What is Amazon Route 53? DNS in plain English
Amazon Route 53 is AWS's Domain Name System (DNS) web service: it translates a name like example.com into the IP address a browser needs, lets you register the domain name itself, and checks whether your servers are actually up so it can stop sending visitors to the ones that aren't. Here's the part almost nobody mentions: the name has nothing to do with a highway. AWS says outright that "Route 53" comes from port 53, the network port every DNS server listens on, and from the fact that DNS answers are what route a visitor to your application. It just happens to look like a road sign. If you are a new reader of our site and non tech, don't worry! you can start from here learn aws for free..
Jake runs a phone and computer repair shop, and last spring he built a one-page site to list his repair prices. A customer called to say the site "wasn't working," and Jake spent forty minutes convinced his web host had gone down — when the actual problem was a DNS setting he'd never touched. That's the moment he learned Route 53 existed. His friend Ethan, who's spent a decade building things on AWS, walked him through it over coffee, and most of what follows is that conversation, cleaned up.
"So it's like... the phone book for the internet?" Jake asked. Ethan nodded. "Close enough to start with. You look up a name, it hands you a number. The interesting part is everything Route 53 does around that lookup."
The Three Jobs Route 53 Actually Does
Amazon's own documentation is specific about this: Route 53 performs three main functions, and you can use any combination of them. You don't have to use all three, and using one doesn't obligate you to the others.
1. Domain registration
Your website needs a name — example.com — before anything else can happen. Route 53 can register that name for you. Amazon Route 53 acts as a domain reseller for Amazon Registrar and its registrar associate, Gandi, meaning it isn't itself the registry that owns every top-level domain (TLD); it's the storefront that processes your registration with the accredited registry behind each TLD.
2. DNS routing
Once a name exists, something has to answer "where does this name point?" That's the DNS half of the job — the part most people mean when they say "Route 53 is DNS."
3. Health checking
Route 53 can send automated requests to your servers to check whether they're reachable, available, and functional, and it can route traffic away from ones that fail those checks. This is the piece most beginner explanations skip, and it's the piece that actually keeps a site up during a partial outage.
♂️ Jake's Reality Check
"Do I have to move my domain to Amazon to use any of this?"
No. AWS's own documentation describes these as functions you can use "in any combination." Plenty of people register a domain with GoDaddy or Namecheap and only use Route 53 for the DNS routing and health checking — you just point your existing registrar's nameserver settings at the four name servers Route 53 gives you.
How a Domain Name Actually Turns Into a Web Page
"Walk me through what happens when I type your shop's URL," Jake said. Ethan grabbed a napkin.
A DNS query is a request — usually sent the instant you type a domain into a browser — asking "what's the IP address for this name?" That request doesn't go straight to Route 53. It first hits a DNS resolver, typically run by your internet service provider, which acts as the go-between. The resolver is also called a recursive name server, because it works its way down a chain of authoritative name servers until it gets an answer, then hands that answer back to your browser.
For any domain that uses Route 53, Route 53's name servers are the authoritative name servers — the ones with the final, definitive answer. When a Route 53 name server gets a request for www.example.com, it looks in the hosted zone for that domain, finds the matching record, and returns the value, such as an IP address of 192.0.2.33.
Route 53 splits this work into a control plane and a data plane, and the split matters more than it sounds. The control plane is where you create, update, and delete records — it's optimized for consistency and it runs out of the US East (N. Virginia) Region, with the console failing over to US West (Oregon) if that Region has a problem. The data plane is the part that actually answers DNS queries in real time, and it's built for availability: it runs across more than 200 points of presence worldwide and is designed to keep answering queries even during a rare event that knocks out the control plane. That's a deliberate trade-off. It means that during a bad control-plane day, your existing DNS records keep resolving normally — you just can't create new ones or edit old ones until the control plane recovers.
