Route 53 vs Cloudflare DNS: Pricing ($0.50 a Zone vs Free), Alias vs CNAME Flattening, Health Checks, Private Zones, Registrar, and When to Use Both

Route 53 vs Cloudflare for DNS: Cloudflare hosts your DNS for free on every plan, including unmetered queries, DNSSEC and CNAME flattening at the root domain, and can also sit in front of your site as a CDN and firewall; Amazon Route 53 charges $0.50 per hosted zone per month plus $0.40 per million queries, and in return is woven into AWS: free alias queries to CloudFront, load balancers and S3, health checks with failover (the first 50 checks of AWS endpoints are free), latency and geolocation routing, and private DNS inside your VPCs, which Cloudflare cannot do. For a website or blog, Cloudflare's free DNS is hard to beat; for infrastructure that lives on AWS, Route 53 is the native choice, and many teams use both. The detail that surprises people: Route 53's 100 percent availability SLA comes with every hosted zone, while Cloudflare's 100 percent uptime SLA starts on the Business plan at $200 a month.

Jake bought the shop's domain years ago from the cheapest registrar he could find, and when Ethan moved the website to AWS, he moved the DNS to Route 53 along with it. A friend who runs a bakery's website asked Jake why he pays for DNS at all. "Mine's free," she said. Jake asked Ethan the same question that evening, and the honest answer took longer than either expected.

This guide compares Amazon Route 53 and Cloudflare as DNS providers and domain registrars: features, prices in October 2026, how each handles a root domain pointed at AWS, traffic routing and failover, what each cannot do, and how to move a domain from one to the other without downtime. For how DNS hosting works on AWS, see what a Route 53 hosted zone is.

Route 53 vs Cloudflare: what each actually is

Both are authoritative DNS providers: they answer the internet's questions about your domain ("what is the address of jakesshop.com?") from large global networks of name servers. Both can also register domains. Past that, they come from opposite directions:

• Route 53 is AWS's DNS service. Its strengths are the AWS connections: alias records that point straight at CloudFront distributions, load balancers, S3 websites and API Gateway, health checks that remove unhealthy endpoints from answers, routing policies (latency, geolocation, weighted, failover), and private hosted zones that answer only inside your VPCs.
• Cloudflare is a global edge network whose DNS is free and fast, and which can optionally proxy your website: with the orange cloud on, visitors connect to Cloudflare, which caches content, blocks attacks and forwards the rest to your server. DNS is the entry point to its CDN, WAF, DDoS protection, Workers and more.

The deciding question is usually not "which DNS is better" but "where do the things my DNS points at live, and do I want Cloudflare's proxy in front of them?"

Route 53 vs Cloudflare DNS: side by side

When Cloudflare is the better choice

• A website, blog or small business site. Free DNS, free TLS certificates at the edge, caching and DDoS protection in one dashboard, with nothing to bill.
• Many domains with low traffic. Fifty parked or small domains cost $15 a month in Route 53 hosted zone fees alone (25 at $0.50, 25 at $0.10), before queries, and nothing in Cloudflare.
• You want a root domain on a non-AWS host (a page builder, a Git-based host): CNAME flattening works for any target, where Route 53 aliases only reach AWS resources.
• You want Cloudflare's proxy features: caching, the WAF, bot protection, Workers, image optimization. Those require Cloudflare to be your DNS (or a partial CNAME setup on paid plans).
• Cheapest domain renewals. Cloudflare Registrar charges the registry's price with no markup.

The bakery's site, a few pages on a website builder, is the textbook case. Jake's friend was right to use Cloudflare; her DNS costs nothing and her site sits behind a CDN she did not have to build. Cloudflare's free tiers extend well beyond DNS.

When Route 53 is the better choice

• Your infrastructure is on AWS. Alias records at the root domain point straight at CloudFront, an ALB, an S3 website or API Gateway, and those alias queries are free; they also follow the target's IP changes automatically.
• You need DNS failover or traffic steering without another product: health checks plus failover, latency or geolocation records are part of Route 53, and checks of AWS endpoints are free up to 50.
• You need private DNS for VPCs: internal names for databases and services, Resolver rules for hybrid networks, and DNS Firewall. Cloudflare has no equivalent inside a VPC.
• Infrastructure as code with the rest of your stack: records live in the same CloudFormation, CDK or Terraform as the resources they point to, under the same IAM permissions and CloudTrail audit.
• An SLA for DNS on any budget: Route 53's 100 percent availability SLA applies to every hosted zone.

Ethan's answer to Jake was the first bullet: the shop's root domain points at a CloudFront distribution through an alias record, the API at a load balancer, and the order database has a private name inside the VPC. Route 53 does all three in one place for about a dollar a month. Custom domain and HTTPS with CloudFront and Route 53 shows that setup.

