- Network Firewall now validates that a connection's destination IP was resolved through the VPC Route 53 Resolver, extending domain‑based filtering to any protocol (e.g., SFTP, SSH).
- The validation closes gaps where clients could bypass domain rules and mitigates SNI spoofing, enabling consistent domain policies across all outbound traffic.
- Feature is available in all AWS commercial regions at no additional charge and integrates with Route 53 Resolver DNS Firewall.