✅ Why this is worth understanding before you build anything
If someone tells you "Route 53 went down and my site went with it," ask which plane they mean. Existing DNS answers are the part designed to survive; the ability to make changes is the part with a single-Region dependency.
Hosted Zones and Records, Explained
A hosted zone is a container for all the DNS records that belong to one domain and its subdomains — example.com, www.example.com, and seattle.accounting.example.com would all live in the same hosted zone if they're all under example.com. Route 53 automatically creates a hosted zone whenever you register a domain through it, and every hosted zone gets exactly four authoritative name servers.
Inside that hosted zone, each individual instruction — "route www to this IP address," "route mail to that server" — is a record. Here are the record concepts you'll run into constantly:
| Concept | What it does | Example |
|---|---|---|
| A record | Points a name at an IPv4 address | example.com → 192.0.2.44 |
| AAAA record | Points a name at an IPv6 address | example.com → 2001:0db8:85a3::abcd:1:2345 |
| Alias record | Route 53's own record type; points a name at an AWS resource, updating automatically as that resource's IP changes | example.com → a CloudFront distribution |
| Subdomain | A name with a label prepended to your registered domain | www.example.com, shop.example.com |
| TTL (time to live) | How long, in seconds, a resolver caches a record's answer before asking again | A longer TTL cuts your query charges; a shorter one speeds up how fast changes take effect |
A hosted zone includes up to 10,000 records at no extra charge; go past that and Route 53 bills $0.0015 per additional record, per month. The default quota is 500 hosted zones per AWS account, though that's a request-a-higher-limit ceiling, not a hard wall.
Alias Records vs. CNAME — Why This Actually Matters
"Every guide I've read says to use a CNAME," Jake said. "Why does AWS keep pushing this 'alias' thing instead?"
Ethan: "Because a CNAME has a rule that breaks the one place you actually need it — the bare domain. Standard DNS doesn't let you put a CNAME on the zone apex, meaning example.com itself, only on a subdomain like www.example.com. An alias record doesn't have that restriction, so it's the only way to point your root domain at something like a CloudFront distribution or an Elastic Load Balancer."
Alias records that target specific AWS services — Elastic Load Balancers, CloudFront distributions, Elastic Beanstalk environments, API Gateways, VPC endpoints, S3 buckets configured as website endpoints, App Runner, AppSync, OpenSearch, Lightsail, and Global Accelerator — don't incur a DNS query charge at all. That's a real cost difference, not a marketing line: a CNAME-based setup pays per query, an alias record to one of those services doesn't.
✅ Why this is the one to use
If you're routing to an AWS-hosted target, use an alias record over a CNAME, full stop — it works on the apex domain, it tracks target IP changes automatically, and it's free where a CNAME would cost you.
The Eight Routing Policies — and Which One You Actually Need
A routing policy is a setting on a record that decides how Route 53 answers when multiple possible responses exist. Every record you create picks one.
| Policy | Use it when |
|---|---|
| Simple | One resource does the whole job — a single web server for the domain |
| Failover | You want active-passive failover between a primary and a backup |
| Geolocation | You want to route based on where your users physically are |
| Geoproximity | You want to route by where your resources are, and optionally shift traffic gradually between locations |
| Latency-based | You have resources in multiple AWS Regions and want the fastest one for each user |
| IP-based | You know the specific IP ranges your traffic originates from and want to route by that |
| Multivalue answer | You want up to eight healthy records returned at random for simple client-side load spreading |
| Weighted | You want to send traffic to multiple resources in proportions you set — useful for gradual rollouts |
Almost every small site should start with Simple, and most people never need to leave it. Latency-based, geolocation, and geoproximity routing all cost more per query than Simple routing does, so reach for them only when you actually have resources spread across Regions or a real reason to care where a user is sitting.
Route 53 vs. Route 53 VPC Resolver — the Confusion That Trips Up Even Experienced People
"I saw 'Route 53 Resolver' mentioned in the console and thought it was a different product," Jake admitted.
