Route 53 is AWS's DNS service (authoritative DNS, domain registration, health checks and traffic routing). Overview is in 5. AWS Networking; DNS fundamentals are in Network Services.

Parts at a glance

Records

TTL is how long resolvers cache an answer. Lower it before planned changes (for example to 60 s), then raise it again.

Alias vs CNAME

Use alias for anything pointing at AWS, especially the apex: example.com alias A and AAAA to CloudFront (AWS CloudFront Deep Dive).

Routing Policies

flowchart LR
    U[User] --> R[Route 53]
    R -- healthy --> P[Primary: ALB in af-south-1]
    R -. unhealthy .-> S[Secondary: S3 maintenance page via CloudFront]
    HC[Health check] --> P
    HC --> R

Failover setup

1. Create a health check on the primary (HTTPS, path /health, expect 2xx or 3xx)
2. Create the primary record: Failover Primary, attach the health check
3. Create the secondary record: Failover Secondary
4. Keep TTLs low (30 to 60 s)

Health Checks

• Checkers run from several Regions; the endpoint must allow their IP ranges
• Settings: interval (30 s standard, 10 s fast), failure threshold, latency graphs, SNS notification
• Private endpoints cannot be probed directly; use a CloudWatch alarm health check

Public and Private Hosted Zones

Split-horizon DNS: the same name in a public and a private zone returns different answers inside the VPC and outside.

Registering and Delegating Domains

• Register in Route 53 or elsewhere; a public hosted zone gets four NS records. If the domain is registered elsewhere, copy those four NS values to the registrar
• Delegate a subdomain (dev.example.com) by creating a zone for it and adding its NS records in the parent zone
• Transfers: unlock the domain, get the authorisation code, approve at both ends
• Enable auto-renew and keep contact details current

Resolver (Hybrid DNS)

Every VPC has an Amazon-provided resolver at the VPC base + 2 address (for example 10.0.0.2). Route 53 Resolver extends it:

DNSSEC

• Signs a public zone so resolvers can verify answers
• Uses a KMS key in us-east-1 (asymmetric, ECC_NIST_P256) and a DS record published at the registrar
• Do it carefully: a wrong DS record can make the domain unresolvable

Common Tasks

$ aws route53 list-hosted-zones
$ aws route53 list-resource-record-sets --hosted-zone-id Z123EXAMPLE

# change-batch.json
{
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "www.example.com",
      "Type": "A",
      "AliasTarget": {
        "HostedZoneId": "Z2FDTNDATAQYW2",
        "DNSName": "d111111abcdef8.cloudfront.net",
        "EvaluateTargetHealth": false
      }
    }
  }]
}
$ aws route53 change-resource-record-sets --hosted-zone-id Z123EXAMPLE --change-batch file://change-batch.json

Z2FDTNDATAQYW2 is the fixed hosted zone ID used for all CloudFront alias targets.

Testing DNS

$ dig www.example.com +short
$ dig NS example.com +short
$ dig @ns-123.awsdns-45.com www.example.com      # ask Route 53 directly
$ dig www.example.com +trace                      # follow delegation
$ aws route53 test-dns-answer --hosted-zone-id Z123EXAMPLE --record-name www.example.com --record-type A

Certificate validation

ACM DNS validation adds a CNAME in the zone; keep it, because ACM uses it to renew automatically.

Troubleshooting

Costs: a monthly fee per hosted zone, per-million-query charges (alias queries to AWS resources are free), health checks and domain fees.