Study guide
Technical reference and lesson notes
Purpose of This Lesson
Amazon Route 53 is AWS’s highly available DNS service. It can translate domain names into application endpoints, register domains, resolve private names inside VPCs, perform endpoint health checks, and route users according to policies such as latency, geography, weights, or failover state.
For the SAP-C02 exam, Route 53 is important because DNS is often the control plane for multi-Region architectures, blue/green deployments, disaster recovery, and global traffic distribution.
Key Concepts
DNS hierarchy and fully qualified domain names
Applications communicate using IP addresses or service endpoints, while users generally access applications through domain names. DNS resolves a name to one or more records that clients can use to connect to the destination.
A fully qualified domain name (FQDN) identifies a complete location in the DNS hierarchy, such as www.example.com.. The final period represents the DNS root and is normally omitted in user-facing URLs.
The hierarchy is generally interpreted as:
- Root:
. - Top-level domain:
.com - Registered domain:
example.com - Host name or subdomain:
www.example.com
A subdomain is a subdivision of a parent domain, such as support.example.com. A host name is a label used to identify a resource within a zone; in common usage, names such as www may function as host names, subdomains, or both depending on the DNS design.
Hosted zones
A Route 53 hosted zone is a container for records associated with a domain or subdomain.
- Public hosted zone: Contains records resolvable through the public DNS system. It is used for Internet-facing applications.
- Private hosted zone: Contains records resolvable only from associated VPCs through Amazon-provided DNS. It is used for internal services such as
api.internal.example.com.
A private hosted zone must be associated with one or more VPCs. VPC DNS support settings, including DNS resolution and DNS hostnames, must be configured appropriately for workloads to resolve private names.
When a domain is registered with Route 53, AWS can create a public hosted zone and delegate the domain through name server records. Domain registration and DNS hosting are related capabilities but are not the same thing: a domain can be registered with one provider while its authoritative DNS is hosted elsewhere.
Common DNS record types
| Record | Purpose | Typical AWS use |
|---|---|---|
A | Maps a name to an IPv4 address | Pointing a name to an IPv4 endpoint |
AAAA | Maps a name to an IPv6 address | IPv6-enabled applications |
CNAME | Maps one name to another DNS name | Aliasing an application hostname to another hostname |
Alias | Route 53-specific mapping to selected AWS resources or another Route 53 name | Pointing the zone apex to an Application Load Balancer, CloudFront distribution, API Gateway, or S3 website endpoint |
MX | Identifies mail-exchange servers | Email delivery for a domain |
TXT | Stores text values | Domain verification, SPF, and other policy or authorization data |
SRV | Identifies service locations, ports, and priorities | Service discovery for protocols that support SRV |
NS | Identifies authoritative name servers | Delegation and hosted-zone authority |
SOA | Stores start-of-authority information for a zone | Zone metadata and DNS administration |
An important Route 53 distinction is between CNAME and an alias record. A CNAME cannot normally be used at the zone apex, such as example.com, because the apex must contain required records such as NS and SOA. An alias record can be used at the apex for supported AWS targets and does not incur a separate Route 53 query charge for the alias lookup.
Health checks and DNS failover
Route 53 health checks can monitor endpoints such as public IP addresses, load balancers, and other supported targets. A health check can test availability and, depending on configuration, verify an expected response.
Health checks are commonly combined with failover routing:
- A primary record points to the preferred Region or endpoint.
- A secondary record points to the recovery destination.
- Route 53 returns the primary while it is considered healthy.
- If the primary becomes unhealthy, Route 53 returns the secondary.
This is an active-passive DNS failover design. DNS failover does not copy data, start application capacity, or make an otherwise unprepared Region operational. The secondary environment must already be deployed or be capable of being restored, and data replication and recovery automation must be designed separately.
DNS responses can be cached by clients and recursive resolvers. Consequently, failover is not necessarily instantaneous. The record TTL, resolver behavior, client caching, and health-check evaluation all affect how quickly users observe a change.
