What Limits DNS Queries in an Amazon VPC - The Shared 1,024 Packets per Second, Resolver Endpoints, and What the Logs Miss

First Published: 2026-11-15
Last Updated: 2026-11-15

Instances within an Amazon VPC have a limit of 1,024 packets per second per network interface when sending queries to the Amazon DNS server. This limit applies not only to DNS queries but also includes traffic related to the Instance Metadata Service, Amazon Time Sync Service, and Windows licensing. This limit cannot be increased. VPC Flow Logs do not record traffic to the Amazon DNS server. According to EKS documentation and re:Post, queries that exceed this limit are not logged in Resolver query logs either.

This article will explore what this limit encompasses, what happens when it is exceeded, where records are kept, and where they are not, drawing on documentation for VPC, EC2, Route 53, CloudWatch, and EKS, whitepapers, re:Post, and the Networking & Content Delivery Blog. It will also show that the limit on Resolver endpoints counts something different. This article is not an introduction to DNS. It is neither a guide to designing hybrid DNS solutions nor a procedure for load testing. It does not cover pricing either.

In conclusion:

The limit is 1,024 packets per second for each network interface. This count includes DNS queries to VPC Resolver, requests to IMDS, requests to Amazon Time Sync Service (NTP), and Windows licensing requests. This limit cannot be increased.
Increasing the instance size does not increase this limit. There is no limit on the total number of queries across the entire VPC.
Traffic to a DNS server that you run yourself is not counted against this limit.
Regarding queries exceeding the limit, the documentation says that they are rejected, queued and then dropped, or left unanswered. re:Post says that the queries intermittently time out.
VPC Flow Logs do not record traffic to the Amazon DNS server. The documentation for EKS and re:Post indicates that dropped queries are not logged in query logs. What keeps a count is the ENA driver counter linklocal_allowance_exceeded.
The limit for Resolver endpoints is up to 10,000 UDP queries per second for each endpoint IP address. It counts something different from the 1,024 limit, in a different unit.

This article reviewed the documentation on November 14, 2026 (Japan Standard Time). It does not include observations from actual AWS accounts.

Related articles on this site:

1. Scope and Terms
2. What the Link-Local Allowance Counts
3. What Happens When the Allowance Runs Out
4. What Records It and What Does Not
5. Resolver Endpoints Count Something Else
6. What the Documentation Recommends
7. Where the Sources Disagree, and Where No Statement Was Found
8. Failure Modes
9. Frequently Asked Questions About DNS Query Limits in a VPC
10. Summary
11. References

1. Scope and Terms

This chapter defines the scope, intended audience, source materials, and terminology used in this article. The key conclusions are as follows:

This article focuses solely on the query limits and logging related to DNS within a VPC. Separate articles on this site cover the API limits for Route 53 and the design of hybrid DNS (Section 1.2).
The terms "1,024," "Resolver," "limit," and "log" may refer to different things in the sources (Section 1.4).
Route 53 Resolver was renamed to Route 53 VPC Resolver on November 30, 2025. Some pages still use the previous name (Section 1.5).
This article will not state that something is "unavailable" or "impossible" if it is not explicitly mentioned in the source materials (Sections 1.6 and 7.3).

1.1 Intended Audience

This article is intended for readers who:

Are investigating the reasons for occasional name resolution failures within their VPCs.
Want to know if traffic to IMDS and NTP is subject to the same limits as DNS queries.
Are deploying systems that generate a high volume of DNS queries within a VPC, such as EKS, Lambda, or Active Directory domain controllers.
Are using Resolver endpoints to forward queries and want to understand where the limits are reached.

This article assumes that readers may believe the following, and checks each one against the sources:

Increasing the instance size will also increase the DNS query limit.
It is possible to request an increase to these limits.
DNS failures can be identified by examining VPC Flow Logs or Resolver query logs.
Traffic to IMDS and NTP is not subject to the same limit as DNS.
Resolver endpoints also have a limit of 1,024 packets per second.
Route 53 Resolver and Route 53 VPC Resolver are distinct services.

1.2 Scope and Exclusions

This article covers the following:

The per-network interface limit of 1,024 packets per second, detailing what is counted and what is not.
What the documentation states regarding behavior when this limit is exceeded.
Which records keep queries dropped over this limit, and which do not.
What the Resolver endpoint limit counts.
The actions that the sources recommend.
Disagreements between sources, and points where no statement was found.

This article does not cover:

Pricing.
API request limits for Route 53. The Route 53 API Throttling article on this site covers this.
The design of Resolver endpoints, forwarding rules, and private hosted zones. The Amazon Route 53 DNS Architecture Guide on this site covers this.
The functionality of IMDS and its own request limitations. The Metadata Endpoints Across AWS Compute article on this site covers this.
The complete process for troubleshooting VPC traffic. The AWS VPC Network Troubleshooting Guide on this site covers this.
The full range of ENA allowances and instance bandwidth design.
The functionality of DNS Firewall, Route 53 Profiles, and Route 53 Global Resolver. This article mentions Global Resolver only to distinguish the names.
Procedures for testing whether a limit is exceeded, or for sending large volumes of queries.

1.3 Date of Review and Materials Reviewed

This article reviewed the following materials on November 14, 2026 (Japan Standard Time). In the text, this article uses the English names in parentheses.

