Hosted Zones and DNS Record Types

Amazon Route 53 is AWS's highly available and scalable Domain Name System (DNS) service. It translates human-readable domain names (like api.example.com) into IP addresses that computers use to connect. Route 53 also provides domain registration, health checks, and sophisticated traffic routing policies.

Route 53 is designed to be 100% available (backed by an SLA of 100% uptime) and is distributed across AWS edge locations worldwide, giving it sub-10ms query response times globally.

A public hosted zone is a container for DNS records that define how internet traffic is routed for a domain. When you register a domain or transfer one to Route 53, a public hosted zone is created automatically. You can also create a hosted zone for a domain registered elsewhere and point the domain's name servers to Route 53.

Each hosted zone costs a small monthly fee plus per-query charges. When you create a hosted zone, Route 53 assigns four name server (NS) records—you must configure these at your domain registrar to delegate DNS resolution to Route 53.

A private hosted zone is associated with one or more VPCs and is only resolvable from within those VPCs. It enables internal service discovery: your EC2 instances can resolve database.internal.example.com to a private IP without exposing the name to the public internet.

Private hosted zones are ideal for microservices that communicate internally, internal load balancers, and database endpoints that should never be publicly accessible. You can associate multiple VPCs (including across accounts) with a single private hosted zone using the associate-vpc-with-hosted-zone API.

An A record maps a hostname to an IPv4 address (e.g., www.example.com → 54.123.45.67). It is the most fundamental DNS record type and is used for any resource that has a static IPv4 address. An AAAA record does the same for IPv6 addresses.

For AWS resources with dynamic IPs (like an ALB or CloudFront distribution), Route 53 provides ALIAS records that behave like A records but point to an AWS resource DNS name rather than a static IP. ALIAS records are free to query, unlike standard records pointing to CloudFront or ALB which would incur charges for the intermediate resolution.

A CNAME (Canonical Name) record maps one hostname to another hostname, not directly to an IP. For example, www.example.com → d123abc.cloudfront.net. CNAMEs cannot be created at the zone apex (the root domain, e.g., example.com itself)—this is a DNS standard restriction.

ALIAS records are a Route 53 extension that behave like A/AAAA records but point to AWS resources by name. ALIAS records can be created at the zone apex, making them the correct choice for routing example.com (without www) to an ALB, CloudFront, or S3 website endpoint.

Beyond A and CNAME, Route 53 supports the full range of DNS record types:

• MX: Mail Exchange—specifies the mail servers responsible for receiving email for a domain, with priority values
• TXT: Text—stores arbitrary text, commonly used for domain ownership verification (SES, Google Workspace, SSL certificate validation) and SPF email authentication
• NS: Name Server—identifies the authoritative name servers for the hosted zone; auto-created by Route 53 and should not be modified
• SOA: Start of Authority—metadata about the zone; auto-created

SRV records specify the host and port for services, enabling service discovery in protocols like SIP and XMPP. Format: priority, weight, port, target. Kubernetes etcd and other service meshes use SRV records for peer discovery.

CAA (Certification Authority Authorization) records specify which certificate authorities (CAs) are permitted to issue SSL/TLS certificates for your domain. Adding a CAA record that restricts issuance to amazon.com prevents other CAs from issuing certificates for your domain, reducing the risk of certificate misissuance.

TTL (Time to Live) is a value in seconds that tells DNS resolvers how long to cache a record before re-querying Route 53. A low TTL (e.g., 60 seconds) means DNS changes propagate quickly but Route 53 receives more queries. A high TTL (e.g., 86400 = 1 day) reduces Route 53 query costs but slows propagation of record updates.

Best practice: use a high TTL for stable records (like a primary domain A record). Before a planned migration or traffic shift, temporarily lower the TTL to 60 seconds so the change propagates quickly. After the migration, restore the high TTL.

The Route 53 Resolver is built into every VPC and handles DNS resolution for records in private hosted zones and AWS service endpoints. For hybrid architectures where on-premises systems need to resolve AWS private zone names (or vice versa), use Resolver Inbound Endpoints (on-premises to AWS) and Resolver Outbound Endpoints (AWS to on-premises DNS).

Resolver Forwarding Rules let you configure which domain suffixes are forwarded to your corporate DNS servers, enabling seamless hybrid DNS resolution without duplicate zone management.

Route 53 doubles as a domain registrar, letting you register new domains or transfer existing ones. During registration you provide contact information and optionally enable privacy protection (which hides personal WHOIS data). Route 53 supports hundreds of top-level domains (TLDs).

When you register a domain through Route 53, a public hosted zone is automatically created with NS and SOA records pre-configured. The NS records at the registrar already point to Route 53's name servers, so no manual delegation step is needed—you can immediately start adding records.

Key hosted zone best practices for the SAA-C03 exam:

• Use ALIAS records at the zone apex instead of CNAME for AWS resources
• Use private hosted zones for all internal DNS, never expose internal hostnames in public zones
• Set a low TTL (60–120s) before migrations; restore a high TTL after
• Enable DNSSEC signing for public zones to protect against DNS spoofing attacks
• Tag hosted zones for cost allocation if managing multiple clients or environments

Test your understanding of AWS Solutions Architect (SAA-C03) concepts from this lesson.

In this lesson you learned: public hosted zones route internet traffic while private hosted zones resolve only within VPCs, ALIAS records solve the zone-apex CNAME limitation for AWS resources, and TTL controls DNS cache duration and propagation speed. Next up we explore Route 53 routing policies including simple, weighted, and latency-based routing.