title: Why is an endpoint-specific DNS hostname resolving on the open internet?
body: <p>For work, I created an <a href="https://docs.aws.amazon.com/vpc/latest/userguide/vpce-interface.html" rel="nofollow noreferrer">interface endpoint with private dns enabled</a>.  AWS generated endpoint-specific DNS hostnames as expected.  However, I expect those DNS addresses to be accessible only within my VPC and instead I see they resolve on the public internet.  By "public internet" I mean that my personal (non-work) laptop can resolve the DNS hostname when tethered to my non-work cell phone (no VPN, no work access).  Major-league surprise!</p>
  
  <p>I'm obfuscating the DNS name for this example, but basically the following command worked from a public network when I expected it to fail:</p>
  
  <pre><code>c:\&gt;nslookup vpce-05df6-ug9qu.ec2.us-east-1.vpce.amazonaws.com
  Server: Unknown
  Address: 192.168.43.254
  
  Non-authoritative answer:
  Name: vpce-05df6-ug9qu.ec2.us-east-1.vpce.amazonaws.com
  Addresses: 10.137.90.25
             10.137.95.40
  </code></pre>
  
  <p>Again, I've obfuscated/altered the above DNS name and IP answers because I don't want the real values posted in this question, but the above is sufficient to clarify that surprisingly the address did resolve. I had instead expected nslookup would say:</p>
  
  <blockquote>
    <p>*** Unknown can't find vpce-05df6-ug9qu.ec2.us-east-1.vpce.amazonaws.com: Non-existent domain</p>
  </blockquote>
  
  <p>Why is this?</p>