Amazon Route 53

1. What DNS is

DNS stands for Domain Name System. Its job is to translate human-friendly hostnames into the machine IP addresses that traffic actually uses — www.google.com becomes 172.217.18.36. It is the backbone of the internet, and it uses a hierarchical naming structure: .com sits above example.com, which sits above www.example.com and api.example.com.

Terminology

Take the URL http://api.www.example.com. and break it apart:

Term	Meaning
Domain Registrar	Where you register a domain name — Amazon Route 53, GoDaddy and others
DNS Records	The entries themselves: A, AAAA, CNAME, NS and more
Zone File	The file that contains the DNS records
Name Server	The server that resolves DNS queries; authoritative or non-authoritative
Top Level Domain (TLD)	.com, .us, .in, .gov, .org
Second Level Domain (SLD)	amazon.com, google.com
Sub Domain	The www (and api) portion in front of the SLD
FQDN	The Fully Qualified Domain Name — everything from the subdomain down to the root
Protocol	The http:// part; combined with the FQDN it forms the URL
Root	The trailing dot at the end of a fully qualified name

How a lookup actually runs

The resolution walks down the hierarchy, and each step is managed by a different party:

1. Your web browser asks the local DNS server for example.com. That server is assigned and managed by your company, or handed to you dynamically by your ISP.
2. The local DNS server asks a root DNS server, managed by ICANN. It answers with the name server for .com — .com NS 1.2.3.4.
3. It then asks the TLD DNS server for .com, managed by IANA, a branch of ICANN, which answers example.com NS 5.6.7.8.
4. Finally it asks the SLD DNS server for example.com, managed by the domain registrar (for instance Amazon Registrar, Inc.), which answers with the actual address: example.com IP 9.10.11.12.
5. The browser connects to the web server at 9.10.11.12.

Answers are cached according to their TTL at the local DNS server and at the client, which is why a record change is not visible everywhere at once.

2. Amazon Route 53

Route 53 is a highly available, scalable, fully managed and authoritative DNS. Authoritative here means the customer — you — can update the DNS records, and those records are the definitive answer for your domain.

• Route 53 is also a domain registrar.
• It can check the health of your resources.
• It is the only AWS service with a 100% availability SLA.
• The name is a reference to port 53, the traditional DNS port.

Exam tip

Two facts get asked directly: Route 53 is the only AWS service offering a 100% availability SLA, and it is both an authoritative DNS service and a domain registrar — two roles that are otherwise independent, as section 9 explains.

3. Route 53 records

A record tells Route 53 how you want traffic routed for a domain. Each record contains:

• The domain or subdomain name — for example example.com.
• The record type — for example A or AAAA.
• The value — for example 12.34.56.78.
• The routing policy — how Route 53 responds to queries for this name.
• The TTL — how long DNS resolvers cache the record.

Route 53 supports these record types. The four you must know: A / AAAA / CNAME / NS. The advanced ones it also supports: CAA, DS, MX, NAPTR, PTR, SOA, TXT, SPF, SRV.

Type	What it does
A	Maps a hostname to an IPv4 address
AAAA	Maps a hostname to an IPv6 address
CNAME	Maps a hostname to another hostname. The target must itself have an A or AAAA record. You cannot create a CNAME for the top node of a DNS namespace (the Zone Apex) — not for example.com, but yes for www.example.com
NS	The name servers for the hosted zone; they control how traffic is routed for the domain

4. Hosted zones

A hosted zone is a container for the records that define how to route traffic to a domain and its subdomains.

• Public hosted zones hold records that say how to route traffic on the internet, for public domain names such as application1.mypublicdomain.com. A client on the internet asks for example.com and gets back a public address like 54.22.33.44, which may belong to an EC2 instance with a public IP, an Application Load Balancer, an S3 bucket or a CloudFront distribution.
• Private hosted zones hold records that say how to route traffic within one or more VPCs, for private domain names such as application1.company.internal. Inside the VPC, api.example.internal resolves to a private IP like 10.0.0.10 and db.example.internal to 10.0.0.35. Those names mean nothing from outside.

You pay $0.50 per month per hosted zone.

