● Covered by 1 source · 1 reportMedium impact1 neutral
AWS Network Firewall Gains Route 53 Resolved IP Validation for Enhanced Traffic Filtering
Key points
- Route 53 Resolver shares resolved IP addresses with Network Firewall.
- Enables domain-based filtering for non-web protocols like SSH/SFTP.
- Prevents Server Name Indication (SNI) manipulation on TLS traffic.
- Available at no additional charge since October 21, 2026.
New Integration for Network Firewall
AWS has introduced Route 53 Resolved IP Validation for AWS Network Firewall. This new capability allows Amazon Route 53 Resolver to share the IP addresses it returns for domain names directly with Network Firewall. This integration was launched on October 21, 2026, and is available at no additional cost.
Addressing Filtering Challenges
Previously, Network Firewall rules for protocols like SSH and SFTP, which do not carry domain names in their traffic, relied on IP addresses that can change over time. This made domain-based filtering difficult. For HTTP/HTTPS, while domain rules matched client requests, there was no shared visibility between DNS answers and the firewall.
With this update, Network Firewall can now check new outbound connections against the resolved IP addresses provided by Route 53 Resolver. This enables filtering of non-web traffic by domain name and helps prevent Server Name Indication (SNI) manipulation on TLS traffic without requiring TLS inspection.
How the Feature Works
Amazon Route 53 Resolver, which handles DNS queries from resources in a VPC, now maintains a resolved IP cache containing the IP addresses it returns for each domain name. When an outbound connection is initiated, Network Firewall consults this cache to validate the destination address. If the address is in the cache, the connection proceeds according to the firewall policy.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
Reporting from
AWS Network Firewall now integrates with Amazon Route 53 Resolver to validate resolved IP addresses, allowing domain-based filtering for non-web traffic and preventing SNI manipulation without TLS inspection. This feature addresses the challenge of filtering traffic for protocols that do not carry domain names, where firewall rules previously relied on IP addresses that change over time.