Amazon Route 53

What it is

Amazon Route 53 is a HA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entry, scalable DNS (Domain Name System)The internet's directory, which translates domain names such as example.com into IP addresses that computers use to connect. Amazon Route 53 is the AWS DNS service.Glossary entry service with three main jobs:

Domain registration: register and transfer domain names.
DNS routing: answer DNS queries for your domains, with routing policies that decide which answer each user gets.
Health checking: monitor endpoints and route traffic away from unhealthy ones.

Choose Route 53 when a question involves domain names, routing users between AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry or endpoints with DNS, DNS-based FailoverSwitching automatically to a standby resource when the primary one fails, such as a standby database in Amazon RDS or a backup site chosen by Route 53 failover routing.Glossary entry, or resolving names between VPCs and On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry networks.

Hosted zones and records

Public hosted zone: records for a domain on the internet.
Private hosted zone: records visible only inside the VPCs you associate with it. The VPCs must have both DNS resolution (enableDnsSupport) and DNS hostnames (enableDnsHostnames) turned on, and instances must use the Amazon-provided DNS server.
Split-view DNS: a public and a private hosted zone with the same name. VPCs associated with the private zone get its answers, such as an internal load balancer for www.example.com; everyone else gets the public zone's answers.
Records: A, AAAA, CNAME (Canonical name record)A DNS record that makes one domain name an alias of another, such as www.example.com pointing to example.com. A CNAME cannot be used for the zone apex (example.com itself); Route 53 alias records cover that case.Glossary entry, MX, TXT, NS, and others, each with a TTL (Time to live)How long something stays valid before it expires. A DNS record or cached item can be reused until its TTL runs out, then is fetched again; in DynamoDB, a TTL attribute deletes items after a set time.Glossary entry.
Alias records are a Route 53 extension that points to AWS resources, such as CloudFront distributions, ELB load balancers, S3 website buckets, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry Gateway, or another record in the zone.
- Unlike a CNAME, an alias record works at the zone apex (for example example.com itself).
- Route 53 doesn't charge for alias queries to AWS resources, but it does charge for CNAME queries.

Record types

Type	Use it to	Example value
A	Route a name to an IPv4 address	`192.0.2.1`
AAAA	Route a name to an IPv6 address	`2001:db8:85a3::8a2e:370:7334`
CNAME	Point a name to another domain name. Not allowed at the zone apex, and no other record can share its name	`app.example.net`
MX	Name the mail servers for the domain, with a priority (the lowest number is tried first). The server must be an A or AAAA name, not a CNAME	`10 mail.example.com`
TXT	Hold text, such as SPF email sender rules or domain ownership checks. Each string is in quotes, up to 255 characters	`"v=spf1 include:example.net -all"`
NS	List the name servers for a hosted zone, or delegate a subdomain to another hosted zone. Route 53 creates the zone's own NS record	`ns-1.example.com`

Alias records are not a separate type: an alias is an A or AAAA record (matching what the target serves) with Alias turned on, and its value is an AWS resource instead of an address. For example, to send both example.com (the zone apex) and www.example.com to an Application Load Balancer:

Record name	Type	Alias	Value
`example.com`	A	Yes	The load balancer (`my-alb-1234.us-east-1.elb.amazonaws.com`)
`www.example.com`	A	Yes	The load balancer, or the `example.com` record in the same zone
`blog.example.com`	CNAME	No	`blogs.example.net` (a name outside AWS; not possible at the apex)

An alias record has no TTL setting: Route 53 uses the target's TTL, and follows the target's IP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entry addresses when they change.
dig shows an alias as a plain A or AAAA answer; only the Route 53 console or API shows that it is an alias.
In the API, an alias record has an AliasTarget (the target's DNS name and hosted zone ID, and whether to evaluate its health) instead of record values.

Routing policies

Policy	Use when
Simple	One resource serves the domain
Failover	Active-passive: send traffic to a secondary when the primary's Health checkA regular test, such as a request to a web page, that a load balancer, an Auto Scaling group, or Route 53 makes to see whether a resource is working. Unhealthy resources stop receiving traffic or are replaced.Glossary entry fails
Geolocation	Route by the user's location, such as country or continent, for localization or legal reasons. Add a default record, or queries from unmatched or unmapped locations get no answer
Geoproximity	Route by the location of your resources, and shift traffic with a bias
LatencyThe time between sending a request and receiving the response, usually measured in milliseconds. Distance and processing add to it; caching and serving users from nearby locations reduce it.Glossary entry	Send users to the Region with the lowest latency for them
IP-based	Route by the user's source IP ranges (CIDR (Classless Inter-Domain Routing)A notation for a range of IP addresses: an address, a slash, and the number of fixed leading bits, such as 10.0.0.0/16 for 65,536 addresses. VPCs and subnets are defined by CIDR blocks; the smaller the number after the slash, the larger the range.Glossary entry)
Multivalue answer	Return up to eight healthy records at random, a simple DNS-level spread
Weighted	Split traffic in proportions you choose, such as 90/10 for a canary release