The DNS quotas section of the Understanding Amazon DNS page in the Amazon VPC User Guide (DNS quotas section)
The Amazon VPC quotas page in the Amazon VPC User Guide (VPC quotas page)
The Flow log limitations page in the Amazon VPC User Guide (Flow Logs limitations page)
The What is Route 53 VPC Resolver? page in the Amazon Route 53 Developer Guide (What is VPC Resolver page)
The Route 53 VPC Resolver availability and scaling page in the Amazon Route 53 Developer Guide (VPC Resolver scaling page)
The Quotas page in the Amazon Route 53 Developer Guide (Route 53 quotas page)
The Resolver endpoint scaling page in the Amazon Route 53 Developer Guide (endpoint scaling page)
The Monitoring Route 53 VPC Resolver endpoints with Amazon CloudWatch page in the Amazon Route 53 Developer Guide (endpoint metrics page)
The Resolver query logging page in the Amazon Route 53 Developer Guide (query logging page)
The Monitor network performance for ENA settings on your EC2 instance page in the Amazon EC2 User Guide (ENA metrics page)
The Access instance metadata for an EC2 instance page in the Amazon EC2 User Guide (IMDS page)
The Set the time reference on your EC2 instance to use the local Amazon Time Sync Service page in the Amazon EC2 User Guide (Time Sync page)
The Collect network performance metrics page in the Amazon CloudWatch User Guide (CloudWatch agent page)
The Monitoring EKS workloads for Network performance issues page in the Amazon EKS Best Practices Guide (EKS network performance page)
The Giving Lambda Event Functions access to resources in an Amazon VPC page (Lambda VPC page) and the Troubleshoot networking issues in Lambda page (Lambda networking troubleshooting page) in the AWS Lambda Developer Guide
The PDF of the AWS Whitepaper Hybrid Cloud DNS Options for Amazon VPC (Hybrid Cloud DNS whitepaper)
The PDF of the AWS Hybrid DNS with Active Directory Technical Guide, dated June 9, 2021 (Active Directory DNS guide)
Three articles in the AWS re:Post Knowledge Center: Determine the cause of failed DNS queries (re:Post throttling article), Review and troubleshoot partial DNS failures (re:Post partial failures article), and Troubleshoot DNS related errors in AWS Lambda (re:Post Lambda article)
Two posts on the Networking & Content Delivery Blog: Amazon EC2 instance-level network performance metrics uncover new insights (network metrics blog post) and Scaling your hybrid DNS setup with Amazon Route 53 Resolver endpoint metrics (endpoint metrics blog post)
The What's New post Introducing Amazon Route 53 Global Resolver for secure anycast DNS resolution (preview), posted on November 30, 2025 (What's New post of 2025-11-30)
The What's New post Amazon Route 53 Global Resolver is now generally available, posted on March 9, 2026 (What's New post of 2026-03-09)

The AWS pages were read using the text obtained from the AWS Knowledge MCP Server. Direct quotes in this article were verified against that text. Two whitepapers were read in their PDF format.

The HTML page for Constraints in the Hybrid Cloud DNS whitepaper redirected to the What is VPC Resolver page when accessed via curl on the date of review. This article cites a PDF document as the source for the same text.

This article distinguishes between documents, re:Post content, and blog posts. Articles in the re:Post Knowledge Center and blog posts are a separate category of source from the developer guides and user guides. This article states, in the same sentence, which category of source a statement comes from.

1.4 Terms, and Different Things with the Same Name

This article will consistently use the following terms to refer to specific concepts:

VPC Resolver: A recursive DNS resolver that is available by default for each VPC. Until November 30, 2025, it was known as Route 53 Resolver. It is also referred to as the Amazon DNS server, Amazon provided DNS server, or AmazonProvidedDNS.
Link-local allowance: A limit of 1,024 packets per second for each network interface. This is the term used in this article. The ENA metrics page refers to it as Link-local service access.
Link-local services: Services that utilize link-local addresses. The VPC Resolver scaling page lists four such services: VPC Resolver, Amazon Time Service (NTP), IMDS, and Windows Licensing Service.
Custom DNS resolver: A DNS server that users configure and manage themselves. This is the term used on the ENA metrics page.
Resolver endpoint: An endpoint used to forward DNS queries between a VPC and an on-premises network. There are inbound and outbound endpoints.
Counted against: Indicates what is being counted against a specific limit. This article will consistently state what is counted and what is not counted in the same sentence.
Date of review: The date on which this article reviewed the sources, November 14, 2026.

The materials reviewed for this article contain entities that share the same names but represent different concepts.

1,024: There are three instances. The first is the subject of this article: the link-local allowance. The second is a limit of 1,024 packets per second for fragmented packets transmitted per network interface. The ENA metrics page states that with fragment proxy mode enabled in ENA Linux driver version 2.13.3 or later, fragmented packets transmitted are counted against the instance's PPS limit, rather than this limit. Fragment proxy mode is disabled by default. The third instance refers to the SpecialPollInterval of 1,024 seconds on the Time Sync page for Windows Server 2025; this is not a packet limit.
Resolver: There are five names. VPC Resolver, and its former name Route 53 Resolver, refer to the same entity. A Resolver endpoint is a separate resource associated with VPC Resolver. Route 53 Global Resolver is a different service used over the internet. The VPC Resolver scaling page refers to one of the components used to create VPC Resolver as the Nitro Resolver service.
Limit: This article mentions four types of limits. These are the link-local allowance, the limit for queries per IP address on a Resolver endpoint, the limit for the number of Resolver endpoints and IP addresses, and the instance's PPS limit. The instance's PPS limit varies depending on the instance size and is counted in pps_allowance_exceeded. In addition, IMDS imposes request limits per instance. Route 53 APIs also have limits on request frequency.
Log: There are two. VPC Flow Logs record the IP traffic of network interfaces. Resolver query logs record DNS queries and responses received by VPC Resolver. ENA's linklocal_allowance_exceeded is a counter that tracks the number of dropped packets; it is not a log.