Real-world example

A three-tier application uses both at once. The public hosted zone maps example.com to the ALB so users can reach the site. The private hosted zone gives the internal components friendly names — webapp.example.internal, api.example.internal, db.example.internal — so the application never hardcodes private IPs, and none of those names are resolvable from the internet.

5. Record TTL

The TTL (Time To Live) tells the client how long to cache the answer. When a client asks for myapp.example.com, Route 53 answers with the A record and its TTL, and the client reuses that answer for that long without asking again.

• High TTL — for example 24 hours: less traffic on Route 53, but records can be outdated for a long time after you change them.
• Low TTL — for example 60 seconds: more traffic on Route 53 (and therefore more cost), but records are stale for much less time, and changing them is easy.

Except for Alias records, TTL is mandatory on every DNS record.

Exam tip

The practical pattern: lower the TTL well in advance of a planned record change so that clients pick the new value up quickly, then raise it again afterwards. And remember the exception — you cannot set a TTL on an Alias record.

6. CNAME versus Alias

AWS resources such as load balancers and CloudFront distributions expose an AWS-generated hostname like lb1-1234.us-east-2.elb.amazonaws.com, and you want users to reach it at myapp.mydomain.com. There are two ways to bridge that, and the difference is a guaranteed exam question.

	CNAME	Alias
Points to	Any other hostname (app.mydomain.com to blabla.anything.com)	An AWS resource (app.mydomain.com to blabla.amazonaws.com)
Root domain	Non-root domains only (something.mydomain.com)	Works for root and non-root domains (mydomain.com included)
Cost	—	Free of charge
Health check	—	Native health check
Record type	CNAME	Always A / AAAA for AWS resources
TTL	You set it	You cannot set it

An Alias record is an extension to DNS functionality. It automatically recognizes changes in the resource’s IP addresses, which matters because AWS-managed resources change addresses behind the scenes — the record stays valid without you touching it. Unlike a CNAME it can be used at the Zone Apex, so example.com itself can be an Alias of type A pointing at MyALB-123456789.us-east-1.elb.amazonaws.com.

Alias record targets

• Elastic Load Balancers
• CloudFront distributions
• API Gateway
• Elastic Beanstalk environments
• S3 websites
• VPC Interface Endpoints
• Global Accelerator accelerators
• A Route 53 record in the same hosted zone

Exam tip

You cannot set an Alias record for an EC2 DNS name. That single exclusion is asked about regularly — for an EC2 instance you use an A record to its IP, or put a load balancer in front of it.

7. Routing policies

A routing policy defines how Route 53 responds to DNS queries. The word “routing” is misleading: this is not load balancer routing, and DNS does not route any traffic. It only answers queries; the client then connects to whatever address it was given.

The deck’s list names seven: Simple, Weighted, Failover, Latency-based, Geolocation, Multi-Value Answer, and Geoproximity (which requires the Route 53 Traffic Flow feature). IP-based routing is introduced later in the deck and is covered below as well.

Simple

This is the policy for pointing a name at one resource. A single record may still hold several values, and when more than one comes back it is the client that picks one, at random. With Alias turned on you are limited to a single AWS resource. Simple routing is also the one policy that cannot be tied to health checks.

Weighted

Weighted routing controls the percentage of requests that go to each resource. You assign each record a relative weight, and the share a record gets is its weight divided by the sum of all the weights for that name.

• Weights do not need to sum to 100.
• The DNS records must have the same name and the same type.
• Weighted routing can be associated with health checks.
• Use cases: load balancing between Regions, testing a new application version on a small slice of traffic.
• Assign a weight of 0 to stop sending traffic to a resource. If all records have weight 0, then all records are returned equally.

Real-world example

A canary release: give the new version weight 10 and the current version weight 90. Watch the error rate, then shift the weights. To pull the new version entirely, set its weight to 0 rather than deleting the record.

Latency-based

Routes the client to the resource with the lowest latency relative to them. It is extremely useful when user-perceived latency is the priority. Latency is measured on traffic between users and AWS Regions, not on geography, so German users may well be sent to a US Region if that turns out to be the fastest path for them. It can be associated with health checks, which gives it failover capability.

