Amazon Route 53 · DNS · Health checks · Hybrid resolution

DNS that answers every query with a healthy endpoint

Route 53 runs authoritative DNS for public domains, private DNS inside VPCs, and hybrid DNS exchanged with on-premises, all in one service. It factors health check results into its answers so traffic doesn't go to failed endpoints.

See routing policies See the hybrid DNS design
dig · Multivalue answerexample.com
$ dig +noall +answer app.example.com A
app.example.com.	60	IN	A	192.0.2.10
app.example.com.	60	IN	A	198.51.100.20
Routing policyMultivalue
Health check2 / 3 healthy
TTL60 s
100%

Hosted zone availability SLA (monthly)

8

Routing policy types

10 s

Fast health check request interval (default 30 s)

DoH

Encrypted DNS transport for Resolver endpoints

Why Route 53

DNS is the first hop of every connection

If name resolution fails, the service stops even when the network is healthy. Design the availability of authoritative DNS, the health information reflected in answers, and the resolution paths between VPCs and on-premises together.

Available

Authoritative DNS built for availability

The SLA commits to 100% monthly availability per hosted zone. With accelerated recovery turned on, you can change public records again within an hour even during a us-east-1 outage.

Aware

Answers that know health

Combine health checks with routing policies so only healthy endpoints appear in answers.

Hybrid

One resolution path

Resolver endpoints and rules let VPC and on-premises DNS resolve each other's domains.

Resolution scope

Who answers a query, depending on where it's asked

Within Route 53, the component that answers depends on where the query comes from.

PublicInternet

Public hosted zones

Answer as the authoritative server for queries from recursive resolvers on the internet. Each record can have a routing policy and a health check.

Authoritative DNSAlias recordRouting policyHealth check
VPCPrivate

VPC Resolver · Private hosted zones

Instances in a VPC query the VPC Resolver at the VPC+2 address. It resolves private hosted zones associated with the VPC, VPC-internal names such as EC2 instances, and public domains.

VPC+2Private hosted zoneDNS FirewallQuery logging
HybridOn-premises

Resolver endpoints · Rules

Inbound endpoints accept queries from on-premises, and outbound endpoints forward domains that match forwarding rules to your corporate DNS. They run over Direct Connect or Site-to-Site VPN.

Inbound endpointOutbound endpointForwarding ruleDo53 / DoH

Routing policies

Eight routing policies

Choose a policy when you create a record, and Route 53 uses it to pick the value to return for each query.

Route 53 routing policies compared
PolicyDecision basisTypical use case
SimpleReturns the values in the record as isA single resource, such as one web server
WeightedWeight ratio assigned to each recordGradual cutover that sends part of the traffic to a new version
LatencyThe AWS Region with the lowest latency for the userThe same service deployed in multiple Regions
FailoverHealth check status of the primaryActive-passive disaster recovery
GeolocationUser location (continent, country, US state)Country-specific content, regulatory geo-restrictions
GeoproximityResource location and bias valueShifting the traffic share between Regions based on distance
Multivalue answerReturns up to 8 healthy records at randomSimple DNS-level distribution with health checks
IP-basedCIDR collection containing the query source IPAssigning endpoints per ISP or corporate range

Features

Main features

Health checks

Health checks

Check endpoints over HTTP, HTTPS, or TCP, or create calculated checks that combine other health checks and checks based on CloudWatch alarms. You can also match a string in the HTTP response body.

Hybrid DNS

Resolver endpoints

Created as ENIs in VPC subnets and require at least two IP addresses. Placing them in two or more Availability Zones is recommended. Inbound supports Do53, DoH, and DoH-FIPS; outbound supports Do53 and DoH. You can also create delegation endpoints that receive subdomains delegated by NS records.

Forwarding

Resolver rules

Decide, per domain, which DNS servers receive queries. Besides forwarding rules, delegation rules hand subdomains to your corporate DNS. Associate rules with VPCs and share them with other accounts through AWS RAM.

DNS security

DNS Firewall

Applies ALLOW, ALERT, or BLOCK to outbound queries through the VPC Resolver based on domain lists. DNS Firewall Advanced detects DNS tunneling and DGA domains, and you can add Palo Alto Networks Advanced DNS Security rules.

