Route 53 and DNS
Amazon Route 53 is AWS’s DNS service. It registers domain names, hosts public and private zones, answers queries, and runs health checks. The name is a reference to port 53, on which DNS operates.
This section covers:
- Routing policies — the eight ways Route 53 can decide which answer to return, and when each applies.
- Cross-account Route 53 — delegating a subdomain to a hosted zone in another AWS account.
- Cross-account private hosted zones — associating a VPC in one account with a private hosted zone in another.
- Cross-Region failover — Route 53 or Global Accelerator, and the other AWS mechanisms involved.
How a name is resolved
Section titled “How a name is resolved”Every top-level domain is listed in the root zone database at iana.org/domains/root/db.
A domain registrar — AWS, and many others — registers a name under one or more top-level domains. Registrations go through registries accredited by ICANN, which enforces uniqueness, and the registration details are published in WHOIS.
Resolving example.com works down the hierarchy:
- The client asks a recursive resolver for the A record of
example.com. - The resolver asks a root name server, which replies with the name servers for
.com. - The resolver asks a
.comTLD name server, which replies with the NS records forexample.com. - The resolver asks one of those authoritative name servers, which returns the A record.
- The resolver returns the answer to the client and caches it for the record’s TTL.
The TLD servers hold NS records pointing at the authoritative servers for each domain; the authoritative servers hold the records themselves.
Record types
Section titled “Record types”SOA (Start of Authority). Administrative information about the zone: the primary name server, the zone administrator’s address, a serial number that increments on change, refresh and retry timers, and the default TTL. Every hosted zone has exactly one, created with the zone.
NS (Name Server). Names the authoritative servers for a zone. Every hosted zone has an NS record set, created with the zone. The same record type, placed in a parent zone, delegates a subdomain to a different set of name servers — which is how cross-account delegation works.
A. Maps a name to an IPv4 address. AAAA does the same for IPv6.
CNAME. Maps one name to another name. mobile.example.com can be a CNAME for m.example.com, so both resolve wherever m.example.com points.
A CNAME cannot be used at a zone apex — the bare domain. example.com cannot be a CNAME, because the apex must also hold SOA and NS records, and a CNAME cannot coexist with other records for the same name.
Alias. A Route 53 extension that behaves like a CNAME but is resolved inside Route 53 rather than returned to the client. It maps a name to an AWS resource — an ELB load balancer, a CloudFront distribution, an S3 website endpoint, an API Gateway endpoint or another record in the same hosted zone.
Two reasons to prefer an alias record:
- It works at the zone apex, so
example.comcan point at a load balancer. - Route 53 does not charge for queries answered by an alias to an AWS resource.
MX names mail servers, TXT carries arbitrary text (SPF, DKIM and domain verification), and PTR maps addresses back to names.
The time-to-live on a record controls how long resolvers and clients cache it, and therefore how quickly a change takes effect.
The usual practice before a planned change — a migration, a cutover — is to lower the TTL well in advance, from hours to a few minutes, make the change, confirm it, then raise the TTL again. Lowering the TTL at the moment of the change achieves nothing, because resolvers are still holding the old record with the old TTL.
Alias records to AWS resources do not have a TTL you set; Route 53 uses the target’s own.