Lesson 163 · AWS Learning Path

AWS 163: Route 53 hosted zones and DNS records

Anil Jalela · Published Dec 5, 2025 · 9 min read

Why this lesson matters

Understand public and private hosted zones, authoritative delegation, record types, alias records, TTL, split-horizon names, and safe DNS changes.

DNS translates names into records through delegation and caching. Route 53 can be registrar, authoritative DNS and VPC recursive resolver, but these are separate functions. A record marked INSYNC only proves propagation to Route 53 authoritative servers; clients can still use cached old data, wrong delegation or a private view.

What you will be able to do

By the end, you can:

• explain route 53 hosted zones and dns records in plain language;
• locate the current service controls in the AWS Management Console;
• run the matching CloudShell or AWS CLI queries and explain every important field;
• draw the identity, network, data, failure, and monitoring path;
• choose the service from requirements and reject it when those requirements are absent;
• diagnose a failed or misleading result from evidence;
• state the cost owner and prove cleanup or a no-create result.

Before you start

• Use a personal AWS account only when its owner has approved the lesson. Do not use the root user for daily work.
• CloudShell is the default command environment. AWS028 explains CloudShell; AWS029 and AWS030 explain local AWS CLI installation and profiles.
• The course example Region is ap-south-1. Global services and services with a required control Region are called out in their commands.
• Run aws sts get-caller-identity privately. Redact the account number before sharing evidence.
• Never paste access keys, passwords, secret values, private object data, presigned URLs, or full account-specific ARNs into a submission.
• This is a no-create lesson. Every Console action and AWS CLI command is read-only. Create the practical artifact locally.
• Console wording can change. Use the Console service search if a menu label has moved, then confirm the current field in the official documentation.

The core model

How the request flows

+----------------------------------+
|  Registered name and delegation  |
+----------------------------------+
                 |
                 v
+----------------------+
|  Hosted zone record  |
+----------------------+
           |
           v
+--------------------------------+
|  Recursive resolver and cache  |
+--------------------------------+
                |
                v
+------------------------------------------+
|  Client answer and service reachability  |
+------------------------------------------+

For Amazon Route 53 hosted zones and records, the important boundary is this: The learner must identify the account and Region scope, resource boundary, identity path, data or network path, failure behavior, observability, and cleanup ownership for Amazon Route 53 hosted zones and records. Success means the Console fields, CLI result, workload behavior, monitoring evidence, and architecture claim agree. An available state alone is not enough for Amazon Route 53 hosted zones and records. That is why the lesson pairs the Console with CLI output and a practical artifact. One interface may hide a field, use a cached view, or be scoped differently. Matching evidence is stronger than a screenshot alone.

Architecture decision table

Resolution and delegation path

For public app.example.com, a stub resolver asks a recursive resolver, which follows root → .com → example.com NS delegation → authoritative answer, then caches it for TTL. The registrar publishes parent NS/DS delegation; the hosted zone contains the authoritative record sets. Creating a second hosted zone with the same name does nothing until parent delegation points at its exact Route 53 name servers. Do not replace zone NS values with those from another zone.

A private hosted zone answers only through associated VPC Resolver contexts and authorized associations. Public and private zones with the same name create split-view DNS: VPC clients use the most specific associated private zone and do not automatically fall back to public records missing there. Resolver rules and private-zone specificity determine hybrid answers. Test from each client network, not only CloudShell.

Record semantics

• A/AAAA return IPv4/IPv6; dual-stack clients may behave differently.
• CNAME aliases one name to another but cannot normally exist at a zone apex and cannot coexist with other data at that owner name.
• Route 53 alias records are provider-side pointers to supported AWS resources/records, work at apex where supported, expose evaluate-target-health options and do not behave exactly like CNAME lookup chains.
• MX priority routes mail; target values must be hostnames, with their own address records. TXT carries SPF/domain validation and must preserve quoting/chunk concatenation. CAA restricts certificate-authority issuance. SRV and NAPTR support service discovery/telephony use cases.
• NS delegates a child zone; SOA contains zone metadata and negative-caching fields. PTR reverse DNS lives under reverse zones and public address workflows may involve the IP owner.

TTL controls resolver cache duration, not authoritative-change deployment time or application connection lifetime. Lower it at least one old-TTL interval before a planned cutover, wait, change the answer, validate globally, then restore a sane TTL. Negative answers can also cache. Some resolvers cap/override TTL; browsers and applications can retain connections or their own caches.

