Route 53 DNS

People remember kochibakery.in, not d111111abcdef8.cloudfront.net. The Domain Name System (DNS) translates names into addresses, and Amazon Route 53 is AWS's DNS service. It answers DNS queries from locations around the world, can register domains, checks whether your servers are healthy, and can send users to different places depending on where they are or what is working.

In this lesson you will learn hosted zones and records, alias records, how to point a domain at a CloudFront distribution with the CLI, and the routing policies that make Route 53 more than a phone book. The DNS, HTTP & HTTPS lesson explains DNS itself.

Hosted zones and name servers

A hosted zone holds the DNS records for one domain. There are two kinds:

• Public hosted zones answer queries from the internet, for example for kochibakery.in.
• Private hosted zones answer only inside the VPCs you associate, for internal names such as db.internal.shop.

When you create a public hosted zone, Route 53 adds an NS record listing four name servers and an SOA record. If you bought the domain from another registrar, you must change the domain's name servers at that registrar to these four. Until you do, the internet keeps asking the old DNS provider.

aws route53 create-hosted-zone --name kochibakery.in \
  --caller-reference kochibakery-2026-10-30 \
  --query "{Zone: HostedZone.Id, NameServers: DelegationSet.NameServers}"

{
    "Zone": "/hostedzone/Z1D633PJN98FT9",
    "NameServers": [
        "ns-2048.awsdns-64.com",
        "ns-2049.awsdns-65.net",
        "ns-2050.awsdns-66.org",
        "ns-2051.awsdns-67.co.uk"
    ]
}

The caller reference is any unique string; it stops the same request from creating two zones if you retry it. You can also register a new domain directly in Route 53, which creates the hosted zone for you.

Record types

Each record has a TTL (time to live) in seconds, telling resolvers how long to cache the answer. Use short TTLs (60 to 300 seconds) before a planned change, and longer ones for stable records.

Alias records

A plain CNAME cannot be used at the zone apex (the bare domain kochibakery.in), because the apex must hold NS and SOA records. Route 53 solves this with alias records: an A or AAAA record that points to an AWS resource such as a CloudFront distribution, a load balancer, an API Gateway custom domain or another record in the zone. Route 53 looks up the resource's current addresses for you, and when they change, nothing breaks.

This change batch, saved as alias.json, points both the apex and www at the bakery's distribution. Z2FDTNDATAQYW2 is the fixed hosted zone ID that every CloudFront alias uses:

{
  "Comment": "Point the site at CloudFront",
  "Changes": [
    {
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "kochibakery.in",
        "Type": "A",
        "AliasTarget": {
          "HostedZoneId": "Z2FDTNDATAQYW2",
          "DNSName": "d111111abcdef8.cloudfront.net",
          "EvaluateTargetHealth": false
        }
      }
    },
    {
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "www.kochibakery.in",
        "Type": "A",
        "AliasTarget": {
          "HostedZoneId": "Z2FDTNDATAQYW2",
          "DNSName": "d111111abcdef8.cloudfront.net",
          "EvaluateTargetHealth": false
        }
      }
    }
  ]
}

aws route53 change-resource-record-sets --hosted-zone-id Z1D633PJN98FT9 \
  --change-batch file://alias.json

{
    "ChangeInfo": {
        "Id": "/change/C2682N5HXP0BZ4",
        "Status": "PENDING",
        "SubmittedAt": "2026-10-30T10:05:17.402000+00:00",
        "Comment": "Point the site at CloudFront"
    }
}

UPSERT creates the record or updates it if it exists. The change is PENDING until all Route 53 name servers have it, usually within a minute. Wait for it and test with dig:

aws route53 wait resource-record-sets-changed --id /change/C2682N5HXP0BZ4
dig +short www.kochibakery.in

203.0.113.10
203.0.113.42
203.0.113.77
203.0.113.105

CloudFront returns several edge addresses near the person asking, so your results will differ. Remember that the distribution must list both names as alternate domain names with a valid certificate, as covered in CloudFront CDN. ACM can validate that certificate through CNAME records that it can add to your Route 53 zone with one click.

Routing policies

Route 53 can answer the same name differently:

• Simple: one answer for everyone.
• Weighted: split traffic by percentage, for example 90% to the current version and 10% to a new one.
• Latency: send users to the Region that gives them the lowest latency.
• Failover: send traffic to a primary resource while its health check passes, otherwise to a secondary.
• Geolocation: answer by the user's continent, country or state, for example a Hindi site for users in India.
• Geoproximity: route by distance, with a bias you can adjust.
• Multivalue answer: return up to eight healthy records, chosen at random.
• IP-based: route by the user's IP address range.

Health checks test an endpoint (HTTP, HTTPS or TCP) from many locations. A typical disaster recovery design for an Indian company uses a failover policy: the primary record points at the Mumbai load balancer with a health check, and the secondary points at a standby in Hyderabad.

Common mistakes

• Creating a hosted zone but never updating the registrar's name servers. Nothing changes for visitors.
• Trying to put a CNAME at the apex. Use an alias A record instead.
• Deleting and recreating a hosted zone, which gives new name servers that the registrar does not know.
• Long TTLs during a migration, which keep old answers cached for hours.
• Health checks that test only the home page while the API behind it is down. Check a meaningful endpoint.

Key points

• A hosted zone holds a domain's records; public zones answer the internet, private zones answer only inside your VPCs.
• After creating a public zone, point the registrar at its four Route 53 name servers.
• Common record types are A, AAAA, CNAME, MX, TXT and CAA; TTL controls caching.
• Alias records work at the zone apex and point to AWS resources such as CloudFront; the CloudFront alias zone ID is Z2FDTNDATAQYW2.
• Use UPSERT change batches with the CLI and wait for the change to become INSYNC.
• Routing policies (weighted, latency, failover, geolocation and others) plus health checks give traffic control and disaster recovery.

{
  "Changes": [
    {
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "rohtakfest.in",
        "Type": "MX",
        "TTL": 3600,
        "ResourceRecords": [{ "Value": "10 mail.rohtakfest.in" }]
      }
    }
  ]
}

aws route53 change-resource-record-sets --hosted-zone-id Z3EXAMPLEZONE01 \
  --change-batch file://mx.json