Amazon Route 53 - DNS Routing Policies for Production Architectures

What you will learn

• How DNS resolution actually works step by step — Root, TLD, Authoritative Name Server
• Hosted zones — Public vs Private and what the $0.50/month buys you
• Record types — A, AAAA, CNAME, NS, and the Alias record that replaces CNAME for AWS resources
• CNAME vs Alias — the distinction that trips up every engineer at least once
• TTL strategy — how to change DNS records safely without locking clients to stale values
• All 7 routing policies and exactly when to use each one
• Health checks — endpoint monitoring, calculated health checks, and private resource patterns
• How to use Route 53 with a domain registered on GoDaddy or another registrar
• Hybrid DNS — Inbound and Outbound Resolver Endpoints for on-premises integration

Why this matters

At Zerodha, if the primary trading API region goes down at market open, Route 53 Failover routing detects the health check failure and automatically redirects traffic to the backup region — without any human intervention. At Swiggy, Latency-Based routing ensures users in Mumbai connect to ap-south-1 and users in Singapore connect to ap-southeast-1, getting the fastest response from the nearest region. At Hotstar, Weighted routing lets the team gradually shift 10% of traffic to a new version during a deployment and roll back instantly if error rates climb. These are not theoretical use cases — they are production patterns running at scale right now.

How DNS Resolution Works

Every time you type a domain name, a multi-step resolution process runs in milliseconds.

The whole process takes 20-100ms. Results are cached so subsequent requests skip most steps.

DNS terminology you must know:

What is Amazon Route 53

Route 53 is AWS's highly available, fully authoritative DNS service. Authoritative means you — the customer — can update DNS records directly. You are in full control of where traffic goes.

Route 53 is also a Domain Registrar. You can buy and register domain names directly through it, just like GoDaddy or Namecheap.

Key facts:

DNS Record Types

Each record is an instruction telling Route 53 how to respond to a query.

A Record — maps hostname to IPv4 address:

AAAA Record — maps hostname to IPv6 address:

CNAME Record — maps hostname to another hostname:

NS Record — Name Server records:

Tell the internet which DNS servers are authoritative for your domain. When you buy a domain on GoDaddy and point it to Route 53, you update NS records at GoDaddy to use Route 53's name servers.

Must know deeply: A, AAAA, CNAME, NS

Hosted Zones

A Hosted Zone is a container in Route 53 holding all DNS records for a domain and its subdomains.

Cost: $0.50 per month per hosted zone

Public Hosted Zone — routes traffic on the public internet:

Anyone on the internet can query a public hosted zone.

Private Hosted Zone — routes traffic only inside your VPC:

Only resources inside your VPC can resolve these names. Microservices communicate using friendly names instead of hardcoded private IPs.

TTL — Time To Live

TTL is how long a DNS resolver caches a record before asking Route 53 again.

Safe strategy for changing a DNS record:

If you skip Step 2, some clients still have the old high TTL cached and will not see your DNS change for hours.

Remember

TTL is mandatory on all records except Alias records. Alias records have no TTL — Route 53 manages it automatically.

CNAME vs Alias Records

AWS resources expose DNS hostnames, not static IPs:

You need to point your domain at this AWS hostname. Two options:

CNAME:

Alias Record:

Valid Alias record targets:

Remember

You cannot set an Alias record pointing to an EC2 DNS name. EC2 is not a valid Alias target. Only the services listed above are supported.

Health Checks

Route 53 Health Checks monitor your resources and trigger automatic DNS failover when something goes wrong. Health checks work only for public resources — they cannot directly access private VPC resources.

Type 1 — Monitoring an Endpoint:

Route 53 sends health checker requests from 15 global locations to your endpoint.

Type 2 — Calculated Health Checks:

Combine multiple child health checks into one parent using AND/OR/NOT logic.

Type 3 — Health Checks for Private Resources:

Route 53 health checkers run outside your VPC — they cannot reach private endpoints directly.

