1. Route 53 Overview

Amazon Route 53 is a highly available, scalable DNS web service. It performs three main functions: domain registration, DNS routing, and health checking. It is a global service with a 100% availability SLA.


Three Functions 1) Domain Registration: buy and manage domain names (example.com). 2) DNS Routing: translate domain names to IP addresses using routing policies. 3) Health Checks: monitor endpoint health and route traffic away from unhealthy resources. Route 53 is the only AWS service with a 100% availability SLA.

2. DNS Record Types

CNAME vs Alias CNAME: maps name to name. CANNOT be used on zone apex (example.com). Costs per query. Works with any DNS provider. Alias: AWS-specific. CAN be used on zone apex. FREE for AWS resource targets. Auto-detects IP changes. Supports: ELB, CloudFront, S3 website, API Gateway, Beanstalk, Global Accelerator, VPC Endpoint, another Route 53 record. Exam rule: "zone apex" or "naked domain" = use Alias, NOT CNAME.

3. Hosted Zones

  1. Private hosted zones: must be associated with one or more VPCs
  2. Cross-account: share private hosted zone with VPCs in other accounts via CLI/API (not Console)
  3. Split-view DNS: same domain name, public zone returns public IPs, private zone returns private IPs
Split-View DNS:

  Public Hosted Zone (example.com):
    app.example.com → A record → 54.1.2.3 (public ALB)

  Private Hosted Zone (example.com, associated with VPC):
    app.example.com → A record → 10.0.1.50 (internal ALB)

  Result: internet users reach public ALB.
          VPC instances reach internal ALB. Same domain name.

4. Routing Policies

Routing Policy Exam Decision Guide

5. Health Checks

  1. Health checks can trigger: Route 53 failover routing, SNS notification, CloudWatch Alarms
  2. Intervals: 30 seconds (standard, free) or 10 seconds (fast, extra charge)
  3. String matching: check if response body contains specific text (up to 5,120 bytes searched)
  4. Failover latency: ~30–60 seconds after health check detects failure + DNS TTL for clients to update

6. Route 53 Resolver

Route 53 Resolver handles DNS resolution within your VPC and enables hybrid DNS between AWS and on-premises networks.

Resolver Rules Sharing

  1. Share Resolver Rules across accounts using AWS RAM (Resource Access Manager)
  2. The central networking account creates rules and shares to all accounts in the organization
  3. Consistent DNS forwarding across all accounts without duplicate configuration

7. Route 53 DNS Firewall

  1. Filter outbound DNS queries from your VPC
  2. Domain lists: AWS managed (malware, botnet, C2 domains) or custom lists
  3. Actions: ALLOW, BLOCK (return NXDOMAIN or custom response), ALERT (log only)
  4. Associate firewall rule groups with VPCs
  5. Integration: query logs to CloudWatch Logs, S3, or Kinesis Firehose
  6. Use for: block DNS exfiltration, prevent connections to known-bad domains, and compliance
DNS Firewall Example:

  Rule Group: "SecurityBlocking"
    Rule 1: AWS Managed List (malware domains) → BLOCK
    Rule 2: AWS Managed List (botnet C2)       → BLOCK
    Rule 3: Custom List (competitor.com)        → BLOCK
    Rule 4: Custom List (*.internal.corp)       → ALLOW
    Rule 5: Default                             → ALLOW

  Associated with: VPC-Prod, VPC-Dev
  Logging: all BLOCK actions → CloudWatch Logs

8. DNSSEC

  1. DNS Security Extensions: cryptographic signing of DNS records to prevent spoofing
  2. Route 53 supports DNSSEC for public hosted zones (signing + validation)
  3. Signing: Route 53 signs your zone’s records with a KSK (Key Signing Key) stored in KMS
  4. Validation: Route 53 Resolver validates DNSSEC signatures for domains you query
  5. Protects against: DNS spoofing/cache poisoning (man-in-the-middle)
  6. Use for: high-security domains, financial services, government

9. Route 53 + Other Services

10. Advanced DNS Patterns


Weighted Alias for Blue/Green

Blue/Green DNS Shifting:

  app.example.com:
    Weighted Alias: 100% → ALB-Blue  (current production)
    Weighted Alias:   0% → ALB-Green (new version, standby)

  Cutover:
    Shift: 90% Blue, 10% Green (canary)
    Monitor errors/latency on Green
    Shift: 50/50, then 0/100
    Final: 0% Blue, 100% Green (Green is now production)

  Rollback: shift weight back to 100% Blue instantly

Complex Routing (Nested Records)

Nested / Chained Routing Policies:

  app.example.com (Failover)
    Primary → app-primary.example.com (Latency)
               └─ us-east-1: ALB-US
               └─ eu-west-1: ALB-EU
    Secondary → app-dr.example.com (Simple)
               └─ S3 static error page

  Result: users route to the nearest healthy Region.
  If ALL primary Regions fail → failover to the static DR page.
  Nesting: Failover → Latency → Alias to ALB.
Important Warning DNS TTL affects failover speed. Low TTL (60 seconds) = faster failover but more DNS queries (higher cost). High TTL (300 seconds) = slower failover but fewer queries. For DR/failover records, use low TTL (60s). For stable records, use a higher TTL (300–900s). Client-side caching may ignore TTL.
Exam Tip Route 53 Advanced: "Zone apex" = Alias (not CNAME). "Route to nearest Region" = Latency. "DR failover" = Failover policy + health checks. "A/B testing DNS" = Weighted. "EU users stay in EU" = Geolocation. "Private resources health check" = CloudWatch Alarm health check. "Hybrid DNS" = Resolver Inbound + Outbound. "Block malicious DNS" = DNS Firewall. "Prevent DNS spoofing" = DNSSEC. "Shift traffic between Regions" = Geoproximity with bias. Alias is FREE for AWS targets. 100% SLA.