A resolver built as serverless UDP infrastructure
The reference architecture separates global packet ingress from regional policy evaluation. UDP Gateway routes each query to a nearby Lambda function, which checks replicated policy, applies domain or ASN rules, proxies allowed requests upstream, and returns the DNS response.
DNS clients → global Proxylity listener → regional filter Lambda → DNS response
DynamoDB Global Table → policy | query logs → Firehose, S3, and EventBridge analysis
Policy that goes beyond a domain list
Domain controls
Block or redirect exact names, root domains and their subdomains, or entire top-level domains.
ASN controls
Evaluate answer IP addresses against a precomputed ASN index and block or redirect responses associated with selected networks.
Optional DNS-over-HTTPS
An API Gateway and adapter Lambda expose RFC 8484 requests for browsers and clients that need DoH.
Suspicious-domain events
Optional regional logs feed asynchronous analysis for high-entropy domains, unusual subdomain activity, and repeated NXDOMAIN responses.
Global policy, regional processing and logs
A DynamoDB Global Table replicates domain and ASN policy to each deployed region. Queries are processed near arrival, while optional S3 query logs remain regional for residency and retention choices. Logging can be configured per deployment or disabled.
The filter caches policy for efficiency, so a new block or redirect can take up to the configured cache TTL to appear. The UDP listener may use a non-standard external port; clients that require port 53 need network address translation at a router or gateway. Those deployment details are explicit in the example.
Deploy, load policy, and test
The repository includes global and regional templates, deployment and teardown scripts, a blocklist loader, unit tests, UDP and DoH test paths, and configuration for allowed client networks and log retention.
View source and deployment steps →
Read the serverless DNS article →
Related use cases
Collect enterprise syslog | Build serverless CoAP APIs | Inspect UDP protocols live