AWS Route53 – How to Resolve Private DNS Name Inside EC2 Instances

Creating a private hosted zone in Route 53 essentially applies a "hook" in the DNS resolver for your VPC so that queries for that domain are routed directly to the assigned Route 53 nameservers instead of being resolved normally by traversing down starting at the global root servers.

In light of that, I suppose it makes sense for the system to consider a subdomain to be a conflict, and this is a documented limitation:

ConflictingDomainExists

You specified an Amazon VPC that you're already using for another hosted zone, and the domain that you specified for one of the hosted zones is a subdomain of the domain that you specified for the other hosted zone. For example, you cannot use the same Amazon VPC if you're creating hosted zones for example.com and test.example.com.

http://docs.aws.amazon.com/Route53/latest/APIReference/API-create-hosted-zone-private.html

The following (untested) workaround should allow you to achieve the same functionality, though... assuming domain.local is configured as a private hosted zone:

• Create dev.domain.local as a public zone in Route 53.

• Note the 4 NS records assigned to the new zone by Route 53.

• Back in the domain.local private zone, create a record for host "dev," type "NS," and paste the 4 nameservers assigned to dev.domain.local in the box.

This configuration should cause the VPC resolver to consult the private parent domain, learn the delegation, recurse to the delegated nameservers for the correct record, and return the expected response.

You will need to:

• Setup IPsec VPN to connect between AWS and office, and
• Setup Dnsmasq in both AWS and office sites to proxy your DNS requests.

The most important option of Dnsmasq in ths case is --domain=, to specify DNS domains to forward. You can use this option to pass DNS requests to your private Route53 domain (office clients -> Dnsmasq/Unbound in office -> Dnsmasq in AWS -> Route53).