Ethan: "It's easy to mix up because the name overlaps, but they solve different problems. Everything we've talked about so far — hosted zones, records, routing policies — is public authoritative DNS. VPC Resolver is the piece that answers DNS questions from inside your Amazon VPCs: local EC2 hostnames, your private hosted zones, and recursive lookups out to the public internet. It's on by default in every VPC, at a special VPC+2 address, and you never have to set it up."
What changed between versions
- Before: this feature was simply called "Route 53 Resolver."
- Now: AWS renamed it "Route 53 VPC Resolver" when it introduced Route 53 Global Resolver, to keep the two apart.
- What that means for you: if a guide says "Route 53 Resolver" and means the thing that runs inside your VPCs by default, that's today's VPC Resolver — not the newer Global Resolver product.
Where VPC Resolver hits its limits is hybrid setups: on-premises servers that need to resolve AWS names, or AWS resources that need to resolve names on your office network. That's what Resolver endpoints exist for. An inbound endpoint lets queries reach into your VPC from outside; an outbound endpoint lets your VPC forward queries out to an on-premises resolver, over a private connection such as AWS Direct Connect or Site-to-Site VPN. Each endpoint runs at $0.125 per Elastic Network Interface per hour, plus $0.40 per million queries for the first billion queries a month and $0.20 per million after that.
If your Route 53 setup involves both public DNS and a VPC and you want the fuller comparison of what each one is responsible for, this breakdown of Route 53 vs. Route 53 Resolver goes deeper on the hybrid-DNS side than we have room for here.
Health Checks and DNS Failover
A health check is a Route 53 component that monitors a specified endpoint — an IP address, a domain name, or even the alarm state of a CloudWatch alarm — and can notify you or trigger a routing change the moment that endpoint stops answering. DNS failover is what happens next: Route 53 stops handing out the address of the unhealthy resource and starts handing out a healthy one instead, without you touching anything.
New and existing customers get up to 50 free health checks on AWS endpoints within the same account. Past that, a basic health check runs $0.50 a month for an AWS endpoint or $0.75 for a non-AWS one, and optional features — HTTPS, string matching, a faster check interval, latency measurement — each add $1.00 or $2.00 a month depending on the same AWS/non-AWS split. Health checks on Elastic Load Balancing resources and S3 website endpoints don't cost anything at all; AWS provisions those automatically.
⚠️ What this actually breaks
A health check watches one endpoint. If you have a single server behind a Simple routing record and no second server to fail over to, a health check can tell you it's down — it cannot make traffic go anywhere else, because there's nowhere else to send it. Failover routing needs at least two resources to be worth setting up.
If a health check is showing unhealthy and you can't work out why, walking through the specific fixes for an unhealthy Route 53 health check is faster than guessing — it covers the security-group and string-match traps that cause most false failures.
What Amazon Route 53 Actually Costs
There's no upfront fee and no minimum commitment — Route 53 is pay-as-you-go, and for a small personal site the monthly bill is usually a handful of dollars at most.
| Item | Cost |
|---|---|
| Hosted zone (first 25 per account) | $0.50 per zone, per month |
| Hosted zone (each additional) | $0.10 per zone, per month |
| Standard DNS queries | $0.40 per million (first 1 billion/month), $0.20 per million after |
| Latency-based routing queries | $0.60 per million (first 1 billion/month), $0.30 after |
| Geolocation/geoproximity queries | $0.70 per million (first 1 billion/month), $0.35 after |
| Private hosted zone queries | Free |
| Alias queries to supported AWS services | Free |
| Traffic Flow policy record | $50.00 per record, per month |
| Domain registration | Varies by TLD, billed annually |
What changed between versions
- Before: at launch in December 2010, Route 53 charged a flat $1.00 per hosted zone per month with no volume discount, and $0.50 per million queries for the first billion.
- Now: AWS restructured this to the tiered $0.50/$0.10 hosted-zone pricing shown above, in a move it announced as cutting bills by 50–90% for accounts running many zones.
