[AWS] 7. AWS Route 53, DNS (Domain Name System), Routing Policies

Source: Dev.to

What is DNS?

• Domain Name System – translates human‑friendly hostnames into machine IP addresses.

  www.google.com → 172.217.18.36

• The backbone of the Internet.
• Uses a hierarchical naming structure (e.g., .com, example.com, www.example.com, api.example.com).
• Domain Registrar – services that sell domain names (e.g., Amazon Route 53, GoDaddy).
• DNS Records – A, AAAA, CNAME, NS, …
• Zone File – contains the DNS records for a domain.
• Name Server – resolves DNS queries (authoritative or non‑authoritative).
• Top‑Level Domain (TLD) – .com, .us, .in, .gov, .org, …
• Second‑Level Domain (SLD) – amazon.com, google.com, …

Amazon Route 53 Overview

• Highly available, scalable, fully‑managed, authoritative DNS service.
• Authoritative – you (the customer) can update the DNS records.
• Also acts as a domain registrar.
• Can check the health of your resources.
• The only AWS service that offers a 100 % Availability SLA.
• The name “53” refers to the traditional DNS port (53/TCP).

Routing Traffic for a Domain

Each DNS record contains:

DNS Record Types Supported by Route 53

• A – maps a hostname to an IPv4 address.
• AAAA – maps a hostname to an IPv6 address.
• CNAME – maps a hostname to another hostname.
  • The target must have an A or AAAA record.
  • Cannot be used at the zone apex (e.g., you cannot create a CNAME for example.com, but you can for www.example.com).

Name Server (NS) Records

• Define the authoritative name servers for a hosted zone.

Hosted Zones

• Cost: $0.50 per month per hosted zone.

TTL (Time‑to‑Live)

Note: Except for Alias records, TTL is mandatory for every DNS record.

CNAME vs. Alias Records

Example – Mapping an AWS load balancer to a friendly name:

myapp.mydomain.com  →  lb-1234.us-east-2.elb.amazonaws.com   (Alias)

Routing Policies (How Route 53 Responds to DNS Queries)

Important: DNS routing is not the same as traffic routing performed by a load balancer. DNS only returns IP addresses or aliases; the client then contacts the returned endpoint.

Health Checks

• Purpose: Monitor the health of endpoints (applications, servers, AWS resources) and enable automated DNS failover.
• Types of health checks:
  1. Endpoint health checks – HTTP, HTTPS, or TCP probes.
  2. Calculated health checks – Combine results of multiple health checks.
  3. CloudWatch‑based health checks – Use CloudWatch alarms (e.g., DynamoDB throttling, RDS alarms, custom metrics).

Core Settings

Health Check Integration

• Health checks can be attached to records using Weighted, Latency‑based, Failover, and Multi‑Value Answer policies.
• HTTP health checks are only for public resources.
• Private resources can be monitored via Calculated or CloudWatch‑based health checks.

Tip: Ensure your firewall or security groups allow inbound traffic from the Route 53 health‑checking IP ranges.

Quick Reference Cheat‑Sheet

Health Checkers

• Combine results of multiple health checks into a single health check.
  • Logical operators: OR, AND, NOT.
• Maximum children: 256 child health checks.
• Pass‑criteria: Specify how many of the child checks must pass for the parent to be considered healthy.
• Typical use‑case: Perform maintenance on a website without causing all health checks to fail.

Note: Route 53 health checkers run outside the VPC, so they cannot reach private endpoints (private VPC resources or on‑premises servers).
To monitor private resources, you can:

1. Create a CloudWatch metric that reflects the health of the private endpoint.
2. Attach a CloudWatch alarm to that metric.
3. Create a Route 53 health check that monitors the alarm itself.

Failover (Active‑Passive)

Standard Route 53 failover routing where one resource is primary (active) and another is standby (passive).

Geolocation Routing

• Purpose: Route traffic based on the user’s location (different from latency‑based routing).
• Location granularity: Continent, Country, US State (most precise match wins when regions overlap).
• Default record: Always create a “Default” record to catch requests that don’t match any location rule.
• Use cases:
  • Website localization
  • Content restriction by region
  • Load balancing across regions
• Health checks: Can be associated with health checks to ensure only healthy endpoints receive traffic.

Geoproximity Routing

• Goal: Shift traffic toward or away from resources based on geographic bias.
• Supported resources:
  • AWS resources – specify the AWS region.
  • Non‑AWS resources – specify latitude & longitude.
• Implementation: Requires Route 53 Traffic Flow (advanced).
• Bias values:
  • Positive bias (1 – 99): Expands the geographic region → more traffic to the resource.
  • Negative bias (‑1 – ‑99): Shrinks the region → less traffic to the resource.

IP‑Based Routing (CIDR Mapping)

• How it works: Route traffic based on the client’s IP address.
• Configuration: Provide a list of CIDR blocks and map each block to a specific endpoint/location (user‑IP‑to‑endpoint mapping).
• Use cases:
  • Optimize performance by sending users to the nearest endpoint.
  • Reduce network costs.
  • Example: Direct users from a particular ISP to a dedicated endpoint.

Multi‑Value Answer Routing

• When to use: You have multiple resources that can serve the same request.
• Behavior: Route 53 returns up to 8 healthy records for each query.
• Health checks: Can be attached; only healthy records are returned.
• Important: This is not a replacement for an Elastic Load Balancer (ELB).

Domain Registration vs. DNS Service

Typical workflow:

1. Buy a domain from any registrar (including third‑party registrars).
2. Create a Hosted Zone in Route 53.
3. Update the NS records at the registrar to point to the Route 53 name servers.

Key takeaway: Domain registrar ≠ DNS service. Even though many registrars bundle DNS, you are free to use any DNS provider you prefer.

Route 53 Resolver (Hybrid DNS)

By default, the Resolver automatically answers DNS queries for:

• Local domain names of EC2 instances.
• Records in Private Hosted Zones.
• Records in Public Name Servers.

Network Types it Can Connect To

• VPC (including peered VPCs).
• On‑premises networks (via AWS Direct Connect or AWS VPN).

Endpoints

These endpoints make it possible to build a hybrid DNS architecture, seamlessly resolving names across AWS and external networks.