Records, Hosted Zones and TTL

By the end of this lesson you will be able to

• Say what Amazon Route 53 is and does: authoritative DNS, domain registrar, resolver inside every VPC, health checks, and the only AWS service with a 100% availability SLA.
• Read any URL as protocol, subdomain, second-level domain, TLD and root, and tell an authoritative answer from a cached one.
• Describe what every record holds (name, type, value, routing policy, TTL) and choose between A, AAAA, CNAME and NS, plus MX, TXT, CAA, SOA, PTR, SRV and DS.
• Explain the NS and SOA records Route 53 puts in every new zone, and what negative caching is.
• Choose between public and private hosted zones, make a private zone work (DNS attributes, multi-VPC and cross-account association, split view), and estimate the bill.
• Point a domain at a single EC2 instance safely with an Elastic IP.
• Pick a TTL on purpose, and plan a record change so it takes minutes instead of a day.

Route 53 and DNS bring three or four questions to almost every SAA-C03 exam, and they are mixed into questions about load balancers, CloudFront and disaster recovery. This chapter has five lessons. This first one lays the base: records, hosted zones and TTL. Lesson 8.2 covers CNAME vs Alias, 8.3 the routing policies, 8.4 health checks and failover, and 8.5 registrars and hybrid DNS.

#What Route 53 is

#DNS in one paragraph

People remember names; computers need IP addresses. When you type google.com, the browser has no idea where that is until something turns the name into an address such as 142.250.190.46. The Domain Name System (DNS) does that translation for the whole internet, which is why it is called the internet’s phonebook. The System Design lesson DNS: the internet’s phonebook explains the general machinery (the DNS tree, the four kinds of server, record types, caching layers). This lesson recaps only what you need and focuses on what Route 53 adds and what the exam asks.

#Route 53 in five jobs

Amazon Route 53 is a highly available, scalable, fully managed DNS service. It does five things:

Three facts the exam likes:

• 100% availability SLA. Route 53 is the only AWS service whose SLA promises 100%: AWS gives service credits as soon as a hosted zone’s monthly uptime drops below 100%. The SLA covers answering DNS queries (a zone counts as down only when all four of its name servers stop responding); it does not cover the Route 53 API or console. (AWS GovCloud zones are committed at 99.995%.)
• Why “53”? DNS servers listen on port 53, over UDP for normal queries and TCP for large answers and zone transfers.
• Global service. Hosted zones are not tied to a Region; Route 53’s name servers sit at AWS edge locations all over the world. Its control plane (the API and console where you change records) runs in us-east-1.

#A short DNS refresher, from Route 53’s point of view

#Reading a URL

Take http://api.www.example.com. and read it from right to left:

The zone apex (or root domain, or naked domain) is the name of the zone itself, here example.com without any subdomain. It matters for CNAME records, as you will see in a moment.

#The words you need

#Where Route 53 sits in a lookup

1. 1. Browser and OS cache

   You type example.com. The browser and the operating system check their caches. If they have no fresh copy, they send the question to the configured recursive resolver.

2. 2. Root server

   If the resolver has nothing cached, it asks a root server, which does not know the answer but returns the address of the TLD servers for .com. (Root servers are coordinated by IANA, part of ICANN.)

3. 3. TLD server

   The .com TLD server returns the NS records for example.com: the authoritative name servers. If your domain uses Route 53, these are the four Route 53 name servers of your hosted zone. Your registrar put them there.

4. 4. Route 53 answers

   The resolver asks a Route 53 name server, which returns the real record, for example A 203.0.113.10 with TTL 300. The resolver caches it, the browser gets the IP, and the website loads.

Authoritative vs non-authoritative. The answer in step 4 comes straight from the zone: an authoritative answer, marked with the aa flag. When the same resolver answers the next user from its cache, the answer is non-authoritative: correct as of when it was cached, with the TTL counting down. Every query that reaches Route 53 is billed; every cache hit costs you nothing.

#Records: what each one holds

A record tells Route 53 how to answer a query for one name. Each record has five parts:

#The must-know types

• A maps a hostname to an IPv4 address: www.example.com → 192.0.2.44.
• AAAA (“quad A”) maps a hostname to an IPv6 address: www.example.com → 2001:db8::44. Serve both and clients with IPv6 use it.
• CNAME maps a hostname to another hostname: shop.example.com → shops.example.net. The target must eventually resolve to an A or AAAA record. A CNAME cannot be created at the zone apex (example.com), and a name with a CNAME cannot have any other record. Route 53’s answer to both limits is the Alias record, the subject of lesson 8.2.
• NS lists the name servers for a zone. The NS record at the apex is what the registrar must copy into the TLD; NS records further down delegate a subdomain to another zone. NS records therefore control how traffic for a domain is routed, because they decide who answers.