- What that means for you: if you're comparing an old blog post's numbers against what you see in your bill, the old numbers are the 2010 launch price, not what you'll actually be charged.
A hosted zone deleted within 12 hours of creation isn't billed, which is a genuinely useful detail if you're testing a setup and want to tear it down without eating a charge — though any queries it answered in that window still count.
Route 53 vs. a Load Balancer — Different Jobs Entirely
"So Route 53 IS the load balancer?" Jake asked, which is a completely fair guess given how often the two show up in the same sentence.
Ethan: "No — and mixing them up is the single most common mistake I see. A load balancer sits in front of your servers and distributes live traffic between them, connection by connection, in real time. Route 53 sits before that: it answers 'which address do I even send this request to,' and it can point that answer at your load balancer. They're not competitors. Route 53 is usually pointed at a load balancer through an alias record, not instead of one."
The practical distinction: a load balancer reacts within milliseconds and can inspect the request itself; DNS-based routing changes take effect only as fast as cached records expire (that's what TTL controls), and Route 53 has no visibility into the contents of the traffic it's routing — it only knows an address and, if you've set one up, a health check's pass/fail state.
Route 53 vs. Cloudflare and Other DNS Providers
Every major cloud has an equivalent — Route 53 on AWS, and comparable authoritative DNS offerings from other cloud providers, plus dedicated DNS-only companies like Cloudflare. What actually separates them for most people isn't raw DNS speed; it's how deeply the service integrates with the rest of your infrastructure and how its pricing is shaped.
Route 53's real advantage shows up specifically if your resources already live on AWS: free alias-record queries to ELB, CloudFront, S3 website endpoints, and the rest of that list add up fast, and there's no separate account or billing relationship to manage. A general-purpose DNS provider not tied to your cloud can make more sense if your infrastructure is spread across multiple providers and you want one DNS layer that doesn't favor any of them, or if flat-rate pricing with no query metering suits your traffic pattern better than pay-per-query.
Ethan: "I'll say the unpopular part out loud: if you're 100% on AWS already, choosing a non-AWS DNS provider mostly buys you a second login and a second bill for very little upside. If you're multi-cloud, it's a genuinely reasonable call."
Getting Started: Registering or Migrating a Domain
If you're registering a brand-new domain through Route 53, AWS's own recommended order is register the domain, then route traffic, then check health, in that sequence — because each step depends on the one before it.
If your domain is already registered somewhere else and you just want Route 53 to handle the DNS, the process looks different:
- Sign in to the AWS Management Console and open Route 53, then create a public hosted zone for your domain.
- Route 53 automatically generates four name server (NS) values for that zone — write them down exactly as shown.
- Recreate your existing DNS records inside the new hosted zone before you switch anything over, so nothing goes dark mid-migration.
- Log in to your current registrar's dashboard and replace its default nameservers with the four Route 53 name servers from step 2.
- Wait for the change to propagate. This isn't instant — it depends on the TTL your old registrar had set on its own NS records, which you don't control.
- Keep the old DNS configuration untouched (don't delete it) until you've confirmed the new setup is answering correctly, so you have a fast way back if something's wrong.
Domain registration through Route 53 is capped at 20 domains per account by default for newer accounts (older accounts that had a 50-domain default keep it); it's a request-a-higher-limit ceiling, not a hard technical wall.
⚠️ What this actually breaks
Route 53's own SLA explicitly excludes any period in which you weren't using all four of the virtual name servers assigned to your hosted zone. Manually removing or replacing one of the four at your registrar — even by accident — isn't just a resolution risk, it also puts you outside the availability guarantee for that stretch of time.
If you've gone through every step above and the domain still won't resolve, the cause is almost always in the NS records themselves, and this specific walkthrough for a domain not resolving because of an NS record mismatch covers the exact places that check goes wrong.
