS Firewall, query logging and DNSSEC resources in your stack do not create anything on Azure.
* **DNSSEC validation is not supported.** Route 53 Resolver can check DNSSEC signatures on the answers it receives; this mapping does not keep that setting. Signing a hosted zone is a different feature: it signs that zone's records but does not validate answers for your network.
* **Static endpoint IPs are not kept.** Azure assigns the inbound endpoint's address from its subnet. IPs you pinned on the AWS endpoint, its subnets and its security group are not kept, and the deployment reports this.
* **You must give forwarding targets as literal IP addresses.** If a rule's `target_ip` is a variable or a reference, the deployment cannot read it. The rule gets a placeholder address and a warning, and you must replace it with the real DNS server before applying.
* **DNS over HTTPS is not supported.** Azure Private DNS Resolver answers and forwards over standard DNS only. A DoH protocol set on a Route 53 Resolver endpoint or forwarding target is dropped, and the deployment reports it.

#### Other considerations

**Query logging.** To record queries, enable logging on an Azure DNS resolver policy linked to each network you need, and send its diagnostic logs to an Azure Monitor destination. DNS query logs are separate from resource metrics. Update log queries and retention for the Azure format.

**Before switching clients.** Test private names, forwarded domains and policy actions before you change client DNS settings.

**Moving from AWS.** Resolver caches and query history are not transferred. Anything outside the stack that refers to AWS endpoint IDs or rule ARNs needs the target's identifiers instead.

Azure references: [endpoints and rulesets](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) and [DNS query logs](https://learn.microsoft.com/en-us/azure/azure-monitor/reference/tables/dnsquerylogs).

## On Google Cloud

### Cloud DNS

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DNS Firewall (domain lists) | DNS controls | Out of scope | Most usage | DNS Firewall is not supported. Rule groups and their associations are removed at deployment, and no Cloud DNS response policy is created. You must set up DNS filtering yourself. |
| DNSSEC validation | DNS controls | Out of scope | Most usage | Zone signing and recursive validation are different operations. This mapping does not translate the Route 53 Resolver validation setting. |
| Conditional forwarding rules | Forwarding | Partial | Common | A FORWARD rule becomes a private forwarding managed zone attached to the Cloud Adapter deployment's network: dns\_name holds the domain and forwarding\_config.target\_name\_servers holds the IPv4 target IPs. Forwarding uses port 53, and IPv6 targets are dropped, each with a build warning. A non-literal target\_ip becomes a placeholder address that you must replace, and DNS over HTTPS settings are dropped. |
| Inbound endpoint | Hybrid DNS | Partial | Common | the inbound endpoint becomes a google\_dns\_policy with enable\_inbound\_forwarding on the network; Google allocates the inbound forwarder IPs (no addressable endpoint to pin) |
| Outbound endpoint | Hybrid DNS | Partial | Common | the outbound endpoint has no addressable analog; Cloud DNS performs the forwarding egress itself from a forwarding managed zone |
| Query logging | Observability | Out of scope | Most usage | Query logging is not supported. The query-log configuration and its association are removed at deployment, and the DNS policy created for an inbound endpoint does not turn on logging. You must enable Cloud DNS logging yourself. |

#### How it works

Tensor9 turns your Route 53 Resolver configuration into Cloud DNS policies and forwarding zones on the customer's Google Cloud network. An inbound-forwarding policy lets on-premises resolvers query private names. A forwarding zone sends queries for a chosen domain to the on-premises DNS servers you name. Google answers these queries directly, and Tensor9 is not in the DNS query path.

#### Inbound access and network placement

The inbound endpoint becomes a `google_dns_policy` with `enable_inbound_forwarding` on the Cloud Adapter deployment's network. Google picks the forwarding addresses. After deployment, point your on-premises conditional forwarders at the addresses Google reports. The network and your hybrid connection must let DNS traffic through.

The AWS endpoint's chosen IPs, subnets, security group and per-zone network interfaces have no Cloud DNS counterpart. Set up access controls and redundancy on the target network for the path DNS traffic actually takes.

