Route 53
Route 53 is AWS's DNS: hosted zones, records, and routing policies that make DNS part of your availability strategy. Watch a health-checked failover move users between regions, and learn why TTLs decide how fast it happens.
🎯 What you'll learn
- Hosted zones, records and alias records
- Routing policies: simple, weighted, latency, failover, geo
- Health checks and DNS failover
- TTLs, migrations and the Resolver for hybrid DNS
📚 Before you start
1What Route 53 Does
Amazon Route 53 is AWS's DNS service (networking-web/http/07-dns): domain registration, authoritative DNS hosting (hosted zones), health checks, and traffic routing policies (latency, weighted, failover, geolocation…). It's one of the few AWS services with a 100% availability SLA, served from a global anycast network.
2Hosted Zones and Records
- Public hosted zone — answers queries from the internet for
petpal.io. - Private hosted zone — answers only inside associated VPCs (
db.internal.petpal.io→ private IP); can share the same name as a public zone (split-horizon). - Delegation: the registrar's NS records for the domain must point to the hosted zone's four name servers; subdomains can be delegated to separate zones (e.g.
dev.petpal.ioowned by the dev account).
| Record | Use |
|---|---|
A / AAAA | name → IPv4 / IPv6 |
CNAME | name → another name (not allowed at the zone apex) |
| Alias (Route 53 extension) | name → AWS resource (ALB, CloudFront, S3 website, API Gateway, another record); works at the apex (petpal.io), free queries, follows the target's IP changes |
MX, TXT (SPF/DKIM/DMARC, domain verification), CAA (which CAs may issue certs), NS, SRV | mail, verification, policy, delegation |
3Routing Policies
| Policy | Behaviour | Use for |
|---|---|---|
| simple | one answer (or several values, random order) | single resource |
| weighted | split by weights (e.g. 90/10) | canaries, blue/green between stacks |
| latency-based | answer with the region with lowest measured latency to the resolver | multi-region active-active |
| failover | primary while healthy, else secondary | active-passive DR |
| geolocation | by continent/country/state of the resolver | content localization, data residency, licensing |
| geoproximity | by distance with bias (via traffic flow) | shifting load between regions |
| multivalue answer | up to 8 healthy random records | simple client-side load spreading |
| IP-based | by client CIDR | routing specific networks |
Policies can be nested (traffic policies): latency between regions, then weighted inside each region.
4Health Checks and Failover
Route 53 health checkers in many locations probe an endpoint (HTTP/HTTPS/TCP, optional string match) every 10 or 30 s; an endpoint is unhealthy when enough checkers fail. Health checks can also be calculated (combine others) or based on a CloudWatch alarm (useful for private resources). Records with health checks are removed from answers when unhealthy; failover records switch to the secondary. Alias records can evaluate target health (e.g. an ALB with no healthy targets).
5TTLs and Changes
- TTL controls how long resolvers cache answers. Before a migration, lower the TTL (e.g. to 60 s) a full old-TTL period in advance; raise it again after.
- Alias records use the target's TTL (60 s for ALBs/CloudFront).
- DNS failover is only as fast as health check detection + TTL + client caching — typically 1–3 minutes; some clients (JVMs, long-lived connections) cache longer (
system-design/system-design/08-service_discovery).
6Resolver and Hybrid DNS
Route 53 Resolver answers DNS inside VPCs (the .2 address). Inbound endpoints let on-premises networks resolve private hosted zones; outbound endpoints + forwarding rules let VPCs resolve on-prem domains. Resolver DNS Firewall blocks queries to malicious domains (data exfiltration over DNS).
Under the HoodHow Latency-Based Routing Decides▾
Route 53 doesn't measure latency to each end user at query time. AWS continuously measures network latency between resolver networks (the recursive DNS servers clients use, identified by their IP — or the client subnet if the resolver sends EDNS Client Subnet) and each AWS region, building a latency map. When a query arrives at one of Route 53's anycast name servers, it looks up the resolver's network in that map, filters out records whose health checks are failing, and answers with the record for the lowest-latency region. Two consequences: users of a far-away public resolver (without ECS support) may be routed by the resolver's location rather than their own; and the answer is cached by that resolver for the TTL, so a regional failure is reflected only after health checks fail and caches expire.
⚠️ Common Pitfalls
- CNAME at the apex — not allowed; use an alias record.
- Changing records with a long TTL without lowering it first.
- Failover without health checks (or health checks on a trivial endpoint that stays green while the app is broken).
- Forgetting NS delegation after creating a hosted zone — nothing resolves.
- Dangling records pointing to deleted resources (S3 website, CloudFront) — subdomain takeover risk.
- No
CAA/ SPF / DMARC records — certificate mis-issuance and email spoofing.
📋 Quick Reference
public vs private hosted zones · delegate NS · alias (apex, AWS targets) vs CNAME
policies: simple · weighted · latency · failover · geolocation · geoproximity · multivalue · IP-based
health checks (HTTP/TCP/calculated/CloudWatch) + evaluate target health
failover time ≈ detection + TTL + client caching · lower TTLs before migrations
Resolver endpoints for hybrid DNS · DNS Firewall🧠 Key takeaways
- Hosted zones hold records; alias records point the apex at AWS resources (free queries).
- Routing policies: weighted (canary), latency, failover, geolocation/geoproximity, multivalue.
- Health checks drive failover; failover time ≈ detection interval × threshold + TTL.
- Lower TTLs before migrations; use private hosted zones and Resolver endpoints for internal/hybrid DNS.
🎤 Interview Q&A
Q1What does Route 53 do?core▾
Managed DNS: hosted zones (public and private), domain registration, routing policies, and health checks with DNS failover.
- Alias record? Route 53-specific record pointing to AWS resources (ALB, CloudFront, S3), allowed at the zone apex and free to query.
Q2Which routing policies exist?core▾
Simple, weighted (split traffic by percentage), latency-based (nearest region), failover (primary/secondary with health checks), geolocation and geoproximity, multivalue answer, and IP-based routing.
- Use for blue/green? Weighted records shifting traffic gradually.
Q3How do health checks drive DNS failover?senior▾
Route 53 health checkers probe endpoints from multiple locations; when the primary fails, failover records answer with the secondary. Effectiveness depends on TTLs and client caching.
- Private resources? Health checks can use CloudWatch alarms instead of direct probes.
Q4What are private hosted zones?core▾
DNS zones resolvable only inside associated VPCs, e.g. db.internal, enabling internal service names without exposing them publicly. Resolver endpoints connect to on-prem DNS.
- Split-horizon DNS? Same name resolving differently inside and outside the VPC.
Q5How do you migrate DNS to Route 53 safely?core▾
Lower TTLs at the old provider in advance, recreate records in Route 53, verify with dig @route53-ns, switch NS records at the registrar, monitor, then raise TTLs.
- Why lower TTLs early? Caches must expire before the cutover.
🛠️ Practice exercises
Each exercise is a file in this topic folder. Code exercises are self-checking: run them and make the checks pass.
✅ Check yourself
Answer the questions — feedback is instant.