Failover (active-passive)

One record is the primary and one the secondary (disaster recovery) resource. A health check on the primary is mandatory. While the primary is healthy Route 53 answers with it; when it fails, Route 53 answers with the secondary.

Geolocation

Different from latency-based: this routes based on the user’s location, not on measured speed. You specify the location by continent, country, or US state; if several records overlap, the most precise one wins. You should create a “Default” record for queries that match no location. It can be associated with health checks. Use cases: website localisation, restricting content distribution, load balancing.

Geoproximity

Routes traffic based on the geographic location of both users and resources, with the ability to shift more traffic to a resource using a bias. The bias changes the size of the geographic region a resource serves:

• To expand it: a bias of 1 to 99 — more traffic to that resource.
• To shrink it: a bias of -1 to -99 — less traffic to that resource.

Resources can be AWS resources (you specify the AWS Region) or non-AWS resources (you specify latitude and longitude). With us-east-1 and us-west-1 both at bias 0, the country splits roughly down the middle; raising us-east-1 to bias 50 pushes the dividing line west and sends much more of the country to us-east-1. You must use Route 53 Traffic Flow to use this feature.

IP-based routing

Routing is based on the clients’ IP addresses. You supply a list of CIDR blocks for your clients and the corresponding endpoints or locations — a user-IP-to-endpoint mapping. For instance a CIDR collection defines location-1 as 203.0.113.0/24 and location-2 as 200.5.4.0/24, and the records for example.com map location-1 to 1.2.3.4 and location-2 to 5.6.7.8. Use cases: optimizing performance and reducing network costs, for example routing the end users of a particular ISP to a specific endpoint.

Multi-Value Answer

Use it when routing traffic to multiple resources. Route 53 returns multiple values, it can be associated with health checks so that only healthy resources are returned, and up to 8 healthy records are returned per query.

Exam tip

Multi-Value is not a substitute for having an ELB. A question offering Multi-Value as a replacement for a load balancer is offering the wrong answer.

8. Health checks

HTTP health checks are only for public resources. Health checks are what turn Route 53 into an automated DNS failover mechanism, and they come in three kinds:

1. Health checks that monitor an endpoint — an application, a server, another AWS resource.
2. Health checks that monitor other health checks — calculated health checks.
3. Health checks that monitor CloudWatch alarms — the option with full control, and the one that works for private resources: DynamoDB throttles, alarms on RDS, custom metrics.

Health checks are integrated with CloudWatch metrics.

Monitoring an endpoint

• Roughly 15 health checkers, spread around the world, are the ones probing the endpoint.
• It takes 3 consecutive results to flip the verdict — that is the default healthy/unhealthy threshold.
• Probes go out every 30 seconds unless you shorten the interval to 10 seconds, which costs more.
• The check speaks HTTP, HTTPS or TCP.
• The verdict is a vote: as long as over 18% of the checkers see the endpoint as healthy, Route 53 calls it healthy, and below that unhealthy.
• The locations used for the checks are yours to pick.
• Only a 2xx or 3xx response counts as a pass.
• A check can be keyed to the body as well, passing or failing on text found in its first 5120 bytes.
• Your router or firewall has to let the Route 53 health checkers in; their IP ranges are published at https://ip-ranges.amazonaws.com/ip-ranges.json.

Calculated health checks

A calculated health check rolls the verdicts of several other health checks into one result. The combination is expressed with OR, AND or NOT, a parent can watch as many as 256 child health checks, and you decide how many children have to pass before the parent does. The use the deck gives: take part of your website down for maintenance without every health check failing along with it.

Health checks and private hosted zones

Route 53’s health checkers live outside your VPC, so they cannot reach private endpoints — neither resources inside a private VPC nor on-premises resources. The workaround is indirect: create a CloudWatch metric, attach a CloudWatch alarm to it, and then create a health check that watches the alarm.

Real-world example

An active-passive setup across two Regions: an ALB with an Auto Scaling group in us-east-1 as primary and the same stack in eu-west-1 as secondary, each behind a health check, with a failover routing policy on top. Lose the primary Region and DNS starts answering with the secondary, with no human involved.