![An on-premises resolver queries a Google-allocated inbound address to resolve a private name.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBvbi1wcmVtaXNlcyByZXNvbHZlciBxdWVyaWVzIGEgR29vZ2xlLWFsbG9jYXRlZCBpbmJvdW5kIGFkZHJlc3MgdG8gcmVzb2x2ZSBhIHByaXZhdGUgbmFtZS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiMzMzQxNTV9PC9zdHlsZT48cmVjdCB4PSIyNCIgeT0iMzAiIHdpZHRoPSIyNDAiIGhlaWdodD0iOTAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjE0NCIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5Pbi1wcmVtaXNlcyByZXNvbHZlcjwvdGV4dD48dGV4dCB4PSIxNDQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+cHJpdmF0ZS1uYW1lIHF1ZXJ5PC90ZXh0PjxwYXRoIGQ9Ik0yNjcgNzUgaDIyIG0tNiAtNSA2IDUgLTYgNSIgZmlsbD0ibm9uZSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+PHJlY3QgeD0iMjk0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iNDE0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkluYm91bmQgRE5TIHBvbGljeTwvdGV4dD48dGV4dCB4PSI0MTQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+R29vZ2xlLWFsbG9jYXRlZCBhZGRyZXNzPC90ZXh0PjxwYXRoIGQ9Ik01MzcgNzUgaDIyIG0tNiAtNSA2IDUgLTYgNSIgZmlsbD0ibm9uZSIgc3R5bGU9InN0cm9rZTojNjQ3NDhiIi8+PHJlY3QgeD0iNTY0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iNjg0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPkNsb3VkIEROUzwvdGV4dD48dGV4dCB4PSI2ODQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzY0NzQ4YiI+bmV0d29yayBwcml2YXRlIHpvbmVzPC90ZXh0Pjwvc3ZnPg==)

![An on-premises resolver queries a Google-allocated inbound address to resolve a private name.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBvbi1wcmVtaXNlcyByZXNvbHZlciBxdWVyaWVzIGEgR29vZ2xlLWFsbG9jYXRlZCBpbmJvdW5kIGFkZHJlc3MgdG8gcmVzb2x2ZSBhIHByaXZhdGUgbmFtZS4iPjxzdHlsZT50ZXh0e2ZvbnQtZmFtaWx5OkludGVyLC1hcHBsZS1zeXN0ZW0sQmxpbmtNYWNTeXN0ZW1Gb250LCdTZWdvZSBVSScsUm9ib3RvLCdIZWx2ZXRpY2EgTmV1ZScsQXJpYWwsc2Fucy1zZXJpZjtmaWxsOiNjYmQ1ZTF9PC9zdHlsZT48cmVjdCB4PSIyNCIgeT0iMzAiIHdpZHRoPSIyNDAiIGhlaWdodD0iOTAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjE0NCIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5Pbi1wcmVtaXNlcyByZXNvbHZlcjwvdGV4dD48dGV4dCB4PSIxNDQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+cHJpdmF0ZS1uYW1lIHF1ZXJ5PC90ZXh0PjxwYXRoIGQ9Ik0yNjcgNzUgaDIyIG0tNiAtNSA2IDUgLTYgNSIgZmlsbD0ibm9uZSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+PHJlY3QgeD0iMjk0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iNDE0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkluYm91bmQgRE5TIHBvbGljeTwvdGV4dD48dGV4dCB4PSI0MTQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+R29vZ2xlLWFsbG9jYXRlZCBhZGRyZXNzPC90ZXh0PjxwYXRoIGQ9Ik01MzcgNzUgaDIyIG0tNiAtNSA2IDUgLTYgNSIgZmlsbD0ibm9uZSIgc3R5bGU9InN0cm9rZTojOTRhM2I4Ii8+PHJlY3QgeD0iNTY0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iNjg0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPkNsb3VkIEROUzwvdGV4dD48dGV4dCB4PSI2ODQiIHk9IjkyIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogMTFweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzk0YTNiOCI+bmV0d29yayBwcml2YXRlIHpvbmVzPC90ZXh0Pjwvc3ZnPg==)

The arrows show the direction of the DNS query.