Route 53 vs Cloudflare pricing, with examples

Route 53 prices from the AWS price list (September 2026): hosted zones $0.50 a month for the first 25, $0.10 after; standard queries $0.40 per million (first billion), latency-based $0.60, geolocation and geoproximity $0.70; queries to alias records that point at AWS resources are free; health checks of AWS endpoints free for the first 50, then $0.50 a month, non-AWS endpoints $0.75. Cloudflare's DNS is included on the Free plan ($0), Pro ($20 a month billed annually), Business ($200) and Enterprise.

For most sites, the DNS bill is a rounding error either way; the real money is in what sits behind DNS. Two cost details matter more than the query price: Route 53's alias queries to AWS resources are free, so a site that answers mostly with aliases pays little more than the zone fee; and on Route 53, a high TTL (how long resolvers cache your answer) directly lowers your query count, while on Cloudflare TTL has no cost effect.

Root domains: Route 53 alias vs Cloudflare CNAME flattening

The DNS standard does not allow a CNAME record at the root of a domain (jakesshop.com, the "zone apex"), only at subdomains like www. Yet CloudFront, load balancers and most hosting platforms give you a hostname to point at, not a fixed IP. Each provider solves it its own way:

• Route 53 alias records look like an A or AAAA record to the outside world, but Route 53 fills in the target's current addresses itself. They work at the root and are free to query, but only for AWS targets: CloudFront, ELB, S3 website endpoints, API Gateway, Global Accelerator, another record in the same zone, and a few more.
• Cloudflare CNAME flattening lets you create a CNAME at the root; Cloudflare resolves the target and answers with its IP addresses. It works for any hostname, AWS or not.

Here is the Route 53 alias for a root domain pointed at CloudFront, as an API request (the shape is checked against the current SDK model, botocore 1.43.118). Z2FDTNDATAQYW2 is the fixed hosted zone ID used for every CloudFront alias:

aws route53 change-resource-record-sets --hosted-zone-id Z0123456789ABC --change-batch '{
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "jakesshop.com.",
      "Type": "A",
      "AliasTarget": {
        "HostedZoneId": "Z2FDTNDATAQYW2",
        "DNSName": "d111111abcdef8.cloudfront.net.",
        "EvaluateTargetHealth": false
      }
    }
  }]
}'

On Cloudflare, the same thing is a CNAME record named @ with the CloudFront hostname as its target. One caution: if you turn the Cloudflare proxy on (orange cloud) for a record pointing at CloudFront, you are putting one CDN in front of another, with two caches and two TLS hops; most setups keep such records DNS only (gray cloud). Alias vs CNAME at the zone apex covers the Route 53 side in depth.

Using Cloudflare DNS with AWS services

Cloudflare DNS works with AWS resources; you just do by hand what Route 53 automates:

1. Point records at AWS hostnames with CNAMEs (flattened at the root): the CloudFront domain, the ALB's DNS name, the API Gateway custom domain target. Never point an A record at an ALB IP; those change.
2. Validate ACM certificates by adding the CNAME records ACM gives you, set to DNS only. A proxied validation record is the most common reason a certificate stays at "Pending validation"; the ACM pending validation guide walks through it.
3. Decide per record whether to proxy. Proxying an ALB adds Cloudflare's WAF and caching but changes client IPs (read them from the CF-Connecting-IP header) and needs your security group to allow Cloudflare's ranges.
4. Keep private names in Route 53. Internal names for RDS, ElastiCache or services inside the VPC still need a Route 53 private hosted zone.
5. Automate it with the Cloudflare Terraform provider alongside your AWS resources, so a new load balancer gets its record in the same change.

Using both: the common split

Many teams end up with a split that plays to each service's strengths: the public domain's DNS on Cloudflare (free, with its proxy and WAF in front of the website), and Route 53 for everything internal to AWS (private hosted zones for service discovery, Resolver for hybrid DNS) plus any subdomain that needs AWS-native failover, delegated to Route 53 with NS records. A domain can delegate a subdomain like api.jakesshop.com to a Route 53 hosted zone while the parent stays on Cloudflare.

That is roughly where Jake's shop landed after the conversation with the bakery: still on Route 53 for now, because everything it points at is on AWS, but with the cheapest-renewal registrar moved to Cloudflare. "So I was paying for DNS that earns its keep, and overpaying for the domain," Jake summarized. Ethan said that was exactly it.

