An interface endpoint is reachable by its endpoint-specific DNS name, but applications using the normal regional service hostname still connect publicly. What should be checked?

1. Create a public CNAME pointing to a random private IP.
2. Associate an S3 gateway endpoint route with the service hostname.
3. Enable private DNS on the endpoint and confirm VPC DNS support and hostnames are enabled.
4. Replace the endpoint security group with an internet gateway.