# Per-VPC DNSSEC validation status of the Route 53 Resolver, joined against the full VPC inventory so that a VPC which never enabled validation is visible rather than absent

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/route53-resolver-dnssec-validation

Recipe id: `route53-resolver-dnssec-validation` · cadence weekly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-SIN`
- control `sc-21`

## Collection

Kind: `cli`

```sh
# describe-vpcs
aws ec2 describe-vpcs --query 'Vpcs[].VpcId'
# list-resolver-dnssec-configs
aws route53resolver list-resolver-dnssec-configs
```

## Expected output

describe-vpcs yields the VpcId inventory for the Region. list-resolver-dnssec-configs yields ResolverDnssecConfigs[] with Id, OwnerId, ResourceId and ValidationStatus (ENABLING | ENABLED | DISABLING | DISABLED | UPDATING_TO_USE_LOCAL_RESOURCE_SETTING | USE_LOCAL_RESOURCE_SETTING); the array is paginated and carries NextToken.

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

Route 53 is available in both GovCloud (US) Regions and the GovCloud difference page documents no carve-out for Resolver DNSSEC validation; it does record that Route 53 Resolver delegation is unavailable for private hosted zones, which is a different feature. The Route 53 control plane for GovCloud is in GovCloud (US-West). VPC ARNs use partition arn:aws-us-gov.

## Notes

Rated partial for a reason that is in AWS's own words rather than in our judgement of the control: ListResolverDnssecConfigs returns one element per DNSSEC validation configuration associated with the account and "doesn't contain disabled DNSSEC configurations for the resource". A VPC with validation off is therefore ABSENT from the array, not reported as DISABLED — so a check of the form "every returned entry is ENABLED" is vacuously true on an account that has enabled validation nowhere. That is the exact shape of a check that passes while proving nothing, so it is not written as an assertion.

The decidable question is a set comparison: every VpcId from describe-vpcs must appear as a ResourceId in ResolverDnssecConfigs with ValidationStatus ENABLED. That spans two collections, and the assertion vocabulary compares a field against a constant rather than one command's output against another's, so the completeness half is a human read. The telemetry is real and specific; what it cannot do by itself is prove coverage.

Two further limits worth attaching to the evidence. Validation is applied by the VPC Resolver when it performs recursive resolution, so if the VPC forwards to another resolver, that resolver is the one doing recursion and must validate — the AWS status says nothing about it. And the VPC Resolver ignores the DO and CD bits and does not set AD or return DNSSEC records, so a workload cannot perform its own validation downstream of it; where a system owes that, the artifact is the resolver it runs instead.

## References

- {"title":"ListResolverDnssecConfigs API — \"It doesn't contain disabled DNSSEC configurations for the resource\"; paginated with NextToken","url":"https://docs.aws.amazon.com/Route53/latest/APIReference/API_route53resolver_ListResolverDnssecConfigs.html"}
- {"title":"AWS CLI: route53resolver get-resolver-dnssec-config (ResolverDNSSECConfig fields and the ValidationStatus value set)","url":"https://docs.aws.amazon.com/cli/latest/reference/route53resolver/get-resolver-dnssec-config.html"}
- {"title":"Enabling DNSSEC validation in Amazon Route 53 (applied by the VPC Resolver during recursion; a forwarding resolver must validate itself; the VPC Resolver ignores DO/CD and does not set AD)","url":"https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-dnssec-validation.html"}
- {"title":"Amazon Route 53 in AWS GovCloud (US) — Region availability and documented differences","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-r53.html"}