Multi-account

Route 53 Profiles

Bundle private hosted zones, Resolver rules, DNS Firewall rule groups, interface VPC endpoints, and query logging configurations into one Profile and apply it to many VPCs and accounts.

Anycast resolver

Route 53 Global Resolver

An internet-reachable anycast resolver that lets authenticated clients resolve public domains and private hosted zones from anywhere. Generally available since March 2026, it accepts IPv4 and IPv6 queries and provides query filtering and centralized logging.

Reference architecture

Hybrid DNS through a shared services VPC

Place Resolver endpoints in a shared services VPC, and deploy rules and private hosted zones to workload VPCs with a Profile. Query direction is the key. Inbound receives aws.corp.internal queries in the on-premises → AWS direction; outbound forwards corp.internal queries to corporate DNS in the AWS → on-premises direction. Queries arriving through the inbound endpoint are resolved in the context of the VPC that holds the endpoint, so the private hosted zone must also be associated with the shared services VPC.

Route 53 hybrid DNS reference architecture Shows DNS query flows in two directions. Inbound (on-premises to AWS): a corporate client asks the corporate DNS server for aws.corp.internal, and the corporate DNS server conditionally forwards it over Direct Connect or VPN to the inbound endpoint ENIs in the shared services VPC. The inbound endpoint hands the query to the VPC Resolver, which finds the answer in the private hosted zone aws.corp.internal. Outbound (AWS to on-premises): an EC2 instance in a workload VPC asks the VPC Resolver at the VPC+2 address for corp.internal; when it matches a forwarding rule, the VPC Resolver sends the query through the outbound endpoint ENIs in the shared services VPC to the corporate DNS server across DX or VPN. Responses return along the same path in reverse. A Route 53 Profile associates the forwarding rules, private hosted zones, and DNS Firewall rule groups with the workload VPCs. ON-PREMISES AWS REGION SHARED SERVICES VPC WORKLOAD VPCs DX / VPN Corp clientaws.corp.internal? Corp DNS serverauth corp.internalcond. fwd aws.* inbound: on-prem → AWS Inbound endpointENI × 2 AZ Outbound endpointENI × 2 AZ outbound: AWS → on-prem Private zoneaws.corp.internal VPC Resolver.2 address per VPCRegional service Forwarding rulecorp.internal DNS FirewallRule group · query filter Workload VPC A · BEC2 → VPC+2 query10.1.0.0/16 · 10.2.0.0/16 Route 53 ProfileRules·PHZ·Firewall in one ① query ② cond. forward ③ ④ lookup ❶ ❷ rule match ❸ ❹ to corp DNS
DNS query direction · inbound (on-premises → AWS) DNS query direction · outbound (AWS → on-premises) Profile association Direct Connect / VPN Responses return along the same path in reverse.

On narrow screens, swipe the diagram sideways.

Reference architecture · Global Resolver

Global Resolver: query the same anycast addresses from anywhere

Branches, data centers, and remote users query the same two anycast IPs over the internet, without VPNs or Resolver endpoints. Queries are handled in the nearest of two or more Regions you choose, and if that Region stops, the next-nearest Region takes them on the same addresses. Each Region authenticates the client, applies the filtering rules in the DNS view, and resolves through the private hosted zones associated with the view or through public DNS.