1.5 A Change of Name

The What's New post of 2025-11-30 announced the preview of Route 53 Global Resolver and, in the same post, stated the following:

With the launch of Global Resolver, we are renaming Route 53 Resolver to Route 53 VPC Resolver, to help clarify the distinction between the two services.

The What is VPC Resolver page includes the following note:

Route 53 VPC Resolver was previously called Route 53 Resolver, but was renamed when Route 53 Global Resolver was introduced.

On March 9, 2026, Route 53 Global Resolver became generally available.

On the date of review, the Route 53 Developer Guide pages use the new name. However, the DNS quotas section, the VPC quotas page, the ENA metrics page, one sentence on the Route 53 quotas page, and the two whitepapers still say Route 53 Resolver. This article does not consider these instances to be errors; rather, they represent remnants of the previous naming convention. This article does not alter the names in quotations.

1.6 Terms for the State of the Sources

This article uses the following six terms to describe the state of the documentation. These terms, including their English spellings, are also used in the tables.

Stated: The documentation contains a statement regarding the matter.
Stated as not supported: The documentation explicitly states that the matter is not supported or cannot be used.
Documentation does not list: While a list or table exists, the specific item is not included. This does not necessarily indicate that the matter is unsupported or unavailable.
No statement found: Despite searching using different keywords and categories of documentation (as described in Section 1.3), no relevant statement could be found. This does not necessarily indicate that the matter is absent or impossible.
Sources disagree: The statements regarding the same matter in two different documents are contradictory. This article presents both statements, along with their sources, without designating either as incorrect.
Inference: This is an inference made by this article, and is not a statement found in any of the documentation. This article says in the same sentence that it is an inference.

All dates referenced in this article are presented with the year. Pages may be rewritten after the date of review.

2. What the Link-Local Allowance Counts

This chapter clarifies what is counted, what is used as the unit, and what is excluded from the link-local allowance limit of 1,024 packets per second. Figure 1 summarizes the key points of this chapter.

What Counts Against the Link-Local Allowance

2.1 Four Kinds of Traffic Counted Together

The DNS quotas section states the following:

There is a 1024 packet per second (PPS) limit to services that use link-local addresses. This limit includes the aggregate of Route 53 Resolver DNS queries, Instance Metadata Service (IMDS) requests, Amazon Time Service Network Time Protocol (NTP) requests, and Windows Licensing Service (for Microsoft Windows based instances) requests. This quota cannot be increased.

The IMDS page and the Time Sync page also carry a statement to the same effect. The VPC Resolver scaling page lists the same four as link-local services and then states the following:

These services scale with each elastic network interface you create in your VPC, and each network interface allows 1024 packets per second (PPS) destined to Link-Local services. Packets exceeding this limit are rejected.

The limit applies to the total of these four kinds of traffic. Even if the number of DNS queries is low, if there are many requests to IMDS from the same network interface, the amount available for DNS will be reduced. The DNS quotas section also lists, alongside DNS throttling, instance metadata queries that use the Route 53 Resolver network interface as a possible cause of reaching the quota.

IMDS also has separate limitations. The IMDS page states that queries to IMDS are throttled on a per-instance basis, and that the number of simultaneous connections is also limited. This article does not address IMDS limitations themselves (see Section 1.2).

2.2 The Unit Is the Network Interface

The VPC quotas page states the following:

Each EC2 instance can send 1024 packets per second per network interface to Route 53 Resolver (specifically the .2 address, such as 10.0.0.2 and 169.254.169.253). This quota cannot be increased.

While the subject of the sentence is the instance, the unit of measurement is the network interface. The ENA metrics page, the VPC Resolver scaling page, and the re:Post throttling article also specify the unit as a network interface. The DNS quotas section does not specify a unit. The Hybrid Cloud DNS whitepaper states the unit is a network interface in the Constraints section, but specifies the instance in the DNS logging section (Section 7.1).

According to the DNS quotas section, VPC Resolver has three addresses: 169.254.169.253, the IPv6 address fd00:ec2::253, and the primary IPv4 CIDR of the VPC plus two. If the VPC's CIDR is 10.0.0.0/16, the third address is 10.0.0.2. The VPC quotas page specifically mentions 10.0.0.2 and 169.254.169.253. Whether queries directed to fd00:ec2::253 are counted against the same limit is described in Section 7.3.

2.3 It Does Not Change with Instance Size

The network metrics blog post describes ENA network allowances as follows:

All of these allowances get a bump as you increase instance size within the instance family, except for link local PPS.

The same article states the following about the allowance behind linklocal_allowance_exceeded:

This allowance is the same across instances.

The value in the DNS quotas section is also 1,024, with no condition on instance type or size. Increasing the instance size does not increase the link-local allowance.

