Factory instances resolve a name in their private hosted zone to the wrong address. A Resolver forwarding rule for that same domain sends queries to the plant, and the private zone is associated with the VPC. Why does the private record lose?
Select an answer to reveal the explanation.
Short Explanation
You posted two signs for the same street, and the forwarder is the one drivers are told to obey. When a Resolver forwarding rule and a private hosted zone cover the same domain on the same VPC, the forwarding rule wins and the private record is never used. Turning DNS hostnames off is a different outage, not this precedence.
Full Explanation
Route 53 Resolver gives a forwarding rule precedence over a private hosted zone when both match the same domain name on the VPC. Queries leave for the plant resolvers, so the record in the private zone is not the answer the instances receive, even though the zone is associated correctly. The private zone does not win that tie. This is the documented order, not a race the zone wins by being associated. DNS hostnames and DNS resolution must be enabled for the VPC to use its Resolver normally, but they are not the switch that chooses a forwarding rule over a private zone. The plant is not a fallback after a correct private answer. The rule prevents the private zone from answering that name. Caveat: a more specific name still beats a broader one, so a private zone for a child name can answer when the forwarding rule covers only the parent. Operational check: disassociate or narrow the forwarding rule, resolve the name from an instance, and confirm the address now matches the private record.