#### Conditional forwarding

Each `FORWARD` rule becomes a private forwarding zone, together with the outbound endpoint it uses. The rule's domain becomes the zone's `dns_name`, its target IPs become `forwarding_config.target_name_servers`, and the rule association becomes the network the zone is attached to.

Cloud DNS forwards queries itself, with no outbound endpoint IP you can choose. It always forwards to port 53, so a target on another port cannot keep its port. The deployment reports such a rule for you to correct; changing only the target IP would not make it equivalent.

#### DNS filtering

Tensor9 does not create DNS Firewall rules on Google Cloud. The Cloud DNS counterpart for custom domain lists is response-policy rules on the network. An allow rule uses bypass. A block returns a local answer that you configure, which differs from AWS DNS Firewall's response options, so do not expect an identical NXDOMAIN. Response policies match DNS names and do not reproduce the ordered AWS rule groups.

For alert-only rules, use query logging and choose which queries raise alerts. AWS-managed domain lists need replacement lists; a Google list is not assumed to hold the same domains.

#### Limitations

Where Route 53 Resolver and this target differ

* **You must set up DNS filtering and query logging yourself.** The deployment creates the endpoints and forwarding rules only. Route 53 Resolver DNS Firewall, query logging and DNSSEC resources in your stack do not create anything on Google Cloud.
* **DNSSEC validation is not supported.** Route 53 Resolver can check DNSSEC signatures on the answers it receives; this mapping does not keep that setting. Signing a hosted zone is a different feature: it signs that zone's records but does not validate answers for your network.
* **Forwarding ports other than 53 are not supported.** Cloud DNS has no port setting for forwarding targets. A non-53 port is dropped and the deployment reports it.
* **IPv6 forwarding targets are not supported.** Cloud DNS forwarding targets are IPv4 only. IPv6 targets are dropped and reported; a rule whose targets are all IPv6 gets a placeholder address you must replace.
* **You must give forwarding targets as literal IP addresses.** If a rule's `target_ip` is a variable or a reference, the deployment cannot read it. The rule gets a placeholder address and a warning, and you must replace it with the real DNS server before applying.
* **DNS over HTTPS is not supported.** Cloud DNS answers and forwards over standard DNS only. A DoH protocol set on a Route 53 Resolver endpoint or forwarding target is dropped, and the deployment reports it.

#### Other considerations

**Query logging.** To record queries, enable logging on the network's DNS policy, which sends them to Cloud Logging. Update collection, retention and queries for the Google log format. Existing AWS query history stays where it is unless you export it.

**Before switching clients.** Test inbound private names and outbound forwarded names, including network failures and blocked domains.

**Moving from AWS.** Resolver caches and query history are not transferred. Anything outside the stack that refers to AWS endpoint IDs or rule ARNs needs the target's identifiers instead.

Google reference: [Cloud DNS response policies](https://docs.cloud.google.com/dns/docs/zones/manage-response-policies).

