A network engineer is designing private DNS integration for AWS workloads and on-premises systems. Five VPCs in eu-west-1 connect to on-premises via Direct Connect and communicate through a Transit Gateway. Each VPC has a private hosted zone using aws.example.internal. The engineer created a Route 53 Resolver outbound endpoint in a shared services VPC attached to the Transit Gateway. DNS queries ending with aws.example.internal must resolve using the private hosted zone; all other domains must be forwarded to the on-premises DNS resolver. Which configuration satisfies these requirements?

The correct solution is to add a forwarding rule for "." (the root domain) that targets the Route 53 Resolver outbound endpoint. This configuration ensures that all DNS queries originating from the on-premises network are forwarded to the Route 53 Resolver outbound endpoint. Route 53 Resolver then handles the resolution: queries for aws.example.internal will resolve using the associated private hosted zones, while all other queries will be forwarded to the on-premises DNS resolvers as per the Resolver's default outbound forwarding rules. Incorrect options: Adding a forwarding rule for "" targeting the on-premises DNS server and a system rule for aws.example.internal targeting Route 53 Resolver is incorrect because system rules are not a standard Route 53 Resolver construct for this purpose. Adding a forwarding rule for aws.example.internal targeting Route 53 Resolver and a system rule for "." targeting the outbound endpoint is also incorrect due to the "system rule" terminology and misapplication of forwarding. Adding a forwarding rule for "" targeting the Route 53 Resolver outbound endpoint is less precise than using "." for all domains. While "" can sometimes function similarly, "." explicitly denotes the root and is the standard practice for forwarding all unhandled queries.