Purpose of This Lesson

Amazon Route 53 is AWS’s managed DNS service. For CloudOps and reliability scenarios, the important skill is choosing the correct hosted-zone type and routing policy for the required traffic behavior, such as weighted testing, regional latency optimization, automatic failover, geographic routing, or simple DNS resolution.

Key Concepts

Route 53 Capabilities

Route 53 provides several related capabilities:

• Domain registration: Register domain names through Route 53.
• Hosted zones: Store DNS records for a domain.
• Health checks: Monitor the health of configured endpoints and use the results in routing decisions.
• Traffic Flow: Manage complex routing configurations when there are many records to maintain.
• Routing policies: Return different DNS answers based on weights, latency, health, geography, proximity, or source IP ranges.

Hosted Zones

A hosted zone is a collection of DNS records belonging to a domain.

A public hosted zone is used for an internet-accessible domain, such as example.com. When a client requests the address for the domain, Route 53 returns the configured DNS answer, such as an IP address. The client can then connect to the endpoint using the returned address.

A private hosted zone is used for internal DNS names, such as mycompany.local, within one or more associated VPCs. Resources in the VPC can resolve internal names such as an application server or database server without making those names publicly available on the internet.

For private hosted-zone resolution to work, the VPC must have DNS hostnames and DNS resolution enabled. The hosted zone must also be associated with the VPC.

Health Checks

Route 53 health checks monitor configured endpoints at intervals. When a routing configuration uses health checks and an endpoint fails, Route 53 can stop returning that endpoint in DNS responses. Health checks are therefore important for routing traffic away from unhealthy resources, especially in failover and multi-endpoint designs.

Account and Provider Migration

Route 53 supports several migration and association workflows:

• Import records when moving from another DNS provider to Route 53.
• Move hosted-zone management between AWS accounts.
• Migrate from Route 53 to another DNS registrar.
• Associate a hosted zone with a VPC in a different AWS account.

For a cross-account VPC association, the VPC owner must authorize the association, and the association must then be created from the second account.

DNS Routing Policies and Their Operational Use

Route 53 routing policies determine which DNS answer is returned. They are more capable than a basic DNS lookup that always returns the same address.

Simple Routing

Simple routing is the standard DNS behavior: a query receives the configured record or records for the name. Use it when no traffic distribution, health-based selection, geographic decision, or regional optimization is required.

Weighted Routing

Weighted routing uses multiple records with the same name and assigns each record an integer weight from 0 through 255. Route 53 distributes responses according to the relative weights.

A common use case is a controlled application rollout. For example, a new application version can receive a small share of DNS traffic while the existing version continues to receive most traffic. Health checks can be associated with the endpoints so unhealthy destinations are excluded from responses.

Weighted routing controls the distribution of DNS answers; it should not be interpreted as an exact per-request traffic guarantee.

Latency-Based Routing

Latency routing returns the endpoint that provides the lowest latency for the requesting user, based on AWS’s latency measurements. It is useful when equivalent application endpoints exist in multiple AWS Regions.

For example, a user in Singapore may receive an endpoint in ap-southeast-1, a user in Sydney may receive one in ap-southeast-2, and a user in New York may receive one in us-east-1. Health checks may also be used.

The deciding factor is expected network latency, not simply the geographic distance shown on a map.

Failover Routing

Failover routing defines a primary and a secondary endpoint. Route 53 returns the primary endpoint while its required health check succeeds. If the primary becomes unhealthy, Route 53 returns the secondary endpoint instead.

Health checks are required for failover routing. The primary and secondary targets can use supported endpoint types such as IP addresses or application load balancers.

Geolocation Routing

Geolocation routing selects an endpoint based on the geographic location of the requesting user. It is useful when traffic must be handled differently for users in particular countries or regions.

For example, users in Mexico may be routed to an endpoint in us-east-1, while users in New Zealand may be routed to an endpoint in ap-southeast-2. Health checks are optional.

Geolocation routing is based on the user’s location, not the location of the deployed resources.

Geoproximity Routing

Geoproximity routing routes users based on the geographic location of the resources. It can also support shifting traffic between locations. This makes it useful when an organization needs geographic control over how much traffic is directed toward resources in different locations.

The distinction from geolocation routing is important: geolocation focuses on the user’s location, while geoproximity focuses on resource locations and can be used to shift traffic between them.

Multivalue Answer Routing

Multivalue answer routing returns up to eight healthy records selected at random for a DNS query. It can provide simple load-distribution behavior across multiple endpoints.

Health checks can be used so that only healthy records are returned. This is not the same as using a dedicated load balancer; it is DNS-level selection among healthy records.

IP-Based Routing

IP-based routing uses a CIDR collection and CIDR locations. Records are selected according to the source IP address of the request and the CIDR range to which that source belongs.

Use this policy when routing decisions must be based on known client IP blocks rather than general geographic location.