Route 53 Global Resolver reference architecture Branch offices, on-premises data centers, and remote users send Do53, DoT, and DoH queries over the internet to the two anycast IP addresses of Global Resolver. Anycast routing sends each query to the nearest deployed Region, or to the next-nearest Region if that one is unavailable. In each Region, Global Resolver authenticates the client with an access token or an IP-based access source, applies the DNS view's filtering rules to ALLOW, BLOCK, or ALERT the query, and then resolves it through the private hosted zones associated with the view or through public DNS on the internet. Query logs are sent to CloudWatch Logs, S3, or Data Firehose in the observability Region. CLIENT LOCATIONS AWS CLOUD · DEPLOYED IN 2+ REGIONS AWS REGION A AWS REGION B DNS VIEW · SAME CONFIG IN EVERY REGION Branch officeAccess sourceDo53·DoT·DoH Data centerAccess sourcePublic IP·CIDR Remote usersAccess tokenDoH·DoT ① query over internet Anycast IP 2 addresses IPv4 · IPv6 same everywhere ② nearest Region next one on failure Global Resolverauth → policy→ resolve → log Global Resolverauth → policy→ resolve → log DNS filtering rulesALLOW·BLOCK·ALERT · domains · DGA·tunneling Private hosted zonelinked to view · no per-Region association Public domainsinternet recursion · DNSSEC validation Query logs (OCSF)sent to the observability RegionCloudWatch Logs · S3 · Data Firehose ③ ④ ④ ⑤
DNS query direction (client → Global Resolver) Failover to the same anycast IPs on Regional failure Query log delivery ③ policy evaluation after authentication · ④ private/public resolution · responses return along the same path.

On narrow screens, swipe the diagram sideways.

Getting started

Steps to set up hybrid DNS

  1. STEP 1

    Prepare security groups

    Allow TCP and UDP 53 in the endpoint security group. If you use DoH, also open 443.

  2. STEP 2

    Create endpoints

    Create inbound and outbound endpoints in the shared services VPC across two or more AZs.

  3. STEP 3

    Write forwarding rules

    On the outbound endpoint, create rules that send corporate domains such as corp.internal to your corporate DNS server IPs.

  4. STEP 4

    Deploy to VPCs

    Put the rules and private hosted zones in a Profile, associate it with workload VPCs, and share it with accounts through RAM.

  5. STEP 5

    Configure corporate DNS

    Add conditional forwarding on your corporate DNS that sends AWS domains to the inbound endpoint IPs, then verify both directions with dig.

Pricing

Cost components

Route 53 costs are driven by the number of hosted zones, query volume and routing policy type, the number of health checks, and Resolver endpoint ENI hours. In hybrid DNS, the number of endpoint ENIs becomes a fixed cost.

Route 53 charges
ChargeBilling basisNotes
Hosted zonesMonthly charge per hosted zone. Above 10,000 records per zone, a monthly charge per additional recordHosted zones deleted within 12 hours of creation aren't charged.
Standard queriesPer million queries to public hosted zonesQueries to private hosted zones are free. Alias queries to supported AWS targets such as ELB, CloudFront, API Gateway, VPC endpoints, Global Accelerator, and S3 website endpoints are also free.
Policy-based queriesPer million Latency, Geolocation/Geoproximity, and IP-based queries, by typeFor IP-based routing, CIDR blocks beyond 1,000 incur a monthly charge per block.
Traffic FlowMonthly charge per policy recordApplies to policy records created by applying a traffic policy to a domain name.
Health checksMonthly charge per health check. Rates differ for AWS endpoints and other endpoints.Up to 50 health checks for AWS endpoints are free. HTTPS, string matching, fast interval, and latency measurement each add a monthly charge.
Resolver endpointsHourly charge per endpoint ENI, plus per million queries through the endpointRecursive queries resolved within the VPC without passing through an endpoint are free.
DNS FirewallPer million queries from VPCs with rule groups associated, plus a monthly charge per domain in custom domain listsAWS managed domain lists have no domain charge. Advanced rules add an hourly charge per rule group VPC association.
Route 53 ProfilesHourly charge per account per Region (includes 100 Profile-VPC associations), plus an hourly charge per additional associationBeyond 100 Profile-VPC associations, a per-association charge is added.
Global ResolverHourly charge per deployment (first two Regions included, additional Regions charged per Region), plus per million queries above 1 billion per deployment per monthThe hourly rate depends on whether DNS filtering is used. New customers can use a 30-day free trial.
Related costsDomain registration (annual fee by TLD), DNSSEC signing keys, query log storageDNSSEC signing and query logging have no Route 53 charge themselves; they're billed through AWS KMS and CloudWatch Logs, S3, or Data Firehose.

Rates vary by Region and usage. See the Route 53 pricing page for current rates.

Next step

Map out your organization's DNS resolution paths with us

Bring your corporate domains, VPC and account structure, and failover criteria, and we'll review the hosted zone and Resolver design together.

Open the service page Read the developer guide