Route 53 (DNS)

# 1) Hosted Zone — DNS zone for a domain
aws route53 create-hosted-zone \
    --name example.com \
    --caller-reference $(date +%s)

# Output includes name servers (NS records) — give these to your domain registrar

# 2) Common record types
#   A      — IPv4 address
#   AAAA   — IPv6 address
#   CNAME  — alias to another DNS name (cannot be on apex)
#   ALIAS  — Route 53-specific; can be on apex; points to AWS resources
#   MX     — mail servers
#   TXT    — arbitrary text (SPF, DMARC, verification)
#   NS     — name servers
#   SOA    — start of authority
#   PTR    — reverse DNS
#   SRV    — service location
#   CAA    — certificate authority authorization

# 3) Add an A record
aws route53 change-resource-record-sets --hosted-zone-id Z1ABCDEF --change-batch '{
    "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
            "Name":            "www.example.com",
            "Type":            "A",
            "TTL":             300,
            "ResourceRecords": [{"Value":"192.0.2.1"}]
        }
    }]
}'

# 4) ALIAS to a CloudFront distribution / ALB / S3 website
aws route53 change-resource-record-sets --hosted-zone-id Z1ABCDEF --change-batch '{
    "Changes": [{
        "Action": "CREATE",
        "ResourceRecordSet": {
            "Name":  "example.com",
            "Type":  "A",
            "AliasTarget": {
                "DNSName":             "d111111.cloudfront.net",
                "EvaluateTargetHealth": false,
                "HostedZoneId":         "Z2FDTNDATAQYW2"      // CloudFront's hosted zone ID
            }
        }
    }]
}'
# ALIAS is free; CNAME would incur DNS queries.
# ALIAS can sit on the apex (example.com); CNAME cannot.

# 5) MX records (mail)
[
    { 'Value': '10 aspmx.l.google.com' },
    { 'Value': '20 alt1.aspmx.l.google.com' },
    { 'Value': '20 alt2.aspmx.l.google.com' }
]

# 6) TXT — DMARC + SPF + verification
# SPF
"v=spf1 include:_spf.google.com -all"

# DMARC (host: _dmarc.example.com)
"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com; pct=100"

# Domain verification (e.g. Google Workspace)
"google-site-verification=abc123XYZ"

# 7) Routing policies

# a) Simple — single record
# (Default; covered above.)

# b) Weighted — split traffic
# 80% to v1, 20% to v2 (canary)
[
    { 'SetIdentifier': 'v1', 'Weight': 80, 'ResourceRecords': [{'Value':'1.2.3.4'}] },
    { 'SetIdentifier': 'v2', 'Weight': 20, 'ResourceRecords': [{'Value':'5.6.7.8'}] }
]

# c) Latency-based — route to closest AWS region
[
    { 'SetIdentifier': 'us-east-1', 'Region': 'us-east-1', 'AliasTarget': { /* US ALB */ } },
    { 'SetIdentifier': 'eu-west-1', 'Region': 'eu-west-1', 'AliasTarget': { /* EU ALB */ } },
    { 'SetIdentifier': 'ap-southeast-2', 'Region': 'ap-southeast-2', 'AliasTarget': { /* AU ALB */ } }
]
# DNS query from London → returns eu-west-1 IP

# d) Geolocation — route by country / continent
[
    { 'SetIdentifier': 'au-only', 'GeoLocation': {'CountryCode': 'AU'}, 'AliasTarget': { /* AU ALB */ } },
    { 'SetIdentifier': 'default',  'GeoLocation': {'CountryCode': '*' }, 'AliasTarget': { /* default */ } }
]

# e) Failover — primary + secondary
[
    {
        'SetIdentifier': 'primary',
        'Failover': 'PRIMARY',
        'HealthCheckId': 'hc-1234',
        'AliasTarget': { /* primary ALB */ }
    },
    {
        'SetIdentifier': 'secondary',
        'Failover': 'SECONDARY',
        'AliasTarget': { /* DR ALB or S3 maintenance page */ }
    }
]
# If primary health check fails → secondary serves traffic