Conversely, there is no limit on the number of queries for a VPC as a whole. The VPC Resolver scaling page states:

There is no per-VPC aggregate limit on the number of queries, thus the Route 53 VPC Resolver can scale within the bounds of a VPC, which is inherently based on network address usage (NAU).

The same page explains that because VPC Resolver is implemented per network interface, it scales as you add more instances across more Availability Zones. The limit applies to traffic originating from a single network interface.

2.4 Resources Other Than EC2 Instances

The Hybrid Cloud DNS whitepaper, in its Constraints section, states the following:

Therefore, a computing resource on AWS that has a network interface attached to it and is sending traffic to the Amazon DNS resolver (for example, an Amazon EC2 instance or AWS Lambda function) falls under this hard-limit restriction.

The Active Directory DNS guide also includes a similar statement. This article did not find a statement of this limit on the Lambda VPC page or the Lambda networking troubleshooting page (No statement found). Lambda functions utilize a network interface called Hyperplane ENI within a VPC. The Lambda VPC page indicates that functions configured with the same subnet and security group can share these network resources. However, this article did not find a statement clarifying whether this limit applies to each function individually or to each shared Hyperplane ENI (Section 7.3).

The EKS network performance page notes that running CoreDNS replicas on different worker nodes results in each replica's traffic passing through a separate network interface, which reduces the number of DNS queries per network interface.

2.5 What Is Not Counted

The ENA metrics page describes linklocal_allowance_exceeded as follows:

This impacts traffic to the Amazon DNS service, the Instance Metadata Service, and the Amazon Time Sync Service, but does not impact traffic to custom DNS resolvers.

If an instance queries a DNS server that you run yourself, rather than VPC Resolver, that traffic will not be counted against the link-local allowance. However, if that DNS server is running on an instance in the VPC and subsequently forwards queries to VPC Resolver, traffic from the DNS server's network interface to VPC Resolver is counted against the link-local allowance. The DNS logging section of the Hybrid Cloud DNS whitepaper notes that the DNS server receiving and aggregating queries may exceed this limit.

Table 1 summarizes this chapter. The date of review for all rows is November 14, 2026.

Traffic	Destination	Counted against the link-local allowance?	Source
DNS queries to VPC Resolver	`169.254.169.253`, the VPC CIDR base address plus two	Yes (Stated)	DNS quotas section, VPC quotas page, VPC Resolver scaling page
IPv6 queries to VPC Resolver	`fd00:ec2::253`	No statement found	Section 7.3
Requests to IMDS	`169.254.169.254`	Yes (Stated)	DNS quotas section, IMDS page
NTP requests to Amazon Time Sync Service	`169.254.169.123`	Yes (Stated)	DNS quotas section, Time Sync page
Windows licensing requests	The DNS quotas section does not state a destination	Yes (Stated)	DNS quotas section
Traffic to a custom DNS resolver	Your own DNS server	No (Stated)	ENA metrics page
Traffic from Lambda functions to VPC Resolver	VPC Resolver	Yes (Stated)	Hybrid Cloud DNS whitepaper

3. What Happens When the Allowance Runs Out

This chapter shows, source by source, what happens to queries over the limit.

3.1 The Verb in Each Source

The verb used when the limit is exceeded varies depending on the source.

The DNS quotas section states the following:

If you reach the quota, the Route 53 Resolver rejects traffic.

The VPC Resolver scaling page states that packets exceeding the limit are rejected (quoted in Section 2.1). The ENA metrics page describes the overall network limit as follows:

When the network traffic for an instance exceeds a maximum, AWS shapes the traffic that exceeds the maximum by queueing and then dropping network packets.

The table on the same page describes linklocal_allowance_exceeded as the number of dropped packets. The Hybrid Cloud DNS whitepaper states that if designed without considering the limit, queries to Route 53 Resolver may not receive a response.

When you're designing a scalable solution for name resolution, you must consider this limit, because failure to do so can result in queries to Route 53 Resolver going unanswered if the limit is reached.

Rejecting, dropping, and going unanswered do not necessarily say the same thing about whether anything is returned to the client. This article presents this difference as a disagreement between sources (Section 7.1).

3.2 What Clients See

The re:Post partial failures article states the following about the case where the Amazon DNS server is throttling queries:

Amazon provided DNS servers reject traffic that exceeds the quota of 1024 packets per second for each elastic network interface. The DNS throttles and intermittently times out.

The EKS network performance page states the following:

Running DNS intensive workloads can sometimes experience intermittent CoreDNS failures due to DNS throttling, and this can impact applications where you may encounter occasional UnknownHostException errors.

The re:Post Lambda article discusses intermittent DNS errors for Lambda functions, suggesting that network congestion and high traffic volumes may be contributing factors. As one action, it lists DNS libraries that cache locally, which it says help when DNS servers reach the packets-per-second (PPS) quota.

The documentation reviewed does not state whether VPC Resolver returns DNS responses such as SERVFAIL or REFUSED when query limits are exceeded. The behavior that the sources do describe is intermittent timeouts and errors in which applications cannot resolve names.

3.3 Why the Failures Are Intermittent

Since the limit is a number per second, exceeding it only occurs during moments of high query volume. The EKS network performance page notes that packet loss occurs on a second-by-second basis, making it difficult to monitor and determine whether throttling is actually occurring. As an inference by this article, even if the average query rate is well below the limit, brief periods of concentrated query volume can still result in failures. This is likely why the failures appear intermittent.