Security: IAM, DNSSEC, and Who Can Touch Your Records
Route 53 was built from the start to work with AWS Identity and Access Management (IAM), which is what lets you control exactly who in an organization can create, edit, or delete DNS records — a real concern once more than one person has console access, since a single wrong record can take a whole domain offline.
Route 53 also supports DNSSEC signing on public hosted zones, and enabling it costs nothing extra from Route 53 itself — though it does incur AWS Key Management Service (KMS) charges, because DNSSEC needs a private key stored and used to sign your zone. If you'd rather not manage that key per zone, a single customer-managed KMS key can be reused across multiple public hosted zones.
Resolver DNS Firewall is the piece worth knowing about if you're running workloads inside a VPC: it lets you build rule groups that block queries to known-malicious domains and explicitly allow queries to trusted ones, filtering outbound DNS traffic before it ever leaves your VPC.
The Route 53 SLA — What "Highly Available" Actually Guarantees
A lot of pages repeat "Route 53 has a 100% SLA" as if that's still the literal deal. It isn't, and it's worth being straight about that. AWS's current Route 53 SLA, last updated April 16, 2025, sets Monthly Uptime Percentage tiers per hosted zone, with service credits scaled to how far availability fell short — not a flat promise that nothing ever goes wrong:
| Monthly Uptime Percentage | Service Credit |
|---|---|
| Less than 100% but at least 99.99% | 10% |
| Less than 99.99% but at least 99.95% | 25% |
| Less than 99.95% | 100% |
A hosted zone counts as "Unavailable" only during a minute where all four of its assigned name servers failed to answer every query sent to them throughout that minute — a single name server having a bad minute doesn't trigger it, because the other three are still answering. The credit itself is a percentage of your Route 53 query charges for the affected zone, not a cash refund, and it only applies to Route 53's authoritative DNS — the console and API's own availability aren't covered by this particular commitment.
None of this makes Route 53 fragile — the design genuinely does spread answers across a globally distributed network specifically so that no single failure takes the whole thing down. It just means "100% SLA" as a marketing shorthand oversimplifies a policy that's actually more nuanced, and more honest, than that.
Common Mistakes That Break a Route 53 Setup
Most "Route 53 isn't working" problems trace back to one of the same handful of causes. Before you start troubleshooting deeper, check these in order:
- Nameserver mismatch. The NS records your registrar has on file don't exactly match the four Route 53 assigned your hosted zone. Even one character off means queries never reach Route 53 at all.
- Stale TTL expectations. You changed a record and expected it live instantly, but the old value's TTL hasn't expired yet on resolvers that already cached it.
- CNAME on the apex. Trying to point the bare domain at a CNAME target, which standard DNS doesn't allow — use an alias record instead.
- Deleted the wrong hosted zone. Removing a hosted zone that's still referenced by an active domain's nameserver settings takes the domain down immediately.
- Health check false failures. A security group or firewall blocking the health checker's IP ranges, which makes a perfectly healthy server look down.
- Assuming domain registration equals DNS hosting. Registering a domain elsewhere doesn't automatically mean Route 53 is answering for it — you still have to point that registrar's nameservers at Route 53 yourself.
Frequently Asked Questions
What does Amazon Route 53 actually do?
It performs up to three functions, in any combination: registering domain names, routing DNS traffic for a domain by translating names into IP addresses, and checking the health of your resources so it can route traffic away from ones that stop responding.
Is Route 53 just DNS, or is it something more?
It's DNS plus two extra layers most DNS providers don't bundle in: a full domain registrar, and a health-checking system that can trigger automatic failover based on those checks. The core DNS routing is still the part most people use it for.
Why is it called "Route 53"?
AWS states directly that the name comes from port 53 — the network port DNS servers respond to queries on — combined with the fact that DNS answers are what route a visitor's request to your application on the internet. It's a technical reference, not a highway reference.
What is a hosted zone in Route 53?
A container for all the DNS records belonging to one domain and its subdomains. Route 53 gives every hosted zone four authoritative name servers, and it's charged $0.50 a month for each of your first 25 hosted zones, then $0.10 for each additional one.