## On OCI

### OCI DNS

| Operation | Area | Support | Depth | Notes |
| - | - | - | - | - |
| DNS Firewall (domain lists) | DNS controls | Out of scope | Most usage | DNS Firewall is not supported. Rule groups and their associations are removed at deployment. Network Firewall URL inspection or a timed-out forwarded query is not equivalent to AWS DNS Firewall actions. |
| DNSSEC validation | DNS controls | Out of scope | Most usage | Zone signing and recursive validation are different operations. This mapping does not translate the Route 53 Resolver validation setting. |
| Conditional forwarding rules | Forwarding | Partial | Common | A FORWARD rule becomes a resolver rule on the Cloud Adapter deployment VCN's resolver, with the domain in qname\_cover\_conditions and the target IPs in destination\_addresses, sent through the forwarding endpoint. Forwarding uses port 53; a non-53 target port is dropped without a warning. A non-literal target\_ip becomes a placeholder address that you must replace, and DNS over HTTPS settings are dropped. |
| Inbound endpoint | Hybrid DNS | Supported | Common | the inbound endpoint becomes a listening resolver endpoint on the VCN's resolver, a VNIC in a subnet |
| Outbound endpoint | Hybrid DNS | Supported | Common | the outbound endpoint becomes a forwarding resolver endpoint the resolver rules egress through |
| Query logging | Observability | Out of scope | Most usage | Query logging is not supported. The query-log configuration and its association are removed at deployment. You must set up resolver logging in OCI Logging yourself. |

#### How it works

Tensor9 turns your Route 53 Resolver configuration into listening endpoints, forwarding endpoints and rules on the resolver of the customer's OCI VCN. A listening endpoint receives queries for private names, for example from your on-premises resolvers. A forwarding endpoint sends queries for chosen domains to the DNS servers you name. Oracle operates the resolver, and Tensor9 is not in the DNS query path.

#### Endpoints and private names

Each endpoint is a virtual network interface in a subnet of the Cloud Adapter deployment's network. Point your on-premises conditional forwarders at the listening endpoint's address. The private views attached to the VCN resolver decide which private zones it can answer.

OCI decides where endpoints run, so the AWS per-zone IP assignments do not produce a matching set of interfaces. The AWS endpoint security group is not kept: set up subnet access, and any OCI network security group, for listening and forwarding traffic yourself.

![An OCI listening endpoint receives private-name queries for the VCN resolver.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBPQ0kgbGlzdGVuaW5nIGVuZHBvaW50IHJlY2VpdmVzIHByaXZhdGUtbmFtZSBxdWVyaWVzIGZvciB0aGUgVkNOIHJlc29sdmVyLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6IzMzNDE1NX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojZjhmYWZjO3N0cm9rZTojNjQ3NDhiIi8+PHRleHQgeD0iMTQ0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICMwZjE3MmEiPk9uLXByZW1pc2VzIHJlc29sdmVyPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5wcml2YXRlLW5hbWUgcXVlcnk8L3RleHQ+PHBhdGggZD0iTTI2NyA3NSBoMjIgbS02IC01IDYgNSAtNiA1IiBmaWxsPSJub25lIiBzdHlsZT0ic3Ryb2tlOiM2NDc0OGIiLz48cmVjdCB4PSIyOTQiIHk9IjMwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjkwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiNmOGZhZmM7c3Ryb2tlOiM2NDc0OGIiLz48dGV4dCB4PSI0MTQiIHk9IjY1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogIzBmMTcyYSI+TGlzdGVuaW5nIGVuZHBvaW50PC90ZXh0Pjx0ZXh0IHg9IjQxNCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5WTklDIGluIGN1c3RvbWVyIHN1Ym5ldDwvdGV4dD48cGF0aCBkPSJNNTM3IDc1IGgyMiBtLTYgLTUgNiA1IC02IDUiIGZpbGw9Im5vbmUiIHN0eWxlPSJzdHJva2U6IzY0NzQ4YiIvPjxyZWN0IHg9IjU2NCIgeT0iMzAiIHdpZHRoPSIyNDAiIGhlaWdodD0iOTAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6I2Y4ZmFmYztzdHJva2U6IzY0NzQ4YiIvPjx0ZXh0IHg9IjY4NCIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjMGYxNzJhIj5WQ04gRE5TIHJlc29sdmVyPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjNjQ3NDhiIj5hdHRhY2hlZCBwcml2YXRlIHZpZXdzPC90ZXh0Pjwvc3ZnPg==)