Route 53 routing policies
Route 53 routing policies determine how records are returned for a DNS query. They are not all load balancers, and their behavior depends on DNS caching and the selected policy.
#### Simple routing
Simple routing returns one or more values associated with a record. It is appropriate when no special routing logic is required. It does not provide health-check-based failover behavior.
#### Failover routing
Failover routing selects a primary or secondary record based on health. It is the usual choice for active-passive disaster recovery or a primary application with a standby environment.
#### Weighted routing
Weighted routing distributes queries according to configured relative weights, such as 90/10 or 80/20. It is useful for:
- Canary releases
- Blue/green deployments
- Gradual migration between environments
- Splitting traffic across Regions or accounts
Weights are applied to DNS responses, not to every individual request. Cached responses mean the actual request distribution may not exactly match the configured percentages.
#### Latency-based routing
Latency-based routing directs users to the AWS Region that Route 53 determines will provide the lowest latency from the user’s location. It is useful for multi-Region active-active applications where each Region can serve traffic.
Latency routing is based on measured network latency, not simply geographic distance. The lowest-latency Region may not be the physically closest Region.
#### Geolocation routing
Geolocation routing selects an answer based on the geographic location of the DNS resolver or client, depending on the available location information. It is useful when requirements are tied to geography, such as:
- Data residency
- Localized content
- Regulatory boundaries
- Country-specific endpoints
Geolocation is policy-based and should not be confused with automatic selection of the fastest endpoint. Default locations can be configured to handle queries that do not match a more specific location.
#### Geoproximity routing
Geoproximity routing routes traffic based on the geographic relationship between users and endpoints. With Route 53 Traffic Flow, administrators can use bias values to expand or shrink an endpoint’s effective geographic area. This allows traffic to be shifted between Regions or endpoints while still using geographic proximity as the basis for routing.
#### Multivalue answer routing
Multivalue answer routing returns multiple healthy record values in response to a query. It can improve availability and provide a basic form of client-side distribution, but it is not a substitute for a fully featured load balancer. Clients and resolvers may select one returned value, and traffic distribution is not centrally controlled.
#### IP-based routing
IP-based routing uses the source IP address of the DNS query to select an answer. It is useful when an organization maintains known mappings between client networks and preferred endpoints. It requires maintaining those mappings and can be affected by resolver behavior, NAT, and the source address visible to Route 53.
Route 53 Traffic Flow
Route 53 Traffic Flow provides a visual and policy-based way to combine routing decisions. It can be used to construct more complex traffic policies involving combinations of latency, geolocation, weighted routing, health checks, and failover.
Traffic Flow is useful when a global application requires layered routing logic—for example, routing European users to European endpoints, applying a canary percentage within that geography, and failing over to another Region when necessary.
Architecture Decision Guide
| Requirement | Preferred Route 53 approach | Important consideration |
|---|---|---|
| One stable DNS name for an AWS resource | Alias record | Use an alias for supported AWS targets and zone-apex records |
| Internal service names in VPCs | Private hosted zone | Associate the zone with the required VPCs and configure VPC DNS support |
| Primary Region with standby recovery Region | Failover routing plus health checks | Prepare the secondary environment and replicate data separately |
| Gradual migration or canary release | Weighted routing | DNS caching means percentages are approximate over short intervals |
| Route users to the best-performing Region | Latency-based routing | Requires independently usable endpoints in multiple Regions |
| Enforce country or Region-specific destinations | Geolocation routing | Configure a default answer and account for resolver location behavior |
| Shift geographic coverage between endpoints | Geoproximity routing and Traffic Flow | Bias changes the effective routing area |
| Return several healthy endpoints | Multivalue answer routing | Provides basic DNS-level distribution, not load-balancer features |
| Route known networks to specific destinations | IP-based routing | Maintain client CIDR mappings and consider recursive resolver effects |
| Register a domain | Route 53 Domains | Registration does not require Route 53 to host the authoritative zone |
Exam-Relevant Takeaways
- Route 53 is both a DNS service and a traffic-management service.