Exam- or Assessment-Relevant Takeaways

• A public hosted zone serves publicly resolvable internet domains; a private hosted zone serves internal names through associated VPCs.
• Private hosted-zone scenarios require VPC DNS hostnames and DNS resolution to be enabled.
• Weighted routing is the natural choice for gradual releases, canary-style traffic distribution, or controlled traffic percentages.
• Latency routing chooses the endpoint expected to have the lowest latency for the user.
• Failover routing uses a primary and secondary endpoint and requires health checks.
• Geolocation routing makes decisions based on the user’s geographic location.
• Geoproximity routing makes decisions based on resource locations and supports traffic shifting between locations.
• Multivalue answer routing can return up to eight randomly selected healthy records.
• IP-based routing uses source IP ranges defined in CIDR collections.
• Do not confuse DNS routing with application-layer load balancing. Route 53 chooses DNS answers; it does not replace every function of a load balancer.
• Cross-account private hosted-zone association requires authorization in the VPC-owning account and creation of the association in the other account.

Tool / Feature Decision Guide

Requirement	Route 53 choice	Decisive reason
Resolve an internet-facing domain	Public hosted zone	The domain must be publicly resolvable.
Resolve internal application and database names in a VPC	Private hosted zone	Internal records should be available through associated VPCs rather than the public internet.
Send a controlled portion of traffic to a new version	Weighted routing	Relative record weights distribute DNS answers.
Send users to the best-performing regional endpoint	Latency routing	Selection is based on expected latency for the user.
Use a primary endpoint and direct traffic elsewhere when it fails	Failover routing with health checks	Health status determines whether the primary or secondary answer is returned.
Route users according to country or region	Geolocation routing	The decision is based on the user’s location.
Route based on resource location and shift traffic between locations	Geoproximity routing	The policy considers resource locations and supports traffic shifting.
Return several healthy endpoints for simple DNS-level distribution	Multivalue answer routing	Up to eight healthy records can be returned, selected at random.
Route known source networks to specific targets	IP-based routing	CIDR collections map source IP ranges to routing targets.
Use ordinary DNS resolution without special selection logic	Simple routing	No distribution, health, latency, or geographic decision is needed.

Common Traps / Misconceptions

• Private does not merely mean an unusual domain suffix. A private hosted zone must be associated with a VPC, and VPC DNS hostnames and DNS resolution must be enabled.
• Geolocation and geoproximity are not interchangeable. Geolocation uses the user’s location; geoproximity uses resource locations and can shift traffic between them.
• Failover requires health checks. A primary/secondary label by itself does not provide health-based failover.
• Weighted routing is not an exact traffic meter. Weights are relative values from 0 to 255 that influence DNS-answer distribution.
• Multivalue answer routing is not a full load balancer. It returns a random subset of healthy DNS records rather than managing application connections and session behavior.
• A hosted zone is not the same as a domain registration. Registration establishes ownership or registrar management, while the hosted zone stores DNS records.
• Latency routing is not simply nearest-region routing. The policy uses expected network latency, which may not match the visually closest AWS Region.
• Health checks affect DNS responses, not the underlying endpoint. A failed check causes Route 53 to stop returning the endpoint in applicable routing configurations; it does not repair the resource.

Real-World Engineer / Analyst Notes

• Start a Route 53 troubleshooting investigation by separating the problem into domain registration, hosted-zone authority, record configuration, VPC association, and endpoint health. These are related but distinct layers.
• For private DNS incidents, verify both the hosted-zone-to-VPC association and the VPC DNS settings before changing records.
• When designing regional resilience, define the desired behavior first: lowest latency, geographic policy, explicit primary/secondary failover, or controlled traffic percentage. The correct routing policy follows from that requirement.
• Health checks should be meaningful for the service being protected. A responding network endpoint is not necessarily a healthy application, so the monitored endpoint and check behavior should reflect the operational failure you need to detect.
• Weighted routing is useful during migration and rollout, but DNS caching and resolver behavior mean observed traffic may not match the configured weights immediately or exactly.
• In cross-account environments, document which account owns the VPC, which account owns the hosted zone, and where authorization and association actions must occur.

Quick Reference Summary

• Route 53 provides domain registration, hosted zones, health checks, and Traffic Flow.
• Public hosted zones support internet DNS; private hosted zones support internal VPC DNS.
• Private hosted zones require VPC association plus enabled DNS hostnames and DNS resolution.
• Simple routing returns standard DNS answers.
• Weighted routing distributes answers by relative weights from 0 to 255.
• Latency routing chooses the lower-latency endpoint.
• Failover routing uses a health-checked primary and secondary.
• Geolocation routes according to the user’s location.
• Geoproximity routes according to resource locations and can shift traffic.
• Multivalue answer routing returns up to eight randomly selected healthy records.
• IP-based routing uses source CIDR ranges.

Flashcards

Q: A company needs internal DNS names for an application server and database inside a VPC. Which hosted-zone type should it use, and what VPC conditions are required?

A: Use a private hosted zone associated with the VPC. VPC DNS hostnames and DNS resolution must be enabled.

Q: When should weighted routing be selected instead of latency routing?

A: Choose weighted routing when you need controlled relative distribution, such as sending a small share of traffic to a new application version. Choose latency routing when the goal is to send users to the endpoint with the lowest expected latency.

