Learn
AWS
Networking & content delivery
Route 53

AWSGCP laterAzure later

Route 53Amazon Route 53

Networking & content deliveryCore service · full depthFree while we build the libraryChecked against AWS docs · 15 Sept 2026

AWS's DNS service. It registers domains, answers queries for them with a choice of routing policies, and sends traffic away from endpoints that fail their health checks.

In the examsSolutions Architect – AssociateHIGHSolutions Architect – ProfessionalHIGHDeveloper – AssociateLOWSysOps Administrator – AssociateHIGHSecurity – SpecialtyLOW

Where Route 53 takes you6 steps, all open

I know the problem it solves
I can picture it
I know how it fails
I know when to choose it
I can use it in a design
I can answer an exam question

What & why

The directory in front of everything

Route 53 is AWS's DNS service. It does three jobs, in any combination: it registers domain names, it answers DNS queries for them, and it checks the health of the endpoints behind them.

A hosted zone holds a domain's records. A public hosted zone answers queries from the internet; a private hosted zone answers only inside the VPCs you associate with it. Each record has a routing policy, which decides how Route 53 answers when there is more than one place to send someone.

Reach for it when

your domain should point at a load balancer, a CloudFront distribution or an S3 website
users should go to the Region with the lowest latency, or be sent by where they are
traffic must move to a standby when the primary fails its health checks
names inside a VPC must resolve privately

It is the wrong tool when

requests should be spread across servers in one Region: that is a load balancer
content should be cached close to users: that is CloudFront
the site needs a certificate for HTTPS: that is ACM

Mental model

A directory with an operator

You ask the directory for a business's number. The operator can give you the nearest branch, the branch for your country, a number picked by shares the business chose, or the backup branch when the main one is not answering. You write the number down, and do not ask again until your note expires.

The directory for one businessthe records for one domainHosted zone

An entrya name and where it pointsRecord

How the operator chooseswhich answer to giveRouting policy

Ringing the branch firstchecking the endpoint answersHealth check

How long your note is good forhow long resolvers cache an answerTTL

An internal extension listnames that resolve only in your VPCsPrivate hosted zone

How it works

From a name to an address

Register or bring a domainRegister it with Route 53, or keep it where it is and use a Route 53 hosted zone for its DNS.
Create recordsAn A, AAAA, CNAME or other record for each name. An alias record points at an AWS resource, even at the zone apex.
Choose a routing policySimple, weighted, latency, failover, geolocation, geoproximity, IP-based or multivalue answer.
Attach health checksHealth checkers around the world test the endpoint, and a record that fails is left out of the answers.

Health check interval: 30 sor 10 s, fast, at extra charge
Failure threshold: 3checks in a row, by default
Healthy when: Over 18%of health checkers say so
Multivalue answer: Up to 8healthy records, at random
Alias queries: Freeto AWS resources
Weighted share: Weight ÷ totala weight of 0 stops traffic

Hosted zone
A zone that can answer for the domain. A private zone answers only inside the VPCs associated with it.
Records
The records with this name and type.
Routing policy
Chooses among them: by weight, by latency, by location, or primary before secondary.
Health
A record whose health check is failing is left out of the answer.
Answer
The resolver caches it for the TTL. An alias to an AWS resource uses that resource's TTL.

Pick a case to follow the query through each check.

Architecture

One name, two Regions

Route 53 only answers the question. The browser then connects straight to the load balancer it was given.

Both are failover alias records for example.com, one primary and one secondary, each pointing at a load balancer. An alias can sit at the zone apex, where a CNAME cannot.

With Evaluate Target Health set to Yes, each alias record takes its health from the load balancer it points at, so no separate health check is created for it. AWS recommends exactly that for any resource an alias can point at.

Failure simulation

Lose the primary Region

Failover records with health checks, TTL 60 seconds

UsersServed by Primary site

us-east-1

eu-west-1

Click a node to make it fail. The timings in the log are the real ones, played 25× faster.

Everything is up. Take a node or a whole zone down.

Where the time goes. Health checkers need three failures in a row, 30 seconds apart by default, before the primary is unhealthy: about 90 seconds. Then resolvers that cached the old answer keep handing it out until its TTL runs out, 60 seconds here. A shorter TTL fails over sooner and sends Route 53 more queries.

Faster checks cost more. A 10-second interval finds the failure sooner, at extra charge.

Checking what cannot be reached. Health checkers cannot test an address in a private range. For a private resource, base the health check on a CloudWatch alarm instead.