- Public hosted zones support Internet DNS resolution; private hosted zones support DNS resolution from associated VPCs.
- A private hosted zone does not make an application reachable from the Internet.
- Use failover routing with health checks for DNS-based active-passive disaster recovery.
- Use latency-based routing when the goal is performance; use geolocation when the goal is geographic or regulatory control.
- Use weighted routing for controlled traffic percentages, testing, and gradual migrations.
- An alias record is the normal choice for a Route 53 zone apex pointing to a supported AWS resource.
- DNS failover is subject to TTL and resolver caching, so it cannot guarantee immediate redirection.
- Route 53 does not replace application load balancing, data replication, health-aware orchestration, or disaster recovery automation.
- Multi-Region DNS routing requires each selected endpoint to be independently available and able to serve the expected workload.
Common Exam Traps
- Confusing a hosted zone with a domain registration: A hosted zone stores DNS records; registering a domain establishes ownership and delegation.
- Using a CNAME at the apex: Standard CNAME records cannot be used at
example.com; use a Route 53 alias for supported targets. - Assuming latency means geographic proximity: Latency-based routing uses measured network performance, not a simple distance calculation.
- Treating geolocation as performance routing: Geolocation follows location rules and is appropriate for policy or compliance requirements.
- Assuming weighted routing is exact request load balancing: Weights affect DNS responses, while recursive caching changes the observed request distribution.
- Assuming a health check makes an endpoint highly available: Health checks only influence DNS responses. They do not repair, scale, or fail over the application by themselves.
- Ignoring DNS caching during failover: Existing cached answers may continue directing clients to the old endpoint until their TTL expires.
- Confusing multivalue answer routing with ELB: Multivalue routing returns multiple DNS values but does not provide connection-level load balancing, session handling, or application-aware routing.
- Assuming private hosted zones work automatically across all networks: They must be associated with the relevant VPCs, and hybrid environments may require Route 53 Resolver endpoints and forwarding rules.
Real-World Engineer Notes
- Keep DNS TTLs aligned with operational goals. Short TTLs can improve change responsiveness but increase DNS query volume and may not overcome resolver behavior.
- For critical failover, validate the entire recovery path: DNS health checks, application readiness, database promotion, secrets, certificates, networking, capacity, and observability.
- Avoid health checks that only verify that a TCP port is open when the real requirement is application readiness. Where appropriate, check a health endpoint that validates essential dependencies.
- For multi-Region active-active systems, verify that writes, sessions, queues, and data consistency work across Regions. DNS routing alone does not solve state management.
- Use Route 53 Resolver for hybrid DNS designs when on-premises clients must resolve AWS private names or VPC workloads must resolve corporate names.
- Prefer aliases for supported AWS resources because they integrate with AWS endpoint changes and are suitable for zone-apex records.
- Document routing-policy precedence and fallback behavior, especially when combining health checks, weighted records, geolocation, and Traffic Flow.
Quick Reference Summary
- Public hosted zone: Publicly resolvable DNS records.
- Private hosted zone: DNS records resolvable from associated VPCs.
- A record: IPv4 address.
- AAAA record: IPv6 address.
- CNAME: Name-to-name mapping; not normally valid at the zone apex.
- Alias: Route 53 mapping to supported AWS resources or Route 53 names; usable at the apex.
- Failover: Primary/secondary routing based on health.
- Weighted: Percentage-style distribution for releases and migrations.
- Latency: Selects the Region with the best measured latency.
- Geolocation: Selects based on geographic policy.
- Geoproximity: Selects based on endpoint and user geography, with optional bias.
- Multivalue answer: Returns multiple healthy values; basic distribution only.
- IP-based: Selects answers based on source IP mappings.