Q: What does a Route 53 health check do when an endpoint fails in a routing configuration that uses health checks?

A: Route 53 stops providing that endpoint’s address in applicable DNS responses. The health check influences DNS selection; it does not repair the endpoint.

Q: What is required for Route 53 failover routing?

A: A primary endpoint, a secondary endpoint, and health checks. Route 53 returns the primary while it is healthy and returns the secondary when the primary fails its health check.

Q: A user in one country must always receive a designated regional endpoint, even if another endpoint might have lower latency. Which policy fits this requirement?

A: Geolocation routing, because it bases the decision on the user’s geographic location rather than measured latency.

Q: How does geoproximity routing differ from geolocation routing?

A: Geolocation routes based on the user’s location. Geoproximity routes based on resource locations and can shift traffic between those locations.

Q: What does the weight value represent in weighted routing?

A: It is a relative routing value using an integer from 0 through 255. The relative weights influence how frequently records are returned; they are not an exact per-request guarantee.

Q: When is multivalue answer routing useful?

A: It is useful for simple DNS-level distribution across multiple endpoints, returning up to eight randomly selected healthy records when health checks are configured.

Q: What information does IP-based routing use to select a target?

A: It uses the source IP address of the request, matched against CIDR ranges in a CIDR collection and associated CIDR locations.

Q: A DNS design has no traffic distribution, health, latency, or geographic requirement. Which routing policy is appropriate?

A: Simple routing, because ordinary DNS resolution is sufficient.

Q: What is the distinction between a domain registration and a hosted zone?

A: Registration manages the domain name through a registrar. A hosted zone contains the DNS records that define how the domain name resolves.

Q: What steps are needed to associate a Route 53 hosted zone with a VPC in another AWS account?

A: The association must be authorized by the account that owns the VPC, and the association must then be created in the second account.

Q: A rollout requires approximately 10–20% of DNS responses to reach a new application version while the old version remains primary. Which feature should be used?

A: Weighted routing, assigning a smaller relative weight to the new version and a larger weight to the existing version.

Practice Questions

Question 1

An organization runs the same application in several AWS Regions. Its requirement is to route each user to the endpoint expected to provide the lowest network latency. Which Route 53 policy should the CloudOps engineer choose?

A. Geolocation routing
B. Latency-based routing
C. Failover routing
D. Weighted routing

Correct answer: B. Latency-based routing

Explanation: The decisive requirement is lowest expected latency. Geolocation uses the user’s geographic location, while weighted and failover routing serve different purposes.

Question 2

A company wants db.mycompany.local to resolve only for resources in selected VPCs. The hosted zone exists, but instances cannot resolve the name. Which configuration should be checked first?

A. Whether the domain was registered publicly
B. Whether VPC DNS hostnames and DNS resolution are enabled and the zone is associated with the VPC
C. Whether weighted records use values between 0 and 255
D. Whether Traffic Flow is enabled

Correct answer: B. Whether VPC DNS hostnames and DNS resolution are enabled and the zone is associated with the VPC

Explanation: Private hosted-zone resolution depends on VPC association and the required VPC DNS settings. Public registration and Traffic Flow are not prerequisites for this internal lookup.

Question 3

An application has a primary endpoint in us-east-1 and a standby endpoint in eu-west-1. The organization wants Route 53 to return the standby only when the primary fails its health check. Which design is correct?

A. Weighted routing with equal weights
B. Geoproximity routing without health checks
C. Failover routing with the primary and secondary roles plus health checks
D. Multivalue answer routing with eight records

Correct answer: C. Failover routing with the primary and secondary roles plus health checks

Explanation: Explicit primary/secondary behavior controlled by endpoint health is the failover-routing use case, and health checks are required.

Question 4

A team is releasing a new application version and wants to expose it to a small portion of DNS traffic before increasing its share. Which choice best matches the requirement?

A. Weighted routing with relative weights assigned to the old and new records
B. Simple routing with one record
C. Geolocation routing based on the user’s country
D. IP-based routing with a single CIDR location

Correct answer: A. Weighted routing with relative weights assigned to the old and new records

Explanation: Weighted routing supports controlled relative distribution across records with the same name, making it suitable for gradual releases.

Question 5

A company needs to route users according to where its application resources are located and wants the ability to shift traffic between resource locations. Which policy should be evaluated?

A. Geolocation routing
B. Geoproximity routing
C. Multivalue answer routing
D. Simple routing

Correct answer: B. Geoproximity routing

Explanation: Geoproximity routing uses resource locations and supports shifting traffic between locations. Geolocation routing instead focuses on the user’s location.

WordPress Metadata

Suggested Slug:
aws-route-53-dns-hosted-zones-routing-policies

Meta Description:
Study AWS Route 53 domain management, public and private hosted zones, health checks, cross-account associations, and DNS routing policies for CloudOps operations.

Tags:
AWS, Amazon Route 53, DNS, Hosted Zones, Health Checks, DNS Routing Policies, High Availability, Disaster Recovery, AWS VPC, CloudOps