4. What Records It and What Does Not

This chapter outlines which records keep a trace of queries dropped over the limit, and which do not. Figure 2 summarizes the key points of this chapter.

4.1 VPC Flow Logs

The Flow Logs limitations page lists traffic that Flow Logs do not record. The first item on that list is:

Traffic generated by instances when they contact the Amazon DNS server. If you use your own DNS server, then all traffic to that DNS server is logged.

The same list also includes traffic for Windows license activation, traffic to and from 169.254.169.254 for instance metadata, and traffic to and from 169.254.169.123 for the Amazon Time Sync Service. None of the four kinds of traffic counted against the link-local allowance is recorded in Flow Logs. You will not be able to see this traffic in Flow Logs, regardless of whether you have exceeded any limits.

Traffic to a DNS server that you run yourself is recorded in Flow Logs. This traffic is not counted as part of the link-local allowance (see Section 2.5).

4.2 Resolver Query Logs

The query logging page lists the types of queries that can be recorded, including queries originating from a specified VPC, queries utilizing Resolver endpoints (both inbound and outbound), and queries using DNS Firewall rules. This page does not provide information regarding queries that were dropped due to exceeding the limit.

Two categories of sources state that queries over the limit do not appear in query logs. The first is AWS documentation, the EKS network performance page:

DNS queries are throttled at the elastic network interface level. So, throttled queries don’t appear in the query logging.

The second is the re:Post throttling article:

Throttled DNS queries don't appear in query logs because the queries throttle at the network interface level.

The same re:Post article states that query logs only record traffic that reaches VPC Resolver. The queries are dropped at the network interface before they reach VPC Resolver.

Query logs also omit some queries for a different reason. The query logging page explains this as follows:

VPC Resolver query logging logs only unique queries, not queries that VPC Resolver is able to respond to from the cache.

Queries answered from the cache will not be recorded, even if they do not exceed the limit. As an inference by this article, the number of entries in the query logs does not necessarily correspond to the number of queries sent by the instance. A lower number of entries does not necessarily indicate that the limit has not been exceeded.

4.3 ENA's `linklocal_allowance_exceeded`

The ENA driver counter linklocal_allowance_exceeded tracks the number of dropped packets. The ENA metrics page defines this counter as follows:

Meaning: This counter is the number of packets dropped because the packets-per-second (PPS) rate of traffic to local proxy services exceeded the network interface's limit.
Applies to: Traffic to the Amazon DNS service, IMDS, and Amazon Time Sync Service. It does not include traffic to custom DNS resolvers.
Supported Instances: The "Supported on" column in the table indicates that this applies to all instance types.
Value: This is a cumulative value, representing the total count per network interface since the driver was last reset.

The re:Post throttling article states that this counter is cumulative from the last driver restart caused by a stop and start or a reboot, and that there is an issue only when the value is increasing. The same article says to check the counter at several intervals to see whether the value is increasing. A single reading does not tell you whether throttling is happening now.

To read this counter, a specific version of the ENA driver is required. The ENA metrics page specifies that for Linux, version 2.2.10 or later is required, and for Windows, version 2.2.2 or later is required. On Linux, the counter can be read for each network interface using ethtool -S. On Windows, it can be read using performance counters.

The CloudWatch agent page lists the name of this counter on Windows as:

Link local packet rate allowance exceeded

The CloudWatch agent can send this counter to CloudWatch as a metric. The CloudWatch agent page states the following:

When the CloudWatch agent imports these metrics into CloudWatch from Linux instances, it prepends ethtool_ at the beginning of each of these metric names.

When sending from Linux, the metric name is ethtool_linklocal_allowance_exceeded. The CloudWatch agent page states that version 1.246396.0 or later of the CloudWatch agent is required to ingest this metric. On Linux, the agent will only collect this metric if it is listed in the metrics_collected section of the agent's configuration file under the ethtool section.

4.4 Packet Capture

The re:Post throttling article, in addition to the counters, mentions methods for verifying the number of DNS queries sent, using packet capture and Traffic Mirroring on instances. This article does not cover the procedures for these methods.

Table 2 outlines the content of this chapter. The date of review for all rows is November 14, 2026.

Record	Queries dropped over the limit	Source	Category of source
VPC Flow Logs	Not logged. Traffic to the Amazon DNS server is not logged, regardless of the limit.	Flow Logs limitations page	AWS documentation
Resolver query logs	Not logged.	EKS network performance page, re:Post throttling article	AWS documentation, re:Post
Resolver query logs	The query logging page does not describe dropped queries.	query logging page	AWS documentation
ENA `linklocal_allowance_exceeded`	Counts the number of dropped packets as a cumulative value.	ENA metrics page, re:Post throttling article	AWS documentation, re:Post
CloudWatch `ethtool_linklocal_allowance_exceeded`	Counts the value only when sent via the CloudWatch agent.	CloudWatch agent page	AWS documentation

5. Resolver Endpoints Count Something Else

This chapter shows that the limit on Resolver endpoints counts something different from the link-local allowance. The Amazon Route 53 DNS Architecture Guide on this site covers the design of Resolver endpoints and the associated forwarding rules.