Health checks and failover

Health checks monitor:
- An endpoint, by HTTP (Hypertext Transfer Protocol)The protocol that web browsers and APIs use to send requests, such as GET and POST, and receive responses. On its own it is not encrypted; HTTPS adds TLS.Glossary entry, HTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entry, or TCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entry.
- Other health checks (calculated health checks).
- CloudWatch alarms, for example for private resources that Route 53 can't reach directly.
Attach health checks to records:
- Multi-site active/activeA disaster recovery strategy that runs the full workload in two or more Regions at once, all serving traffic. It recovers fastest, with almost no downtime, and costs the most.Glossary entry failover returns only healthy records from a set (weighted, latency, multivalue, and so on).
- Active-passive failover uses the failover routing policy with a primary and a secondary.
DNS failover depends on TTLs and resolver caching. For instant failover with static IPs, consider AWS Global Accelerator.

Active-passive failover with Route 53. Users send a DNS query to a failover record. While the health check on the primary endpoint passes, the record answers with the primary endpoint; when the primary fails its health check, it answers with the secondary endpoint.

Hybrid DNS and security

Route 53 VPC Resolver (previously called Route 53 Resolver) answers DNS queries in every VPC at the VPC+2 address. It resolves VPC names, private hosted zones, and public domains.
- Inbound endpoints let on-premises networks resolve names in your VPCs.
- Outbound endpoints with forwarding rules let VPCs resolve on-premises domains, over VPN (Virtual private network)An encrypted tunnel over a public network, such as the internet, that joins networks or devices as if they were directly connected. AWS Site-to-Site VPN connects networks; AWS Client VPN connects individual users.Glossary entry or Direct Connect.
- Share forwarding rules with other accounts through AWS RAM and associate them with their VPCs, so one central outbound endpoint serves many accounts.
DNS Firewall filters outbound DNS queries from your VPCs, for example to block known malicious domains.
DNSSEC signing protects your public zones against spoofed DNS responses.

Security, resilience, performance, and cost

Security: IAM controls who can change records; use DNSSEC, DNS Firewall, and private hosted zones for internal names. CloudTrail records API calls.
Resilience: Route 53 is designed for very high availability. Combine health checks with failover or latency routing for multi-Region designs.
Performance: latency-based routing sends users to the fastest Region.
Cost: pay per hosted zone per month, per million queries (alias queries to AWS resources are free), per health check, and for domain registration.

Route 53 or another option?

If the requirement is	Choose
Point example.com at a load balancer or CloudFront	Route 53 alias record
Send users to the lowest-latency Region	Route 53 latency routing
Serve content by country	Route 53 geolocation routing
Canary release by percentage	Route 53 weighted routing
Failover to a standby site	Route 53 failover routing with health checks
On-premises servers resolve VPC names	VPC Resolver inbound endpoint
Same name resolves differently inside the VPC	Split-view DNS: private and public zones with the same name
Static IPs and instant failover	AWS Global Accelerator

Reverse mindmap: when the question points here

Is it Amazon Route 53?

Records
- example.com to an ALB or CloudFront leads to Alias record at the zone apex
- Names only inside our VPCs leads to Private hosted zone
- Private zone doesn't resolve leads to Turn on VPC DNS resolution and DNS hostnames
- Internal and public answers for one name leads to Split-view DNS
Routing policies
- Lowest latency Region leads to Latency routing
- Users in France see the French site leads to Geolocation routing
- Every location must get an answer leads to Geolocation default record
- Shift traffic toward a Region leads to Geoproximity with bias
- 10% to the new version leads to Weighted routing
- Standby site when primary fails leads to Failover routing
- Several healthy IPs returned leads to Multivalue answer
- Route by client CIDR leads to IP-based routing
Health
- Monitor a private resource leads to Health check on a CloudWatch alarm
- Combine several checks leads to Calculated health check
Hybrid DNS
- On premises resolves AWS names leads to Inbound endpoint
- VPC resolves on-premises names leads to Outbound endpoint and forwarding rule
- Many accounts use one forwarding rule leads to Share it through AWS RAM
- Block malicious domains leads to DNS Firewall
No, when the question says
- Failover without DNS caching delays leads to Global Accelerator

Key takeaways

Route 53 registers domains, hosts public and private DNS zones, and checks health.
Alias records point to AWS resources at the zone apex and their queries are free; CNAMEs can't be used at the apex.
Routing policies: simple, failover, geolocation, geoproximity, latency, IP-based, multivalue (up to eight healthy records), and weighted.
Health checks can monitor endpoints, other health checks, or CloudWatch alarms, for active-active or active-passive failover.
VPC Resolver (formerly Route 53 Resolver) inbound and outbound endpoints connect DNS between VPCs and on premises; DNS Firewall filters outbound queries.