Now we will see how our Support Engineers set up a local DNS cache, using dnsmasq (a DHCP and cache DNS server).

1.  Firstly, we can install the dnsmasq server by running the following command:

sudo yum install -y dnsmasq

2.  Then we can create a dedicated system user to run dnsmasq using the following commands:

sudo groupadd -r dnsmasq
sudo useradd -r -g dnsmasq dnsmasq

Note: dnsmasq typically runs as the root user, but drops root privileges after startup by changing to another user. And by default, the user is “nobody”.

3. Next, we will make a copy of the dnsmasq.conf file using the following command:

sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig

4.  And open the configuration file using a text editor as given below:

sudo vim /etc/dnsmasq.conf

5.  Now we will edit the /etc/dnsmasq.conf file so that it is similar to the following:

# Server Configuration
listen-address=127.0.0.1
port=53
bind-interfaces
user=dnsmasq
group=dnsmasq
pid-file=/var/run/dnsmasq.pid

# Name resolution options
resolv-file=/etc/resolv.dnsmasq
cache-size=500
neg-ttl=60
domain-needed
bogus-priv

6. After that we will create the /etc/resolv.dnsmasq file, and set the Amazon DNS server or the custom domain-name-servers that are specified on DHCP options sets.

sudo bash -c "echo 'nameserver 169.254.169.253' > /etc/resolv.dnsmasq"

7. We can restart the dnsmasq server and set the service to start up on boot using the following commands:

Amazon Linux 1

sudo service dnsmasq restart
sudo chkconfig dnsmasq on

Amazon Linux 2

sudo systemctl restart dnsmasq.service
sudo systemctl enable dnsmasq.service

8. Then we can verify that dnsmasq is working correctly using the dig command given below:

dig aws.amazon.com @127.0.0.1

If the result is similar to the following, then it is working correctly:

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.56.amzn1 <<>> aws.amazon.com @127.0.0.1
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25122
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;aws.amazon.com.            IN    A

;; ANSWER SECTION:
aws.amazon.com.        41    IN    A    54.239.31.69

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
...

9. After verification we can set the dnsmasq DNS cache as the default DNS resolver.

10. We can configure the default DNS resolver as a fallback option by using the following:

sudo bash -c "echo 'supersede domain-name-servers 127.0.0.1, 169.254.169.253;' >> /etc/dhcp/dhclient.conf"

11. And we can either run the dhclient command or reboot the instance to apply the change:

sudo dhclient

OR

sudo reboot

12. To verify that the instance is using the DNS cache, we can run the dig command:

dig aws.amazon.com

If we get the following reply then the DNS cache is working correctly:

; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.56.amzn1 <<>> aws.amazon.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1028
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0

;; QUESTION SECTION:
;aws.amazon.com.            IN    A

;; ANSWER SECTION:
aws.amazon.com.        55    IN    A    54.239.31.69

;; Query time: 0 msec
;; SERVER: 127.0.0.1#53(127.0.0.1) <<<-------
...

Steps to automate the installation and configuration of dnsmasq as a DNS resolver 

We can use one of the following to automate the installation and configuration of dnsmasq as a DNS resolver on Amazon Linux:

• AutomateDnsmasq.sh Bash script
• AutomateDnsmasq.cloudinit directives

Both the above files can run on VPC instances or EC2-Classic since they use the Amazon DNS server alternative address of 169.254.169.253 for VPC and 172.16.0.23 for EC2-Classic.

We can run either file at launch time by passing the contents of the file in the user data field. Moreover, we can run the Bash script as a standalone script or with an AWS Systems Manager run command to perform the actions on an existing instance.

For running the Bash script as a standalone script we must do the following:

1. Firstly, we have to download the script on our instance and make it executable.

For this, we can use the following command:

wget https://raw.githubusercontent.com/awslabs/aws-support-tools/master/EC2/AutomateDnsmasq/AutomateDnsmasq.sh
chmod +x AutomateDnsmasq.sh

2.  After that we can run the following command as a root user or use sudo.

sudo ./AutomateDnsmasq.sh

[Need assistance? We can help you]

Conclusion

To conclude, we saw the steps that our Support Techs follow to Avoid DNS resolution failures in EC2.