![An OCI listening endpoint receives private-name queries for the VCN resolver.](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI4MzYiIGhlaWdodD0iMTUwIiB2aWV3Qm94PSIwIDAgODM2IDE1MCIgcm9sZT0iaW1nIiBhcmlhLWxhYmVsPSJBbiBPQ0kgbGlzdGVuaW5nIGVuZHBvaW50IHJlY2VpdmVzIHByaXZhdGUtbmFtZSBxdWVyaWVzIGZvciB0aGUgVkNOIHJlc29sdmVyLiI+PHN0eWxlPnRleHR7Zm9udC1mYW1pbHk6SW50ZXIsLWFwcGxlLXN5c3RlbSxCbGlua01hY1N5c3RlbUZvbnQsJ1NlZ29lIFVJJyxSb2JvdG8sJ0hlbHZldGljYSBOZXVlJyxBcmlhbCxzYW5zLXNlcmlmO2ZpbGw6I2NiZDVlMX08L3N0eWxlPjxyZWN0IHg9IjI0IiB5PSIzMCIgd2lkdGg9IjI0MCIgaGVpZ2h0PSI5MCIgcng9IjEwIiBzdHlsZT0iZmlsbDojMGYxNzJhO3N0cm9rZTojOTRhM2I4Ii8+PHRleHQgeD0iMTQ0IiB5PSI2NSIgdGV4dC1hbmNob3I9Im1pZGRsZSIgc3R5bGU9ImZvbnQ6IDY1MCAxMy41cHggSW50ZXIsIHNhbnMtc2VyaWY7IGZpbGw6ICNmMWY1ZjkiPk9uLXByZW1pc2VzIHJlc29sdmVyPC90ZXh0Pjx0ZXh0IHg9IjE0NCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5wcml2YXRlLW5hbWUgcXVlcnk8L3RleHQ+PHBhdGggZD0iTTI2NyA3NSBoMjIgbS02IC01IDYgNSAtNiA1IiBmaWxsPSJub25lIiBzdHlsZT0ic3Ryb2tlOiM5NGEzYjgiLz48cmVjdCB4PSIyOTQiIHk9IjMwIiB3aWR0aD0iMjQwIiBoZWlnaHQ9IjkwIiByeD0iMTAiIHN0eWxlPSJmaWxsOiMwZjE3MmE7c3Ryb2tlOiM5NGEzYjgiLz48dGV4dCB4PSI0MTQiIHk9IjY1IiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBzdHlsZT0iZm9udDogNjUwIDEzLjVweCBJbnRlciwgc2Fucy1zZXJpZjsgZmlsbDogI2YxZjVmOSI+TGlzdGVuaW5nIGVuZHBvaW50PC90ZXh0Pjx0ZXh0IHg9IjQxNCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5WTklDIGluIGN1c3RvbWVyIHN1Ym5ldDwvdGV4dD48cGF0aCBkPSJNNTM3IDc1IGgyMiBtLTYgLTUgNiA1IC02IDUiIGZpbGw9Im5vbmUiIHN0eWxlPSJzdHJva2U6Izk0YTNiOCIvPjxyZWN0IHg9IjU2NCIgeT0iMzAiIHdpZHRoPSIyNDAiIGhlaWdodD0iOTAiIHJ4PSIxMCIgc3R5bGU9ImZpbGw6IzBmMTcyYTtzdHJva2U6Izk0YTNiOCIvPjx0ZXh0IHg9IjY4NCIgeT0iNjUiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiA2NTAgMTMuNXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjZjFmNWY5Ij5WQ04gRE5TIHJlc29sdmVyPC90ZXh0Pjx0ZXh0IHg9IjY4NCIgeT0iOTIiIHRleHQtYW5jaG9yPSJtaWRkbGUiIHN0eWxlPSJmb250OiAxMXB4IEludGVyLCBzYW5zLXNlcmlmOyBmaWxsOiAjOTRhM2I4Ij5hdHRhY2hlZCBwcml2YXRlIHZpZXdzPC90ZXh0Pjwvc3ZnPg==)

The arrows show the direction of the DNS query.