Route 53 change batches are transactional for the submitted record changes and return a change ID moving from PENDING to INSYNC. Use UPSERT only with an exported expected state; accidental duplicate/wrong-zone records are easy. Infrastructure as code, peer review, IAM conditions, CloudTrail and Route 53 query logging/Resolver logs provide governance. Hosted-zone DNSSEC signs public authoritative answers and requires correct parent DS sequencing; an incorrect DS can make the entire zone bogus for validating resolvers. DNSSEC authenticates DNS data, not HTTPS content, and does not encrypt queries.

AWS Management Console, step by step

Sign in with the normal non-root learning identity. Write the expected starting state before opening the service.

1. Use the Console service search and open Route 53, Hosted zones; confirm the account and Region before reading the page.
2. Inspect the supplied or owned resource's status, configuration, permissions, networking, encryption, monitoring, tags, and dependencies without changing it.
3. Open the related metrics, logs, events, or history view and record one timestamped signal that would prove or disprove the expected behavior.
4. Return to the resource list, clear filters, and record the final inventory. On the read-only track, do not choose Create, Save, or Delete.

CloudShell and AWS CLI, step by step

Start with a known caller and Region:

export AWS_DEFAULT_REGION="ap-south-1"
aws sts get-caller-identity --query Arn --output text
aws configure list

Redact the account part of the ARN in shared evidence. Now run the topic queries:

aws route53 list-hosted-zones --query 'HostedZones[].{Name:Name,Id:Id,Private:Config.PrivateZone,Records:ResourceRecordSetCount}' --output table
aws route53 list-resource-record-sets --hosted-zone-id replace-with-zone-id --query 'ResourceRecordSets[].{Name:Name,Type:Type,TTL:TTL,Alias:AliasTarget.DNSName}' --output table

Expected interpretation

A record set proves intended authoritative data in that zone. Resolver cache, delegation, DNSSEC, private-zone association, and application reachability need separate evidence.

Practical work

Create a DNS sheet for app.example.invalid, API, mail, and internal database names. Choose record type, zone, alias or value, TTL, owner, validation query, rollback value, and change window.

Add current/desired record JSON, delegation NS/DS, public/private answer matrix, IPv4/IPv6, negative cache and resolver locations. Test trailing-dot/name mistakes, duplicate hosted zone, stale TTL, apex CNAME rejection, CNAME conflict, missing private record under split DNS, DNSSEC bad-delegation rollback and mail MX/TXT/CAA integrity. Use .invalid only for offline design; never claim public resolution.

Diagnose this topic from its own evidence

Use dig +trace for public delegation, dig @authoritative NS-host name type for authoritative data and normal dig from each client for recursive/cache behavior. NXDOMAIN means name does not exist; NODATA means name exists but requested type does not; SERVFAIL often indicates DNSSEC/delegation/upstream failure; timeout indicates resolver/network. Compare zone ID, trailing dot, record type, TTL, resolver and VPC association before editing. Flush only a controlled local cache; you cannot purge every recursive resolver.

Cost and cleanup

Hosted zones, health checks, Resolver endpoints, query logging, and some traffic policies can charge even when DNS records look small.

Knowledge check

1. What operational purpose is this lesson solving?

Expected direction: Understand public and private hosted zones, authoritative delegation, record types, alias records, TTL, split-horizon names, and safe DNS changes.

1. Which scope or ownership boundary must be proved first?

Expected direction: The learner must identify the account and Region scope, resource boundary, identity path, data or network path, failure behavior, observability, and cleanup ownership for Amazon Route 53 hosted zones and records.

1. What evidence is strong enough to accept the result?

Expected direction: Success means the Console fields, CLI result, workload behavior, monitoring evidence, and architecture claim agree. An available state alone is not enough for Amazon Route 53 hosted zones and records.

1. Which tempting design or shortcut must be rejected?

Expected direction: Avoid editing delegation and application records together without rollback or using a private zone as a network access control.

1. Which cost dimensions and retained resources need an owner?

Expected direction: Hosted zones, health checks, Resolver endpoints, query logging, and some traffic policies can charge even when DNS records look small.

Lesson acceptance

Pass when the learner traces delegation/recursion/authority/cache, distinguishes public/private split view, correctly uses major record and alias types, plans TTL/negative cache/cutover/rollback and explains DNSSEC sequencing. Fail if hosted-zone creation equals delegation, INSYNC equals worldwide client update, private zones fall back automatically, or DNSSEC is called encryption.

Official sources

• Route 53 hosted zones
• Supported record types
• Route 53 Developer Guide
• CloudFront Developer Guide