AWS Route 53 DNS Setup Guide: Hosted Zones, Records, and Troubleshooting

Amazon Route 53 is a globally distributed, highly available Domain Name System (DNS) cloud service designed to route end-user requests to internet applications. Backed by an Anycast network topology across hundreds of AWS edge locations worldwide, Route 53 offers a 100% SLA availability commitment, making it the industry standard for enterprise cloud deployments running on AWS or hybrid infrastructure.

The Architectural Purpose of Four-TLD Nameserver Diversification

When you create a hosted zone in Route 53, AWS allocates a delegation set composed of four authoritative nameservers across four completely independent Top-Level Domains:

• ns-xxxx.awsdns-xx.com (Verisign .com registry)
• ns-xxxx.awsdns-xx.net (Verisign .net registry)
• ns-xxxx.awsdns-xx.org (PIR .org registry)
• ns-xxxx.awsdns-xx.co.uk (Nominet .co.uk registry)

This 4-TLD architecture ensures absolute operational resilience. Even if an entire global TLD registry experiences a catastrophic outage or BGP routing collapse, recursive resolvers will fall back to nameservers in the remaining three TLDs, guaranteeing continuous name resolution.

Step 1: Create a Public Hosted Zone

A hosted zone functions as a container for all DNS resource records governing a domain name. In Route 53, you can create hosted zones using the AWS Management Console or the AWS CLI:

aws route53 create-hosted-zone \
    --name "example.com" \
    --caller-reference "$(date +%s)" \
    --hosted-zone-config Comment="Production public zone",PrivateZone=false

Upon creation, Route 53 automatically provisions two foundational records:

• Start of Authority (SOA) Record: Defines the primary nameserver, administrator email contact (hostmaster.root), and zone timers (refresh, retry, expire, and minimum negative caching TTL).
• Name Server (NS) Record: Lists the four assigned authoritative nameservers that form your unique delegation set.

Step 2: Update Registrar Delegation and Avoid the Trailing Dot Trap

If your domain was purchased through an external registrar (e.g., GoDaddy, Namecheap, Google Domains), log into that registrar and replace their default nameservers with the four Route 53 nameserver hostnames.

Step 3: Mastering Route 53 Alias Records

One of Route 53's most powerful enterprise features is Alias records. Under RFC 1912 Section 2.4, a standard CNAME record cannot coexist with other records at the zone apex (example.com). If you host a website on an AWS Application Load Balancer (ALB), CloudFront CDN distribution, or Amazon S3 website bucket, AWS does not allocate a static IP address; it provides a dynamic DNS hostname (e.g., d111111abcdef8.cloudfront.net).

In Route 53, an Alias record acts as a virtual pointer. When a recursive resolver queries example.com, Route 53 recognizes that the record aliases an AWS resource, looks up the current underlying IP address of that resource internally, and responds directly with standard A or AAAA records. This satisfies RFC apex rules while delivering three major benefits:

• Root Apex Mapping: You can point your apex domain (example.com) directly to dynamic AWS resources.
• Zero Query Latency Overhead: Resolvers receive direct A records without performing extra CNAME chasing hops.
• Zero Query Billing: Route 53 does not bill for DNS queries targeting AWS Alias resources (ALB, CloudFront, S3).

Step 4: Route 53 Routing Policies Overview

Route 53 supports advanced routing policies that extend beyond basic round-robin DNS:

• Weighted Routing: Distribute traffic across multiple resources based on assigned percentage weights, ideal for canary deployments and A/B testing.
• Latency-Based Routing: Route global users to the AWS region that provides the lowest network latency.
• Failover Routing: Pair with Route 53 Health Checks to automatically redirect traffic to a backup disaster recovery site when the primary endpoint fails.
• Geolocation / Geoproximity Routing: Direct traffic based on the geographic location of the querying resolver.

Step 5: Enabling DNSSEC in AWS Route 53 with AWS KMS

DNSSEC protects your domain against DNS spoofing and cache poisoning attacks by cryptographically signing DNS responses. In Route 53, enabling DNSSEC is an integrated workflow:

1. 1

   1. Create a Customer Managed Key in KMS

   Create an asymmetric KMS key in the us-east-1 (N. Virginia) region with key usage set to SIGN_VERIFY and key spec ECC_NIST_P256.

2. 2

   2. Enable DNSSEC Signing in Route 53

   In the Route 53 hosted zone settings, choose DNSSEC signing > Enable DNSSEC, and attach the KMS Key Signing Key (KSK).

3. 3

   3. Publish DS Record at Your Registrar

   Route 53 outputs the Delegation Signer (DS) record parameters: Key Tag, Algorithm (typically 13 for ECDSAP256SHA256), Digest Type (SHA-256), and Digest. Copy these values to your domain registrar's DNSSEC interface.

Step 6: Split-View DNS and Route 53 Resolver Endpoints

In enterprise hybrid architectures, organizations often maintain both public web presence and private internal microservices under the same domain name. Route 53 supports Split-View (split-horizon) DNS by associating a Private Hosted Zone with specific Amazon VPCs.

To bridge resolution between AWS VPCs and on-premises Active Directory corporate datacenters, deploy Route 53 Resolver Endpoints:

• Inbound Resolver Endpoints: Provide dedicated IP addresses inside your VPC subnets. On-premises DNS servers can forward queries for cloud resources (e.g., *.aws.internal) directly to Route 53.
• Outbound Resolver Endpoints: Forward conditional DNS queries originating from EC2 instances or container workloads out to on-premises DNS servers over AWS Direct Connect or VPN.

Check your result and continue troubleshooting

Use the dns lookup tool to inspect the public DNS data relevant to this guide. Record the hostname, query type, resolver and time so you can compare results after a change. This is a DNS check, not a guarantee of worldwide propagation or successful application delivery.

For the underlying behavior and current configuration guidance, consult the official reference. Provider dashboards can change; use the values shown for your own domain rather than copying an example into production.