#The other types, briefly

#The two records Route 53 creates for you

When you create a public hosted zone, Route 53 adds two records at the apex automatically:

• NS: the four name servers assigned to the zone, each under a different TLD so that a problem with one TLD cannot take your domain down, for example ns-2048.awsdns-64.com, ns-2049.awsdns-65.net, ns-2050.awsdns-66.org, ns-2051.awsdns-67.co.uk. These four are what you give your registrar.
• SOA: for example ns-2048.awsdns-64.net. hostmaster.example.com. 1 7200 900 1209600 86400. The fields are the primary name server, the admin e-mail (with . for @), a serial number, three timers used by secondary DNS servers (refresh 7200 s, retry 900 s, expire 1209600 s = 2 weeks), and the minimum TTL (86400 s).

The last SOA field controls negative caching. When Route 53 answers NXDOMAIN (no such name) or NODATA (the name exists but not with that type), resolvers cache that “no” for the smaller of the SOA record’s own TTL (900 s by default) and the SOA minimum (86400 s): 15 minutes by default. Negative answers are billed like any other query.

Leave both records alone. If you delete and recreate a hosted zone, the new zone gets a different set of four name servers, and your domain stops resolving until you update the registrar (lesson 8.5).

#Hosted zones: public and private

A hosted zone is a container for the records of one domain and its subdomains. Route 53 has two kinds, and the difference is who can ask.

#Public hosted zones

A public hosted zone answers queries from anywhere on the internet. Use it for every name the world must reach: www.example.com, api.example.com, mail.example.com. Creating the zone is not enough on its own: the registrar must list the zone’s four name servers for the domain (automatic if you registered the domain in Route 53, a manual step otherwise; lesson 8.5).

#Private hosted zones

A private hosted zone answers queries only from the VPCs you associate with it. The rest of the world cannot see it, not even that it exists. Use it for internal names: db.corp.internal, orders.internal.example.com, internal microservices. When the database moves, you change one record instead of every application’s config.

How it works and what it needs:

• The VPC Resolver answers. Instances send their DNS queries to the Amazon-provided DNS server, which DHCP configures for them: the VPC base address plus two (10.0.0.2 in 10.0.0.0/16), also reachable at 169.254.169.253 (and fd00:ec2::253 for IPv6 on Nitro instances). It checks the private zones associated with the VPC first, then resolves everything else on the internet. Lesson 8.5 covers this resolver in depth, including how on-premises networks can use it.
• Two VPC attributes must be true: enableDnsSupport (“DNS resolution”: the Amazon DNS server answers at all; true by default) and enableDnsHostnames (“DNS hostnames”; false by default in VPCs you create, true in the default VPC). AWS requires both for private hosted zones. The exam loves this one.
• Many VPCs, many accounts. One private zone can be associated with up to 300 VPCs, in any Region, including VPCs owned by other AWS accounts. For a VPC in another account: the zone owner runs create-vpc-association-authorization, then the VPC owner runs associate-vpc-with-hosted-zone. This works only through the CLI, SDK or API, not the console. Afterwards, delete the authorization; the association stays. For hundreds of VPCs, Route 53 Profiles (lesson 8.5) share zones in bulk.
• DNS is not connectivity. An associated VPC can resolve db.corp.internal, but it still needs peering, a Transit Gateway or similar to reach 10.0.2.35. And a private zone is not visible from the far side of a VPN on its own; on-premises lookups need a Resolver inbound endpoint (lesson 8.5).
• Queries to private hosted zones are free. You pay only for the zone itself.

#Split view (split-horizon DNS)

You can create a public and a private zone with the same name, for example both example.com. The internet gets answers from the public zone; VPCs associated with the private zone get answers from the private one. api.example.com can then resolve to a public address for customers and to an internal address for your own servers.

The rule inside an associated VPC is most specific match, private first: if a private zone matches the name (the same name or a parent of it), Resolver looks only there. If that private zone has no record for the name, Resolver returns NXDOMAIN; it does not fall back to the public zone. So every name your VPC clients need must exist in the private zone too.

#What it costs

The zone charge is not prorated: you pay for the full month on the day you create it and on the first of every month after. A zone deleted within 12 hours of creation is not charged, which makes short tests free. Domain registration is a separate yearly fee (lesson 8.5).

A worked example: 30 hosted zones cost 25 × $0.50 + 5 × $0.10 = $13.00 a month. If the public zones receive 300 million standard queries a month, add 300 × $0.40 = $120. TTL decides much of that second number, as the TTL section shows.

#Pointing a domain at a single EC2 instance

The simplest website on AWS is one EC2 instance in a public subnet. To give it a name:

1. Allocate an Elastic IP and associate it with the instance (lesson 3.6).
2. In the public hosted zone, create an A record: www.example.com → 203.0.113.25 (the Elastic IP), with a TTL such as 300.

