Before reviewing this article, please note that enabling Private DNS for your VPC may cause an outage, in which you will simply need to turn Private DNS off again.

For Aura Enterprise, once your AWS PrivateLink endpoint has been accepted by Aura Endpoint Service, you will need to enable your Private DNS to make sure all your database traffic is routed via this secure channel.  

Since the Private DNS is still an AWS-managed DNS domain, you also need to verify and make sure AmazonProvidedDNS is being used inside the VPC. So that after the PrivateDNS of the PrivateLink Endpoint is enabled, your whole VPC can correctly resolve the *.<orch>.neo4j.io to a VPC internal IP address.