What's the difference between a public and a private hosted zone?
A public hosted zone answers DNS queries from anywhere on the internet. A private hosted zone only routes traffic for a domain and its subdomains within one or more of your Amazon VPCs, and queries against a private hosted zone are never charged, unlike public hosted zone queries.
What's an alias record, and why use it instead of a CNAME?
An alias record is Route 53's own record type for pointing a name at an AWS resource. Unlike a CNAME, it works on the root/apex domain, it updates automatically if the target's IP address changes, and queries to it are free when the target is one of the supported AWS services, such as CloudFront or an Elastic Load Balancer.
How much does Route 53 cost for a small personal site?
Typically a few dollars a month: $0.50 for one hosted zone, plus $0.40 per million standard DNS queries — a low-traffic personal site usually stays well under a dollar in query charges. Domain registration, if you register through Route 53, is a separate annual fee that varies by TLD.
Do I have to register my domain with Route 53 to use it for DNS?
No. Route 53's three functions can be used in any combination, so you can keep your domain registered with any registrar and simply point that registrar's nameservers at the four Route 53 gives your hosted zone.
What's the difference between Route 53 and Route 53 VPC Resolver?
Route 53 (public authoritative DNS) answers DNS queries from the internet using hosted zones and records you manage. VPC Resolver is a separate, always-on component inside every VPC that handles recursive DNS lookups for resources within that VPC and for private hosted zones. For the full comparison, see Route 53 vs. Route 53 Resolver explained.
What's the difference between Route 53 and a load balancer?
Route 53 answers "which address should this request go to" through DNS, and it typically points at a load balancer using an alias record. A load balancer then distributes live, already-arrived traffic across multiple servers in real time. They work together; one doesn't replace the other.
Is Route 53 better than Cloudflare?
Neither is universally better. Route 53's advantage is deep, often free integration with other AWS services, which matters most if your infrastructure already lives on AWS. A cloud-independent DNS provider can make more sense for multi-cloud setups or flat-rate pricing preferences.
What routing policy should I use if I only have one server?
Simple routing. It's the policy for a single resource performing the whole function for your domain, and it's also the cheapest per-query routing type Route 53 offers.
How do Route 53 health checks work, and what happens when one fails?
A health check sends automated requests to a specified endpoint and tracks whether it's reachable. If it's set up as part of DNS failover and the endpoint fails, Route 53 stops handing out that endpoint's address in DNS answers and hands out a healthy alternative instead. If a check is showing unhealthy unexpectedly, this fix guide for an unhealthy health check walks through the usual causes.
Why isn't my domain resolving after I set up Route 53?
Almost always a mismatch between the NS records at your domain's registrar and the four name servers Route 53 assigned to the hosted zone. This NS-record troubleshooting walkthrough covers where that mismatch usually happens.
What is the Route 53 SLA, and does it really mean 100% uptime?
The current SLA sets tiered Monthly Uptime Percentage targets per hosted zone (99.99%, 99.95%, and below), with service credits scaled to the shortfall, rather than a flat, literal 100% promise. A hosted zone only counts as unavailable during a minute where all four of its name servers failed every query for that entire minute.
How many hosted zones or domains can I have in one account?
The default quota is 500 hosted zones per AWS account, and 20 domain registrations for newer accounts (some existing accounts still have an older 50-domain default). Both are request-a-higher-limit ceilings rather than hard technical caps.
Revision note. Written September 2026, covering Route 53 as it currently works: hosted zones, alias records, the eight routing policies, VPC Resolver, health checks, current pricing, and the SLA as updated April 16, 2025. Pricing tiers, quotas, and the resolver naming are the parts most likely to shift next, so treat the numbers above as a snapshot rather than a permanent fixture. If you're the one staring at a domain that won't resolve at midnight, take a breath — it's almost always one mismatched NS record, and it's fixable.