# Route 53

## 1. What Route 53 Does

**Amazon Route 53** is AWS's DNS service (`networking-web/http/07-dns`): **domain registration**, **authoritative DNS hosting** (hosted zones), **health checks**, and **traffic routing policies** (latency, weighted, failover, geolocation…). It's one of the few AWS services with a 100% availability SLA, served from a global anycast network.

## 2. Hosted Zones and Records

- **Public hosted zone** — answers queries from the internet for `petpal.io`.
- **Private hosted zone** — answers only inside associated VPCs (`db.internal.petpal.io` → private IP); can share the same name as a public zone (split-horizon).
- Delegation: the registrar's NS records for the domain must point to the hosted zone's four name servers; subdomains can be delegated to separate zones (e.g. `dev.petpal.io` owned by the dev account).

| Record | Use |
|---|---|
| `A` / `AAAA` | name → IPv4 / IPv6 |
| `CNAME` | name → another name (not allowed at the zone apex) |
| **Alias** (Route 53 extension) | name → AWS resource (ALB, CloudFront, S3 website, API Gateway, another record); works at the **apex** (`petpal.io`), free queries, follows the target's IP changes |
| `MX`, `TXT` (SPF/DKIM/DMARC, domain verification), `CAA` (which CAs may issue certs), `NS`, `SRV` | mail, verification, policy, delegation |

## 3. Routing Policies

| Policy | Behaviour | Use for |
|---|---|---|
| **simple** | one answer (or several values, random order) | single resource |
| **weighted** | split by weights (e.g. 90/10) | canaries, blue/green between stacks |
| **latency-based** | answer with the region with lowest measured latency to the resolver | multi-region active-active |
| **failover** | primary while healthy, else secondary | active-passive DR |
| **geolocation** | by continent/country/state of the resolver | content localization, data residency, licensing |
| **geoproximity** | by distance with bias (via traffic flow) | shifting load between regions |
| **multivalue answer** | up to 8 healthy random records | simple client-side load spreading |
| **IP-based** | by client CIDR | routing specific networks |

Policies can be **nested** (traffic policies): latency between regions, then weighted inside each region.

## 4. Health Checks and Failover

Route 53 health checkers in many locations probe an endpoint (HTTP/HTTPS/TCP, optional string match) every 10 or 30 s; an endpoint is unhealthy when enough checkers fail. Health checks can also be **calculated** (combine others) or based on a **CloudWatch alarm** (useful for private resources). Records with health checks are removed from answers when unhealthy; failover records switch to the secondary. Alias records can **evaluate target health** (e.g. an ALB with no healthy targets).

## 5. TTLs and Changes

- TTL controls how long resolvers cache answers. Before a migration, **lower the TTL** (e.g. to 60 s) a full old-TTL period in advance; raise it again after.
- Alias records use the target's TTL (60 s for ALBs/CloudFront).
- DNS failover is only as fast as **health check detection + TTL + client caching** — typically 1–3 minutes; some clients (JVMs, long-lived connections) cache longer (`system-design/system-design/08-service_discovery`).

## 6. Resolver and Hybrid DNS

**Route 53 Resolver** answers DNS inside VPCs (the `.2` address). **Inbound endpoints** let on-premises networks resolve private hosted zones; **outbound endpoints + forwarding rules** let VPCs resolve on-prem domains. **Resolver DNS Firewall** blocks queries to malicious domains (data exfiltration over DNS).

## Under the Hood: How Latency-Based Routing Decides

Route 53 doesn't measure latency to each end user at query time. AWS continuously measures network latency between **resolver networks** (the recursive DNS servers clients use, identified by their IP — or the client subnet if the resolver sends **EDNS Client Subnet**) and each AWS region, building a latency map. When a query arrives at one of Route 53's anycast name servers, it looks up the resolver's network in that map, filters out records whose health checks are failing, and answers with the record for the lowest-latency region. Two consequences: users of a far-away public resolver (without ECS support) may be routed by the resolver's location rather than their own; and the answer is cached by that resolver for the TTL, so a regional failure is reflected only after health checks fail **and** caches expire.

![Clients query their resolver, which asks Route 53's anycast name servers; Route 53 applies routing policies such as latency, weighted or failover, removes unhealthy endpoints using health checks, and answers with alias records pointing to regional ALBs or CloudFront, cached for the TTL](diagrams/01-route53-routing.svg)

## Common Pitfalls

1. **CNAME at the apex** — not allowed; use an alias record.
2. **Changing records with a long TTL** without lowering it first.
3. **Failover without health checks** (or health checks on a trivial endpoint that stays green while the app is broken).
4. **Forgetting NS delegation** after creating a hosted zone — nothing resolves.
5. **Dangling records** pointing to deleted resources (S3 website, CloudFront) — subdomain takeover risk.
6. **No `CAA` / SPF / DMARC records** — certificate mis-issuance and email spoofing.

## Quick Reference

```
public vs private hosted zones · delegate NS · alias (apex, AWS targets) vs CNAME
policies: simple · weighted · latency · failover · geolocation · geoproximity · multivalue · IP-based
health checks (HTTP/TCP/calculated/CloudWatch) + evaluate target health
failover time ≈ detection + TTL + client caching · lower TTLs before migrations
Resolver endpoints for hybrid DNS · DNS Firewall