Route 53 vs Route 53 Resolver

Two different things share the Route 53 name, and searches mix them up. Route 53 (public DNS hosting) answers the internet's questions about your domains: hosted zones, records, routing policies, health checks. That is the part this guide compares with Cloudflare. Route 53 Resolver is the DNS resolver inside every VPC (the "VPC + 2" address, also reachable at 169.254.169.253): it answers your EC2 instances, containers and Lambda functions when they look up any name, public or private, and is free for that basic use.

Resolver gets its own price list when you extend it: Resolver endpoints for hybrid networks (an inbound endpoint so on-premises servers can resolve your private AWS names, an outbound endpoint plus forwarding rules so AWS workloads can resolve your on-premises names) cost $0.125 per hour per network interface in US East, with at least two interfaces per endpoint for availability, plus $0.40 per million queries through them; Route 53 Resolver DNS Firewall filters which domains your VPCs may resolve. Cloudflare has no counterpart to any of this, because it never sits inside your VPC. If your instances cannot resolve names at all, the Resolver side is where to look; EC2 cannot resolve DNS names covers it.

Route 53 vs Cloudflare as a domain registrar

• Price. Cloudflare Registrar charges what the registry charges, with no markup, on all plans, from $7.85 a year depending on the TLD. Route 53 Domains has its own price list per TLD, typically above wholesale.
• TLD coverage. Both support the common TLDs; each supports some the other does not. Check your TLD on both lists before moving.
• DNS coupling. A domain registered at Cloudflare must use Cloudflare's DNS. A Route 53 domain can use any DNS provider, including Cloudflare.
• Privacy and locks. Both offer WHOIS privacy and transfer locks at no extra cost where the TLD allows.

You can mix them: register with one and host DNS with the other, as long as the registrar's name server settings point at the DNS host.

Moving DNS from Route 53 to Cloudflare (or back) without downtime

1. Lower TTLs on the records you will change, a day ahead, so caches expire quickly afterward.
2. Export the records from the current provider. From Route 53: aws route53 list-resource-record-sets --hosted-zone-id Z0123456789ABC, then recreate them on the other side (Cloudflare can import a BIND zone file). Alias records have no direct equivalent: turn each into a CNAME (flattened at the root) pointing at the AWS hostname.
3. Turn off DNSSEC first at the registrar and the old provider (check with aws route53 get-dnssec); moving name servers while DNSSEC is on can make the domain fail to resolve for validating resolvers.
4. Compare answers by querying the new provider's name servers directly (dig @NEW-NAMESERVER jakesshop.com) for every important record.
5. Change the name servers at the registrar to the new provider's.
6. Keep the old zone for a few days while caches move over (parent NS records can be cached for up to two days), then delete it, and re-enable DNSSEC on the new provider.

If a domain stops resolving after a move, the registrar's name servers and the hosted zone's NS records usually disagree; Route 53 domain not resolving covers that check.

Which is faster?

Both run large anycast networks, and for most visitors either answers in a few tens of milliseconds; independent DNS benchmarks usually rank Cloudflare among the very fastest authoritative providers. In practice, DNS speed is rarely what users feel: caching resolvers answer repeat lookups locally, and a sensible TTL means most visitors never reach your provider at all. Choose on features and fit, not on a few milliseconds. If you want to measure for your own domain, query each provider's name servers directly with dig @ns-123.awsdns-45.com jakesshop.com or dig @ada.ns.cloudflare.com jakesshop.com from a few locations and compare the query times; the result will vary more with the visitor's location than with the provider.

Troubleshooting by symptom

ACM certificate stuck on Pending validation with Cloudflare DNS

The validation CNAME is proxied or mistyped. Set it to DNS only and copy the name and value exactly.

Root domain will not point at my load balancer on Cloudflare

Use a CNAME at @ (CNAME flattening) to the ALB's DNS name, never an A record with an IP.

Site works on www but not on the root domain in Route 53

Add an alias A record (and AAAA for IPv6) at the root pointing at the same target as www.

Domain stopped resolving after moving DNS

Check that the registrar's name servers match the new provider, and that DNSSEC was disabled before the move.

Client IPs in my server logs are all Cloudflare addresses

The record is proxied. Read the real visitor IP from the CF-Connecting-IP header.

Route 53 bill higher than expected

Check query volume and TTLs. Raise TTLs on stable records and use alias records for AWS targets, which are free to query.

Frequently asked questions

The bakery's site still runs on Cloudflare's free plan, and Jake now recommends it to every shop owner who asks. For his own shop he keeps Route 53, for the alias records and the private names, and he has stopped thinking of the dollar a month as paying for DNS. "It's paying for the bit that knows where everything is," he said, which Ethan thought was a better definition than most textbooks give.

Revision note. Written October 23, 2026. "Don't put all your eggs in one basket," the proverb says; with DNS, two baskets that each do what they are good at is a fine arrangement.