I'm not sure how your testing, but if it is just via doing a DNS lookup, it might be this:
Amazon security groups and network ACLs don't filter traffic to or from link-local addresses (169.254.0.0/16) or AWS reserved addresses (the first four IP addresses and the last one in each subnet). These addresses support the services: Domain Name Services (DNS), Dynamic Host Configuration Protocol (DHCP), Amazon EC2 instance metadata, Key Management Server (KMS—license management for Windows instances), and routing in the subnet. You can implement additional firewall solutions in your instances to block network communication with link-local addresses.
From this I infer that DNS will continue to work in any event, and that doing a lookup from the command line should succeed. If you do so with verbose output, you should see a a local address on your subnet for the DNS server.