# Route 53 DNS Firewall’s Palo Alto Networks integration reaches GA in 32 Regions > AWS announced general availability for Palo Alto Networks Advanced DNS Security in Route 53 Resolver DNS Firewall, with cross-account license sharing and VPC deployment options. Canonical URL: https://www.devobs.io/news/news-event-26b1bcc5e85e8ae9f698b9d4/ By: Maya Chen Published: 2026-10-01T23:26:16.508Z Updated: 2026-10-01T23:26:16.508Z Event date: 2026-09-29 Section: Security AWS announced on September 29, 2026, that Palo Alto Networks Advanced DNS Security support in Amazon Route 53 Resolver DNS Firewall is generally available in **32 AWS Regions**, covering every Region where DNS Firewall is offered. According to the [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/09/route-53-dns-firewall-panw-dns-security-generally-available), the integration lets security teams detect and block malicious DNS traffic from their VPCs using Palo Alto Networks rules without deploying separate firewalls or modifying VPC configurations. ## What the integration protects AWS says the feature, previously previewed at AWS Summit New York City, supports inspection and blocking of DNS queries from Amazon VPCs and hybrid-cloud environments through Route 53 Resolver Endpoints. Listed threat categories include command and control, malware, phishing and newly registered domains. The announced protections focus on DNS queries. For hybrid deployments, teams should map which workloads send DNS queries through the relevant Resolver Endpoints before counting those workloads as covered. They should also test rule behavior against legitimate application dependencies before a broad rollout. ## Licensing and VPC deployment are separate checks Customers can subscribe to and enable the feature through the Route 53 DNS Firewall console. [AWS lists two sets of rollout controls](https://aws.amazon.com/about-aws/whats-new/2026/09/route-53-dns-firewall-panw-dns-security-generally-available): - **License sharing:** AWS License Manager can share licenses across organization accounts. - **VPC deployment:** AWS Resource Access Manager, Route 53 Profiles or AWS Firewall Manager can associate DNS Firewall rule groups containing Palo Alto Networks rules with VPCs. For engineering teams, the practical takeaway is to track license sharing and VPC rule-group associations separately. Subscription access should not serve as a proxy for deployment coverage: verify that the intended VPCs have the relevant rule groups associated. ## Check both pricing resources The [release notice](https://aws.amazon.com/about-aws/whats-new/2026/09/route-53-dns-firewall-panw-dns-security-generally-available) directs customers to Route 53 pricing and the Palo Alto Networks Advanced DNS Security AWS Marketplace listing, but does not quote rates. Review both resources before estimating rollout costs; general availability alone does not establish what is included in an existing subscription. ## Source references -