9. Domain registrar versus DNS service

You buy or register a domain name with a domain registrar, typically for an annual fee — GoDaddy, Amazon Registrar Inc. and so on. The registrar usually also gives you a DNS service to manage your records. But the two are separable: you can register the domain in one place and manage the records somewhere else.

The concrete case: purchase the domain from GoDaddy and use Route 53 to manage the DNS records. The procedure is:

1. Create a hosted zone in Route 53 for the domain.
2. Update the NS records at the third-party registrar to point at the Route 53 name servers.

From then on, the registrar handles only the registration and Route 53 answers all the queries. Domain registrar is not the same thing as DNS service — though every registrar usually ships with some DNS features.

10. Hybrid DNS and Resolver endpoints

By default, the Route 53 Resolver automatically answers DNS queries inside a VPC for:

• Local domain names of EC2 instances — for example ec2-192-0-2-44.compute-1.amazonaws.com.
• Records in private hosted zones.
• Records in public name servers.

Hybrid DNS means resolving DNS queries in both directions between the VPC (the Route 53 Resolver) and your own networks running their own DNS resolvers. Those networks can be the VPC itself or a peered VPC, or an on-premises network connected through Direct Connect or AWS VPN.

Two endpoint types make that work:

• Inbound Endpoint — lets your DNS resolvers resolve names for AWS resources. An on-premises resolver asks for app.aws.private, the query travels over the VPN or DX connection to the resolver inbound endpoint in a private subnet, and the Route 53 Resolver looks the name up in the private hosted zone.
• Outbound Endpoint — the reverse: the Route 53 Resolver forwards DNS queries to your DNS resolvers. An EC2 instance asks for web.onpremise.private, the resolver outbound endpoint forwards the query over the VPN or DX connection to the on-premises DNS resolvers, and the answer comes back.

Exam tip

Get the direction right by asking who is asking. Queries coming into AWS from on-premises need an inbound endpoint; queries going out of AWS towards on-premises need an outbound endpoint. A full hybrid setup normally has both.

Quick recap

Topic	What to remember for the exam
Route 53	Authoritative, managed DNS and a domain registrar; the only AWS service with a 100% availability SLA; named after port 53
Must-know record types	A (IPv4), AAAA (IPv6), CNAME (hostname to hostname), NS (name servers)
CNAME limit	Cannot be created at the Zone Apex — www.example.com yes, example.com no
Hosted zones	Public for internet names, private for names inside one or more VPCs; $0.50 per hosted zone per month
TTL	Mandatory on every record except Alias; high TTL means less query traffic but staler data
Alias	Points at an AWS resource, works at the root domain, free, native health check, always A/AAAA, no TTL; targets include ELB, CloudFront, API Gateway, Beanstalk, S3 websites, VPC interface endpoints, Global Accelerator, a record in the same zone — never an EC2 DNS name
Simple	One resource (or several values, client picks at random); no health checks
Weighted	Relative weights, need not sum to 100, same name and type, health checks supported; weight 0 stops traffic, all-zero returns everything equally
Latency-based	Lowest latency between the user and an AWS Region, not geography; health checks supported
Failover	Active-passive; the health check on the primary is mandatory
Geolocation	By continent / country / US state, most precise match wins; create a Default record
Geoproximity	Location plus bias 1 to 99 to expand and -1 to -99 to shrink; needs Route 53 Traffic Flow
IP-based	Maps client CIDR blocks to endpoints
Multi-Value	Returns up to 8 healthy records, health-check aware; not a replacement for an ELB
Health checks	~15 global checkers, threshold 3, interval 30 s (or 10 s for more money), HTTP/HTTPS/TCP, healthy above 18% of checkers, pass on 2xx/3xx, can match text in the first 5120 bytes
Calculated health checks	OR / AND / NOT over up to 256 child health checks
Private resources	Health checkers sit outside the VPC — use a CloudWatch alarm and a health check on the alarm
Registrar vs DNS	Separate roles; to use Route 53 with a third-party registrar, create the hosted zone and update the NS records at the registrar
Hybrid DNS	Inbound endpoint for on-premises resolvers querying AWS; outbound endpoint for AWS querying on-premises resolvers; over Direct Connect or AWS VPN