Why not use the instance’s automatic public IP? Because an auto-assigned public IPv4 address is released when the instance stops, and the instance gets a different one when it starts. The A record would keep pointing at the old address: users time out, or reach whichever instance gets that address next. The instance’s public DNS name (ec2-198-51-100-7.compute-1.amazonaws.com) changes with it, so a CNAME to that name does not help either. An Elastic IP stays with your account through stops, starts and even termination until you release it, and you can move it to a replacement instance in seconds, with no DNS change.

The cost: since February 2024 every public IPv4 address costs about $0.005 per hour (about $3.60 a month), Elastic IPs included, attached or idle. “Cost-effective” in the exam therefore means “the cheapest stable option for one instance”, not “free”. Release Elastic IPs you no longer need.

For anything beyond one instance, use a load balancer in front of an Auto Scaling group and point an Alias record at it (lesson 8.2); the notes put it this way: if there is a load balancer, the answer is Alias.

#TTL: how long answers are cached

Every record except an Alias carries a TTL in seconds. It tells every resolver and client: “you may keep this answer for this long without asking again”. In Route 53 the TTL is mandatory for every non-Alias record (the console suggests 300; any value from 0 to 2,147,483,647 is accepted). Alias records have no TTL of their own: Route 53 uses the TTL of the target (lesson 8.2).

A resolver hands out the remaining TTL. If it cached a record with TTL 300 two minutes ago, it answers with TTL 180, so every cache below it expires at the same moment.

#High TTL vs low TTL

Most records sit comfortably at 300 to 3600 seconds. Records used with failover routing and health checks usually have 60 seconds or less, because the TTL is the delay before clients follow a failover.

#Changing a record safely

There is no such thing as pushing a DNS change. When you edit a record, Route 53 serves the new value within about a minute (get-change shows PENDING and then INSYNC), but resolvers that cached the old answer keep using it until their copy expires. What people call “DNS propagation” is just caches running out. The longest anyone can see the old answer is the TTL the record had when they cached it.

That last sentence is the trap. Suppose a record has had TTL 86400 for months and you lower it to 60 ten minutes before a migration. A resolver that cached the record 2 hours earlier still holds a copy with a 24-hour lifetime: it learns the new TTL, and the new IP, only when that copy expires, 22 hours later. Lowering the TTL just before the change helps almost nobody.

The safe recipe:

1. Lower the TTL well in advance, at least one old TTL before the change (for TTL 86400, at least a day ahead), keeping the old value.
2. Wait until every old long-lived copy has expired.
3. Change the record. Within one short TTL, everyone follows.
4. Keep the old server running for a while; a few resolvers enforce their own minimum TTL or misbehave.
5. Raise the TTL again once the new setup is confirmed, to cut queries and cost.

The cost side in numbers: a busy resolver with constant traffic asks once per TTL. With TTL 60 that is 1,440 queries a day; with TTL 86400 it is one. For 10,000 such resolvers over a 30-day month, TTL 60 means 10,000 × 1,440 × 30 = 432 million queries, about $173; TTL 300 about $35; TTL 3600 about $2.88. Real traffic is lumpier, but the ratio holds: the bill scales with 1 / TTL.

#What goes wrong

#Route 53 in system design

• Every public name in one place. Keep each domain in one public hosted zone, managed as code (CloudFormation, CDK, Terraform), and give subdomain zones to teams through NS delegation when they need autonomy.
• Internal names in private zones. Point applications at db.corp.internal instead of IPs or long endpoint names (for RDS, a CNAME to the RDS endpoint, because its IP changes on failover), so moving a component is a one-record change.
• Split view when the same name must reach a public endpoint from outside and a private one from inside.
• TTL as a design decision: long for stable records, short for anything that may fail over or migrate, and lowered in advance before planned changes.
• Never put one EC2 instance’s IP into DNS for anything important. Use an Elastic IP for a single server, and a load balancer with Alias for real availability.

#Try it yourself

# 1. Create a public hosted zone (the caller reference just has to be unique)
aws route53 create-hosted-zone --name example.com --caller-reference demo-2026-10-25
aws route53 get-hosted-zone --id Z0123456789EXAMPLE          # shows the four name servers

# 2. Look at the NS and SOA records Route 53 created
aws route53 list-resource-record-sets --hosted-zone-id Z0123456789EXAMPLE \
  --query "ResourceRecordSets[?Type=='NS' || Type=='SOA']"

