DNS that crosses the on-premises boundary, selectively.
Every VPC gets a built-in resolver — these two endpoint types extend it hybrid.
Inbound endpointOn-prem queries reach into AWS, resolve against a Private Hosted Zone
Outbound endpointAWS resources query on-prem DNS for domains AWS never heard of
Conditional forwarding rule"corp.internal → on-prem, everything else → AWS"
A newer delegation-endpoint pattern lets on-prem resolve a PHZ subdomain via standard NS delegation — no hand-maintained forwarding rule needed for it.