Route 53 indirectly monitors private resources through the CloudWatch Alarm state.

The 7 Routing Policies

1. Simple Routing — single resource, no health checks:

2. Weighted Routing — control traffic percentage:

3. Latency-Based Routing — route to lowest latency region:

4. Failover Routing — active-passive disaster recovery:

5. Geolocation Routing — route by physical location:

Remember

Geolocation routes by where the user physically is. Latency-based routes by which region responds fastest. A user physically close to a region may still have higher latency — they are different things.

6. Geoproximity Routing — shift traffic by adjusting bias:

7. IP-Based Routing — route by client IP address:

8. Multi-Value Routing — healthy IPs only:

Using GoDaddy as Registrar with Route 53 for DNS

You can buy a domain on GoDaddy and manage DNS records on Route 53.

From this point manage all DNS records inside Route 53 even though you bought the domain on GoDaddy.

Hybrid DNS — Resolver Endpoints

By default, EC2 instances inside your VPC can resolve AWS service DNS names and private hosted zone names. But when you have an on-premises data center connected via VPN or Direct Connect, DNS needs to work in both directions.

Inbound Endpoint — on-premises to AWS:

Outbound Endpoint — AWS to on-premises:

Both endpoints operate over VPN or Direct Connect to bridge DNS between AWS and on-premises.

Hands-on Lab — Hosted Zone, Records, and Weighted Routing

Step 1 — Create a Public Hosted Zone

Step 2 — Create a simple A record

Step 3 — Create a Health Check

Step 4 — Create Weighted routing records

Step 5 — Test traffic distribution

Step 6 — Test health check failover

Step 7 — Cleanup

Production Best Practices and Common Pitfalls

• Always use Alias records instead of CNAME for AWS resources — free, supports root domain, auto-tracks IP changes
• Lower TTL before making DNS changes — if TTL is 24 hours and you change a record, clients are stuck for up to 24 hours
• Always create a Default record with Geolocation routing — without it, users from unmatched locations get NXDOMAIN errors
• Use health checks with Failover routing — Failover without health checks means Route 53 keeps routing to a dead endpoint
• Use Latency-Based routing for multi-region deployments — it automatically finds the fastest region for each user
• Do not confuse Geolocation with Latency-Based — Geolocation routes by where users are, Latency routes by where response is fastest

Quick Reference and Troubleshooting Commands

Common problems and fixes:

Common Mistake

Creating a CNAME for the root domain (example.com). The DNS standard does not allow CNAME at the Zone Apex. Route 53 will reject it. Use an Alias record — it achieves the same result, works for root domains, and is free.

Common Mistake

Using Failover routing without health checks. Without a health check, Route 53 has no way to know the primary is down and will keep routing to a failed endpoint indefinitely. Health checks are mandatory for Failover routing to actually fail over.

Tip

For a production multi-region setup combine Latency-Based routing with health checks on every record. Latency-Based sends users to the fastest region normally. Health checks automatically exclude unhealthy regions. If ap-south-1 goes down during IPL streaming, Route 53 automatically routes users to the next fastest healthy region — no manual intervention, no ops team paged at 3 AM.

Common Mistakes to Avoid

Common Mistake

Using a CNAME for the root domain (example.com). DNS does not allow CNAME at the Zone Apex. Use an Alias record instead — it supports root domains, is free, and automatically tracks IP changes of the AWS resource.

Common Mistake

Using Failover routing without a health check on the primary record. Without a health check, Route 53 has no way to know the primary is down. It keeps routing to the failed endpoint indefinitely. Health checks are mandatory for Failover routing to actually fail over.

Tip

Lower your TTL to 60 seconds before making any DNS change. If TTL is 24 hours and you change a record, clients with the old value cached are stuck for up to 24 hours. Lower TTL → wait 24 hours for caches to expire → make the change → raise TTL back.