Security

Who can answer, and for whom

Private hosted zones keep internal names internal. They answer only in the VPCs associated with them. From anywhere else the query goes to the public internet, where those names do not exist.

Resolver DNS Firewall filters the DNS queries your VPCs make, with domain lists and rules you write, so an instance cannot look up a domain you have blocked.

Changing a record is an IAM permission. Whoever can edit the records decides where your users go, so grant it as narrowly as any other.

Cost

How you are charged, not what it costs today

Hosted zones, by the month, with an extra charge for records beyond a standard number.

Queries. Latency, geolocation and IP-based queries cost more than standard ones. Queries for alias records that point at AWS resources, such as load balancers, CloudFront and S3 website endpoints, are free. A CNAME query is charged, and one that points to another Route 53 record is charged as two.

Health checks, with more for endpoints outside AWS and for HTTPS, string matching and the 10-second interval.

Domains, by the year, at a price that depends on the top-level domain.

Prices change, so none are printed here. Check the Route 53 pricing page on aws.amazon.com.

Comparison

Eight routing policies, and alias against CNAME

Policy	Answers with	Choose it when
Simple	The one resource	One resource does the job
Weighted	Resources in the proportions you set	Trying a new version on a share of the traffic
Latency	The Region with the best latency for the user	Resources in several Regions, users everywhere
Failover	The primary, or the secondary when the primary is unhealthy	Active-passive disaster recovery
Geolocation	The resource for the user's continent, country or US state	Language, or rights to show content only in some places
Geoproximity	Resources by their location, with traffic shifted between them if you choose	Moving traffic from one location of yours to another
IP-based	The resource for the address range the query comes from	You know the IP ranges your users come from
Multivalue answer	Up to eight healthy records, at random	Simple spreading, with health checks

Question	Alias record	CNAME record
Allowed at the zone apex, example.com	Yes	No
Points to	Selected AWS resources, or a record in the same zone	Any DNS name
Queries to AWS resources	Not charged	Charged
TTL	The target resource's, not yours to set	Yours to set
Shows in dig as	A or AAAA, the type you chose	CNAME

SAA traps

The phrase in the question, and what it means

point example.com, the zone apex, at a load balancerAn alias record

A CNAME cannot be created at the apex. An alias can, and its queries to AWS resources are free.

send users to the Region that responds fastest for themLatency routing

It answers with the Region that gives each user the best latency.

send a small share of traffic to the new versionWeighted routing

Each record gets its weight's share of the total. A weight of 0 stops traffic to it.

show the content only in countries where the company has the rightsGeolocation routing

It answers by the user's location. Without a default record, unmatched locations get no answer.

show a static maintenance page from S3 if the site goes downFailover routing, with the S3 website as the secondary

The secondary answers only when the primary is unhealthy.

resolve names like db.example.com only inside the VPCA private hosted zone

It answers only queries from the VPCs associated with it.

return several healthy IP addresses and let the client chooseMultivalue answer routing

Up to eight healthy records, picked at random.

health check an instance that has only a private IP addressA health check on a CloudWatch alarm

Route 53 health checkers cannot reach private addresses.

the health check failed quickly, but users kept going to the old siteThe TTL

Resolvers keep a cached answer until its TTL runs out.

Scenario

Exam style, marked when you answer

A company runs its website in us-east-1 behind an Application Load Balancer. A copy in eu-west-1 should serve users only if the primary Region fails. The site is at the zone apex, example.com. What should a solutions architect configure in Route 53?

Practice

Fill the gap, the way the challenges work

The company's domain is example.com, and at the apex it must point to an Application Load Balancer whose addresses change as it scales. The company wants the domain's DNS to run on AWS. What answers the DNS queries for example.com?

Web client· UsersPick a service belowALB· Load balancer

Quick revision

The night before the exam

Three jobs: Registers domains, answers DNS queries, checks health.
Alias: Allowed at the apex; free queries to AWS resources; the target's TTL.
CNAME: Any name, never at the apex, and charged.
Failover: The primary while it is healthy, the secondary when it is not.
Latency and geolocation: The fastest Region; the user's location, with a default record.
Weighted: Weight ÷ total. A weight of 0 stops traffic.
Health checks: Every 30 s, unhealthy after 3 failures, healthy when over 18% agree.
Private hosted zone: Answers only in the VPCs associated with it.

This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.

Checked against

Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.