#### Conditional forwarding

Each `FORWARD` rule becomes an OCI resolver rule: `qname_cover_conditions` holds the domain, `destination_addresses` lists the target servers, and `source_endpoint_name` picks the forwarding endpoint. The rule is part of the VCN resolver, so it applies to that resolver without a separate rule-association resource.

The domain and target IPs are kept. OCI forwards to port 53 and has no per-target port setting here.

#### DNS filtering

This mapping has no OCI counterpart for DNS Firewall on the resolver; plan domain filtering separately. Network Firewall URL rules inspect different traffic. Forwarding an unwanted domain to a server that does not answer produces a timeout. Neither matches the allow, block and alert behaviour of AWS DNS Firewall. AWS-managed domain lists also need a replacement policy.

#### Limitations

Where Route 53 Resolver and this target differ

* **DNS Firewall is not supported.** OCI's VCN resolver has no DNS firewall, and Tensor9 does not create one. Route 53 Resolver firewall rules, query logging and DNSSEC resources in your stack do not create anything on OCI.
* **DNSSEC validation is not supported.** Route 53 Resolver can check DNSSEC signatures on the answers it receives; this mapping does not keep that setting. Signing a hosted zone is a different feature: it signs that zone's records but does not validate answers for your network.
* **Forwarding ports other than 53 are not supported.** A target on another port is sent queries on port 53, and the deployment does not flag it. Check your rules before deploying; a target that listens on another port needs a different setup.
* **You must give forwarding targets as literal IP addresses.** If a rule's `target_ip` is a variable or a reference, the deployment cannot read it. The rule gets a placeholder address and a warning, and you must replace it with the real DNS server before applying.
* **DNS over HTTPS is not supported.** The OCI VCN resolver answers and forwards over standard DNS only. A DoH protocol set on a Route 53 Resolver endpoint or forwarding target is dropped, and the deployment reports it.

#### Other considerations

**Query logging.** Resolver query logs go to OCI Logging, which you set up: the log destination, access and retention. Update searches and alerts for the OCI fields. Existing AWS log history stays where it is unless you export it.

**Before switching clients.** Point on-premises conditional forwarders at the listening address. Test private views, forwarded domains, network failures and log collection first.

**Moving from AWS.** Resolver caches and query history are not transferred. Anything outside the stack that refers to AWS endpoint IDs or rule ARNs needs the target's identifiers instead.

## Install and run

The documentation and SLAs are public. Downloading and running the Cloud Adapter binary requires an entitled customer account. Set `T9_API_KEY` as described in [Install and Authenticate](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/install-and-authenticate.md), then list the adapters your account may use with this origin:

```sh theme={null}
tensor9 adapt svc list \
  -origin aws::1.0.0::route53::resolver
```

The result is limited to directed mappings for this origin that your account is entitled to use. Use a returned backend identifier when configuring the adapter or investigating a request.

Request binary access from [hello@tensor9.com](mailto:hello@tensor9.com) if your account does not yet include this direction.

## Existing data and credentials

Selecting a backend does not copy existing data, credentials or access policies. Plan and verify migration separately before changing an application's endpoint. Do not assume an identifier, credential or encrypted value from the origin service works unchanged on the target.

## Configure, tune and debug

Start with [setup](https://docs.tensor9.com/cloud-adapter-early-access/getting-started/overview.md) and [configuration](https://docs.tensor9.com/cloud-adapter-early-access/configuration/overview.md). Use [tuning](https://docs.tensor9.com/cloud-adapter-early-access/tuning/overview.md) to understand supported request tags, [debugging](https://docs.tensor9.com/cloud-adapter-early-access/debugging/overview.md) to investigate a request, and [High Fidelity Cloud Emulators](https://docs.tensor9.com/cloud-adapter-early-access/local-testing/overview.md) to validate a bounded reproduction.

For requests that go through an entitled service adapter, use [tensor9 explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/explain.md) and [x-t9-explain](https://docs.tensor9.com/cloud-adapter-early-access/debugging/response-headers.md) to inspect the selected mapping.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.