5.1 UDP Queries per IP Address

The Route 53 quotas page includes a table showing the number of UDP queries per IP address for Resolver endpoints. The table's notes state:

Each IP address in an endpoint can process up to 10,000 UDP DNS queries per second (QPS).

The notes also explain that the actual number of queries varies depending on the query type, response size, status and response time of the destination name server, round-trip latency, and protocol. This limit counts queries, rather than packets, and it counts the queries that an endpoint IP address processes, rather than traffic that a network interface sends to link-local services. The Hybrid Cloud DNS whitepaper states that the limit for Resolver endpoints is higher than the link-local allowance, approximately 10,000 per network interface.

5.2 Conditions That Lower It to 1,500

The Route 53 quotas page states:

If connection tracking is enforced by restrictive security group rules or queries are routed through Network Load Balancer, the maximum queries per second per IP address for an inbound endpoint can be as low as 1500.

The same page also indicates that connections passing through services such as Network Load Balancer and AWS Lambda are tracked by default, even if security group settings do not require it. The endpoint scaling page has a sentence with the same conditions, but it does not limit it to inbound endpoints and states it per IP address for an endpoint (see Section 7.1).

5.3 Redundant Outbound Queries

The Route 53 quotas page states the following regarding outbound endpoints:

As a result, the QPS for each outbound network interface will not match the QPS sent to Route 53 VPC Resolver.

The preceding sentence explains that, for high availability, Route 53 Resolver sends redundant outbound queries for each DNS request it receives. The number of queries sent from the outbound endpoint's network interface may exceed the number of queries sent to VPC Resolver.

5.4 The 50% Guideline and the Capacity Metric

The Route 53 quotas page states the following:

If your maximum query rate exceeds 50% of the capacity for any network interface in the endpoint, you can add more network interfaces to increase the endpoint capacity.

The endpoint metrics page displays the ResolverEndpointCapacityStatus metric, which shows the capacity status of the endpoint. The values are 0, 1, and 2. A value of 0 indicates normal capacity. A value of 1 indicates that at least one network interface has exceeded 50% capacity. A value of 2 indicates that at least one network interface has exceeded 75% capacity. The page also explains that this status is determined by factors such as query volume, query latency, DNS protocol, DNS packet size, and connection tracking status. The endpoint metrics blog post notes that this metric was added to provide insight into capacity usage that cannot be determined solely by InboundQueryVolume and OutboundQueryAggregateVolume.

Table 3 compares the two limits. The date of review for all rows is November 14, 2026.

Item	Link-local allowance	Resolver endpoint limit per IP address
What it counts	Packets of the four kinds of traffic to link-local services	UDP DNS queries processed by the endpoint's IP address
Unit	Network interface	Endpoint IP address
Value	1,024 packets per second	Up to 10,000 queries per second. Can be as low as 1,500 under certain conditions. Sources disagree on where this applies (see Section 7.1).
Increase	No	The table on the Route 53 quotas page does not show a quota increase request for this row (Documentation does not list). Capacity is increased by adding network interfaces.
When exceeded	See Section 3.1	Exceeding the connection tracking limit may result in throttling and query loss (see endpoint scaling page). No statement found regarding what happens when exceeding 10,000.
Value to check	`linklocal_allowance_exceeded`	`ResolverEndpointCapacityStatus`, `InboundQueryVolume`, `OutboundQueryAggregateVolume`
Source	DNS quotas section, VPC quotas page, ENA metrics page	Route 53 quotas page, endpoint metrics page

The Route 53 quotas page states that a single AWS account can have up to four endpoints per Region, and that a single endpoint can have up to six IP addresses. Both of these limits are eligible for increase requests.

6. What the Documentation Recommends

This chapter lists, by source, the actions that the sources recommend for the link-local allowance. This article does not cover setup procedures. Each action is a recommendation for the situation that its source covers, and this article does not extend it to other situations.

6.1 Caching on the Instance and the Retry Interval

The re:Post throttling article and the re:Post partial failures article state that if DNS throttling is causing the failures, you take one of the following actions:

Enable DNS caching on the instance.
Increase the application's DNS retry timer.

The re:Post Lambda article suggests, for Lambda functions, using runtime-specific DNS libraries that allow local caching of DNS queries, and implementing retries with exponential backoff and jitter.

6.2 Distributing Queries Across Different Network Interfaces

The EKS network performance page notes that the CoreDNS Deployment has an anti-affinity policy, ensuring that replicas run on different worker nodes. Because each replica communicates through a separate network interface, the number of queries handled by each network interface is reduced. Furthermore, it states:

If you notice that DNS queries are being throttled because of the 1024 packets per second limit, you can 1) try increasing the number of CoreDNS replicas or 2) implement NodeLocal DNSCache.

The re:Post partial failures article also mentions CoreDNS inter-pod anti-affinity, increasing the number of CoreDNS replicas, and utilizing NodeLocal DNSCache.

6.3 Reducing What DNS Servers Forward

The Active Directory DNS guide states what to do when the limit is reached in a configuration where Active Directory domain controllers also act as DNS servers:

If you encounter this performance limit, AWS recommends configuring this post for conditional forwarding to Amazon Route 53 private zones to use the Resolver service as well as root hints (DNS data sorted in a DNS server) for internet name resolution.

This article reads this sentence as a recommendation to conditionally forward only the names in Route 53 private zones, rather than forwarding all queries to VPC Resolver, and to resolve internet names with root hints. This guide is dated June 9, 2021.