# f) Multivalue answer — DNS-level load balancing (no LB)
# Returns multiple IPs; client picks one
[
    { 'SetIdentifier': 'a', 'MultiValueAnswer': True, 'HealthCheckId': 'hc-a', 'ResourceRecords':[{'Value':'1.2.3.4'}] },
    { 'SetIdentifier': 'b', 'MultiValueAnswer': True, 'HealthCheckId': 'hc-b', 'ResourceRecords':[{'Value':'5.6.7.8'}] }
]

# 8) Health checks
aws route53 create-health-check --caller-reference $(date +%s) --health-check-config '{
    "IPAddress":     "1.2.3.4",
    "Port":          80,
    "Type":          "HTTP",
    "ResourcePath":  "/health",
    "FullyQualifiedDomainName": "app.example.com",
    "RequestInterval": 30,
    "FailureThreshold": 3
}'

# Calculated check — combine multiple checks
# CloudWatch alarm check — fail when an alarm fires

# Attach to a record for failover-style routing

# 9) DNSSEC — sign your zone
aws route53 enable-hosted-zone-dnssec --hosted-zone-id Z1ABCDEF
# Adds RRSIG records; prevents DNS spoofing
# Set up DS record at registrar to chain trust

# 10) Private hosted zones — internal DNS for a VPC
aws route53 create-hosted-zone \
    --name internal.example.com \
    --caller-reference $(date +%s) \
    --vpc 'VPCRegion=us-east-1,VPCId=vpc-abc123'

# Now db.internal.example.com resolves only from inside the VPC
# Great for service discovery without exposing internal IPs

# 11) Domain registration
aws route53domains register-domain --domain-name example.com --duration-in-years 1 \
    --admin-contact file://contact.json \
    --registrant-contact file://contact.json \
    --tech-contact file://contact.json
# Route 53 auto-creates a hosted zone

# 12) Common patterns

# Apex domain → CloudFront (use ALIAS, not CNAME)
example.com → ALIAS → d111111.cloudfront.net

# Subdomain → another zone
api.example.com → CNAME → load-balancer.us-east-1.elb.amazonaws.com
# Or ALIAS if it's an AWS resource

# Email auth
MX     → 10 aspmx.l.google.com
TXT    → 'v=spf1 include:_spf.google.com -all'
_dmarc.example.com TXT → 'v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com'
selector._domainkey.example.com TXT → DKIM key

# Multi-region failover
primary  : ALIAS to us-east-1 ALB (health-checked)
secondary: ALIAS to eu-west-1 ALB (or S3 'site down' page)

# 13) Performance + cost levers
# - TTL: lower (60s) for fast change propagation; higher (3600s) for cost savings
# - ALIAS records are free for AWS resources; CNAME is paid per query
# - Latency-based routing reduces round trips
# - Edge-aware traffic flows: CloudFront → ALB → autoscaling

# 14) Testing
dig +short example.com
dig +short example.com @1.1.1.1                  # query specific resolver
dig +trace example.com                            # full delegation chain
dig MX example.com
dig TXT _dmarc.example.com

nslookup example.com
host -t any example.com

# 15) Common bugs
#   • Forgetting to update name servers at registrar → zone never picks up
#   • CNAME on apex → rejected by spec; use ALIAS
#   • Long TTL during migration → cache delays seeing change
#   • Health check on private resource without IP whitelisting Route 53's IPs
#   • Wildcard records colliding with specific records
#   • Missing CAA records → cert issuance may fail

# 16) Best practices
#   ✅ ALIAS for AWS resources (free queries, supports apex)
#   ✅ Health checks on every record that needs failover
#   ✅ Short TTL (60-300s) during migrations; raise after
#   ✅ CAA record specifying allowed CAs (letsencrypt.org, amazon.com)
#   ✅ SPF + DKIM + DMARC for email auth
#   ✅ DNSSEC for high-value domains
#   ✅ Private hosted zones for internal service discovery
#   ✅ Tag records (Project, Environment) for cost tracking
#   ✅ Use Route 53 Resolver for hybrid VPC ↔ on-prem DNS

# Managed DNS + health checks + traffic policies.
aws route53 list-hosted-zones