# 3. Create or update an A record with TTL 300 (UPSERT = create or replace)
cat > www.json <<'EOF'
{ "Comment": "www to the Elastic IP",
  "Changes": [ { "Action": "UPSERT",
    "ResourceRecordSet": { "Name": "www.example.com", "Type": "A", "TTL": 300,
      "ResourceRecords": [ { "Value": "203.0.113.25" } ] } } ] }
EOF
aws route53 change-resource-record-sets --hosted-zone-id Z0123456789EXAMPLE \
  --change-batch file://www.json
aws route53 get-change --id C0123456789EXAMPLE               # PENDING, then INSYNC

# 4. Ask Route 53 what it would answer, without any cache in the way
aws route53 test-dns-answer --hosted-zone-id Z0123456789EXAMPLE \
  --record-name www.example.com --record-type A

# 5. An Elastic IP for a single web server
aws ec2 allocate-address --domain vpc
aws ec2 associate-address --instance-id i-0abc1234def567890 --allocation-id eipalloc-0abc1234

# 6. A private hosted zone: VPC attributes first, then the zone
aws ec2 modify-vpc-attribute --vpc-id vpc-0a1b2c3d4e5f60718 --enable-dns-support "{\"Value\":true}"
aws ec2 modify-vpc-attribute --vpc-id vpc-0a1b2c3d4e5f60718 --enable-dns-hostnames "{\"Value\":true}"
aws route53 create-hosted-zone --name corp.internal --caller-reference corp-2026-10-25 \
  --vpc VPCRegion=us-east-1,VPCId=vpc-0a1b2c3d4e5f60718 --hosted-zone-config PrivateZone=true

# 7. Associate a VPC from another account
aws route53 create-vpc-association-authorization --hosted-zone-id Z0PRIVATE0EXAMPLE \
  --vpc VPCRegion=us-east-1,VPCId=vpc-0b2c3d4e5f6071829       # run in the zone owner's account
aws route53 associate-vpc-with-hosted-zone --hosted-zone-id Z0PRIVATE0EXAMPLE \
  --vpc VPCRegion=us-east-1,VPCId=vpc-0b2c3d4e5f6071829       # run in the VPC owner's account
aws route53 delete-vpc-association-authorization --hosted-zone-id Z0PRIVATE0EXAMPLE \
  --vpc VPCRegion=us-east-1,VPCId=vpc-0b2c3d4e5f6071829       # tidy up; the association stays

Watch caching and authority with dig (or nslookup on Windows):

dig www.example.com @ns-2048.awsdns-64.com +norecurse   # straight to Route 53: flags include aa
dig www.example.com                                     # via your resolver: run it twice, the TTL counts down
dig +noall +answer www.example.com                      # just the answer line: name, TTL, type, value
dig shpo.example.com                                    # NXDOMAIN, with the SOA in the AUTHORITY section
dig NS example.com +short                               # the four awsdns name servers
nslookup -type=TXT example.com                          # Windows: TXT records

# From an EC2 instance: the VPC Resolver answers private names
dig db.corp.internal @169.254.169.253

#Summary

Key takeaways

• Route 53 = managed authoritative DNS (you edit the records of your hosted zones), plus registrar, the resolver in every VPC, health checks and routing policies. It is the only AWS service with a 100% availability SLA (for answering queries). “53” is the DNS port.
• URL anatomy, right to left: root ., TLD com, SLD example.com, subdomain www; the protocol is not DNS. The FQDN goes all the way to the root; the zone apex is the zone’s own name.
• Authoritative answers come from Route 53’s zone (aa flag) and are billed; non-authoritative answers come from a resolver’s cache and are free. Route 53 never carries your traffic.
• A record = name, type, value, routing policy, TTL. Must-know types: A (IPv4), AAAA (IPv6), CNAME (name → name, not at the apex; Alias in 8.2), NS. Also MX, TXT (ownership, SPF), CAA, SOA, PTR, SRV, DS, NAPTR.
• Every new zone gets NS (four name servers on four TLDs) and SOA (its minimum field and TTL set negative caching, 900 s by default). Recreating a zone changes its name servers.
• Public hosted zone: answers the internet. Private hosted zone: answers only associated VPCs (up to 300, cross-account by authorization + association via CLI/API), needs enableDnsSupport + enableDnsHostnames, free queries. Split view: same name in both; inside the VPC the private zone wins and never falls back.
• Price: $0.50 per zone per month for the first 25, $0.10 after; $0.40 per million standard queries; Alias queries to AWS resources and private zone queries free; zones deleted within 12 hours free.
• One EC2 instance: Elastic IP + A record, because an auto-assigned public IPv4 changes on stop/start; every public IPv4 costs about $0.005/hour since February 2024. More than one instance: load balancer + Alias.
• TTL is mandatory except for Alias. High TTL: fewer queries, lower cost, slow changes. Low TTL: more queries, higher cost, fast changes. Lower it at least one old TTL before a migration: lowering it just before does not help resolvers that cached the long TTL.

Self-check: Route 53 records, hosted zones and TTL30 questions