Table 4 outlines the content of this chapter. The date of review for all rows is November 14, 2026.

Action	Situation	Source	Category of source
Enable DNS caching on instances	EC2 instances	re:Post throttling article, re:Post partial failures article	re:Post
Increase the DNS retry timer for applications	EC2 instances	re:Post throttling article, re:Post partial failures article	re:Post
DNS libraries that cache locally, and retries with exponential backoff and jitter	Lambda functions	re:Post Lambda article	re:Post
Distribute CoreDNS replicas across different nodes and increase the number of replicas	EKS	EKS network performance page, re:Post partial failures article	AWS documentation, re:Post
NodeLocal DNSCache	EKS	EKS network performance page, re:Post partial failures article	AWS documentation, re:Post
Conditional forwarding to private zones and using root hints	Active Directory domain controllers	Active Directory DNS guide	Whitepaper

Regarding requests to IMDS, the IMDS page recommends not querying for credentials on every transaction, but caching them until they approach their expiry time, and retrying with exponential backoff if throttled. This recommendation pertains to limitations inherent in IMDS itself, but requests to IMDS also count towards the link-local allowance (Section 2.1).

7. Where the Sources Disagree, and Where No Statement Was Found

This chapter summarizes the disagreements between sources and the points where no statement was found.

7.1 Where the Sources Disagree

This article found four points where the sources disagree. This article does not conclude that any single source is incorrect.

The first is the verb for what happens when the limit is exceeded. The DNS quotas section says rejects traffic, the VPC Resolver scaling page says rejected, the ENA metrics page says queueing and then dropping, and the Hybrid Cloud DNS whitepaper says going unanswered. The re:Post partial failures article says that the traffic is rejected, and then that the DNS intermittently times out (Sections 3.1 and 3.2).

The second is the unit of the limit. The DNS quotas section does not specify units. The VPC quotas page, ENA metrics page, and VPC Resolver scaling page all state the network interface. The Hybrid Cloud DNS whitepaper states the network interface in the Constraints section, but in the DNS logging section it states the following:

Each EC2 instance is limited to 1024 packets per second for DNS queries toward the Route 53 Resolver.

The third is where the 1,500 applies. The Route 53 quotas page states that, under certain conditions, the inbound endpoint value can decrease to 1,500. The endpoint scaling page states the following under the same conditions:

the overall maximum queries per second per IP address for an endpoint can be as low as 1500.

The fourth is how the value for Resolver endpoints is stated. The Route 53 quotas page states that, for each IP address, the maximum number of UDP queries is 10,000. The Hybrid Cloud DNS whitepaper and the Active Directory DNS guide state approximately 10,000 per network interface, without specifying the protocol. The endpoint metrics blog post states a maximum of 10,000 for UDP, and significantly lower for DNS over HTTPS.

7.2 What This Article Does Not Call a Disagreement

This article does not call the following two points disagreements:

The first is the name. The Route 53 Developer Guide says Route 53 VPC Resolver, while the VPC and EC2 user guides, the whitepapers, and one sentence on the Route 53 quotas page say Route 53 Resolver. This is wording from before the name change on November 30, 2025 that remains, and both names refer to the same thing (see Section 1.5).

The second is the version of the Windows ENA driver. The ENA metrics page states 2.2.2 or later, while the re:Post throttling article specifies 2.2.2.0 or later. The network metrics blog post indicates that the Windows version 2.2.2.0 will soon be available. This article reads these as differences in how the version is written and in when the articles were written.

7.3 Where No Statement Was Found

This article did not find a statement on the following six points in the sources as of the date of review. None of these indicates that the matter is absent or impossible.

Whether VPC Resolver returns a DNS response, such as SERVFAIL, when handling queries exceeding the limit (Section 3.2).
Whether queries for IPv6 address fd00:ec2::253 are counted towards the link-local allowance. The VPC Resolver scaling page states that VPC Resolver runs on the VPC CIDR plus two address and on fd00:ec2::253, and then states the limit for link-local services. However, the limit description does not differentiate between IPv4 and IPv6. This article does not state whether these queries are counted or not.
Regarding network interfaces used by Lambda functions within a VPC, what unit is used to calculate the limit (Section 2.4).
When adding network interfaces to the same instance, which network interface DNS queries pass through, and how the limit counts them.
Whether queries answered from the local cache of the Nitro Resolver service are counted against the link-local allowance.
What happens when the limit of 10,000 queries per second per Resolver endpoint IP address is exceeded. The endpoint scaling page states that exceeding the connections that can be tracked may cause throttling and query loss. This statement is about the connection tracking limit.

8. Failure Modes

This chapter lists failures that can occur with the link-local allowance, as symptom, cause, and source.