- Traffic Flow: Combines routing policies into more advanced traffic rules.
Flashcards
- What is the primary function of DNS?
DNS resolves human-readable domain names to records containing addresses or service information that clients can use to connect.
- What is a Route 53 public hosted zone?
A container for DNS records that can be resolved through the public DNS system.
- What is a Route 53 private hosted zone?
A DNS zone resolvable only from associated VPCs through private DNS resolution.
- When should failover routing be used?
When a primary endpoint or Region should receive traffic while healthy and a secondary should receive traffic after failure detection.
- What is the difference between latency and geolocation routing?
Latency routing selects the endpoint with the best measured network latency, while geolocation routing follows geographic rules.
- What is weighted routing useful for?
Canary releases, blue/green deployments, and gradual traffic migration between endpoints.
- Why can a CNAME not normally be used at the zone apex?
The zone apex must contain required records such as NS and SOA, which conflicts with CNAME behavior.
- What Route 53 feature replaces a zone-apex CNAME for supported AWS resources?
An alias record.
- What do Route 53 health checks do?
They evaluate endpoint health and can influence routing decisions such as DNS failover.
- Why is DNS failover not instantaneous?
Recursive resolvers and clients may cache DNS answers until the record TTL or their own caching policy allows a new query.
- What is multivalue answer routing?
A policy that returns multiple healthy record values, providing basic DNS-level distribution.
- What is Route 53 Traffic Flow?
A policy-management capability for combining routing rules such as weighted, latency, geolocation, and failover behavior.
Practice Questions
Question 1
A company runs its customer-facing application in us-east-1 and eu-west-1. Both Regions are active and can serve all users. The company wants each user sent to the Region with the lowest network latency. Which Route 53 configuration is most appropriate?
A. Geolocation routing
B. Latency-based routing
C. Weighted routing with a 50/50 split
D. Failover routing with us-east-1 as primary
Correct answer: B. Latency-based routing
Latency-based routing is designed to select the AWS Region with the best measured latency for the requesting user. Geolocation is appropriate for geographic policy, not necessarily performance.
Question 2
An organization wants to send 5% of production DNS traffic to a new application version and 95% to the current version. The organization accepts that DNS caching may cause short-term deviations from the percentages. Which policy should be used?
A. Weighted routing
B. Geolocation routing
C. Multivalue answer routing
D. Simple routing
Correct answer: A. Weighted routing
Weighted records support controlled traffic percentages and are commonly used for canary and blue/green deployments. The percentages apply to DNS responses and may be affected by resolver caching.
Question 3
A company owns example.com and wants example.com—not www.example.com—to point to an Application Load Balancer using Route 53. Which record type should it use?
A. CNAME record
B. MX record
C. Alias record
D. TXT record
Correct answer: C. Alias record
A standard CNAME cannot normally be placed at the zone apex. A Route 53 alias record can point the apex to supported AWS resources such as an Application Load Balancer.
Question 4
A business has a production application in one Region and a warm standby environment in another Region. It wants DNS to direct users to the standby when the production endpoint fails a health check. Which design best meets the requirement?
A. Simple routing with both endpoints listed
B. Weighted routing with equal weights
C. Failover routing with a primary and secondary record, using health checks
D. Geolocation routing based on the user’s country
Correct answer: C. Failover routing with a primary and secondary record, using health checks
Failover routing provides primary/secondary behavior and can use health checks to stop returning the unhealthy primary endpoint. The standby must still have the required application capacity and data state.
Question 5
A company has internal service names such as payments.internal.example.com. These names must resolve from VPC workloads but must not be publicly resolvable. What should the company configure?
A. A public hosted zone
B. A private hosted zone associated with the required VPCs
C. A public CNAME record
D. A geolocation routing policy
Correct answer: B. A private hosted zone associated with the required VPCs
Private hosted zones provide DNS records for internal VPC resources without publishing those records through public DNS. The zone must be associated with the VPCs that need to resolve the names.