Symptoms: Name resolution occasionally times out. Cause: A high volume of queries within a short period exceeds the network interface's link-local allowance. Reference: re:Post partial failures article, EKS network performance page (Sections 3.2 and 3.3).
Symptoms: Increasing the instance size does not reduce the name resolution failures. Cause: The link-local allowance is not dependent on the instance size. Reference: network metrics blog post (Section 2.3).
Symptoms: Reviewing VPC Flow Logs to investigate DNS failures reveals no DNS traffic. Cause: Flow Logs do not record traffic to the Amazon DNS server. Reference: Flow Logs limitations page (Section 4.1).
Symptoms: Resolver query logs show no failed queries. Cause: Queries exceeding the limit are dropped by the network interface before reaching VPC Resolver. Reference: EKS network performance page, re:Post throttling article (Section 4.2).
Symptoms: The linklocal_allowance_exceeded counter is non-zero, but no failures are currently occurring. Cause: This counter is cumulative, reflecting the total since the driver's last reset. Reference: ENA metrics page, re:Post throttling article (Section 4.3).
Symptoms: The ethtool_linklocal_allowance_exceeded metric is not appearing in CloudWatch. Cause: The CloudWatch agent configuration file does not list this metric under the ethtool section, or the CloudWatch agent version is earlier than 1.246396.0. Reference: CloudWatch agent page (Section 4.3).
Symptoms: Despite a relatively low volume of DNS queries, the link-local allowance is being exceeded. Cause: Requests for IMDS (Instance Metadata Service) and NTP (Network Time Protocol) from the same network interface also count against the same limit. Reference: DNS quotas section (Section 2.1).
Symptoms: Instances acting as DNS servers experience unstable name resolution. Cause: When the instance forwards client queries to VPC Resolver, those queries count against the link-local allowance of that instance's network interface. Reference: Hybrid Cloud DNS whitepaper, Active Directory DNS guide (Sections 2.5 and 6.3).
Symptoms: Inbound endpoint queries level off far below 10,000. Cause: Connection tracking is in effect because of restrictive security group rules or a Network Load Balancer. Reference: Route 53 quotas page, endpoint scaling page (Section 5.2).

9. Frequently Asked Questions About DNS Query Limits in a VPC

Q1. If you increase the instance size, does the DNS limit go up?

No. According to the network metrics blog post, the ENA network allowances grow as the instance size increases, except for link-local PPS (as stated in Section 2.3).

Q2. Can you request an increase to the limit?

No. The DNS quotas section and the VPC quotas page state that this limit cannot be increased (Sections 2.1 and 2.2).

Q3. Does IMDS and NTP traffic count against the same limit as DNS?

Yes. The DNS quotas section states that DNS queries, IMDS requests, NTP requests, and Windows licensing requests are all counted together, with a limit of 1,024 packets per second (see Section 2.1).

Q4. Does this limit also apply to Lambda functions?

The Hybrid Cloud DNS whitepaper cites Lambda functions as an example of resources that have network interfaces and send traffic to the Amazon DNS resolver. However, this article did not find this limit stated on the Lambda VPC page or the Lambda networking troubleshooting page (Section 2.4).

Q5. Do dropped queries appear in Resolver query logs?

No. The EKS network performance page and the re:Post throttling article both state that throttled queries do not appear in query logs. The query logging page does not mention this (Section 4.2).

Q6. Can you count the number of DNS queries using VPC Flow Logs?

Traffic to the Amazon DNS server cannot be counted. Flow Logs do not record this traffic. However, traffic to a DNS server that you run yourself is recorded (see Section 4.1).

Q7. If you query your own DNS server, does this limit stop applying?

Traffic from an instance to a DNS server that you run yourself is not counted against the link-local allowance. However, if that DNS server runs on an instance in the VPC and forwards queries to VPC Resolver, the forwarded queries count against the link-local allowance of the DNS server's network interface (see Section 2.5).

Q8. Do Resolver endpoints also have the limit of 1,024 packets per second?

The limit for Resolver endpoints is up to 10,000 UDP queries per second per IP address. The Route 53 quotas page states that it can be as low as 1,500 for inbound endpoints under certain conditions, and the sources disagree on where this applies (Section 7.1). The link-local allowance counts something different, in a different unit (see Chapter 5).

Q9. Are Route 53 Resolver and Route 53 VPC Resolver different things?

They are the same. On November 30, 2025, the name was changed to differentiate it from Route 53 Global Resolver (see Section 1.5).

Q10. What does the client receive when the limit is exceeded?

The re:Post partial failures article mentions that timeouts occur intermittently. The EKS network performance page states that the application may experience UnknownHostException errors. This article did not find a statement on whether VPC Resolver returns a DNS response such as SERVFAIL (Section 3.2).

10. Summary

DNS query limits in a VPC can be understood in terms of the following five points:

What is counted: 1,024 packets per second per network interface, counting DNS queries to VPC Resolver together with IMDS, NTP, and Windows licensing traffic. It cannot be increased and does not change with instance size. Traffic to a DNS server that you run yourself is not counted.
Over the limit: The sources describe the behavior as rejecting, queueing and then dropping, or going unanswered. re:Post indicates this appears as intermittent timeouts.
Records: VPC Flow Logs do not record traffic to the Amazon DNS server. Dropped queries do not appear in query logs, according to EKS documentation and re:Post. What keeps a count is the cumulative value of ENA's linklocal_allowance_exceeded.
Resolver endpoints: For each IP address, the limit is up to 10,000 UDP queries per second. Under certain conditions it can be as low as 1,500, which the Route 53 quotas page states for inbound endpoints. This is a separate limit from the link-local allowance.
Actions: Documentation recommends using caching, adjusting retry intervals, distributing queries across different network interfaces, and reducing forwarding. Each is a recommendation for the situation that its source covers.

11. References

References:
Tech Blog with curated related content

Written by Hidekazu Konishi