DNS Records and TTL

DNS maps names to data

Route 53 is managed authoritative DNS. A public hosted zone answers the Internet for a domain you own; a private hosted zone answers only within associated VPCs. Route 53 is a global service with a 100% availability SLA.

flowchart LR
  C["Client<br/>app.example.com?"] --> R["Recursive resolver<br/>ISP or 8.8.8.8, cache"]
  R --> ROOT["Root and .com<br/>name servers"]
  ROOT --> NS["Route 53<br/>authoritative zone"]
  NS -- "A 203.0.113.10, TTL 300" --> R
  R --> C
  %% step C: The client asks its resolver; it never talks to Route 53 directly.
  %% step R: The resolver first checks its cache; if the answer is still within its TTL, it replies immediately.
  %% step ROOT: Otherwise it walks the tree: root servers point to .com, .com points to the domain's NS records.
  %% step NS: Route 53 answers authoritatively from the hosted zone.
  %% step C: The client connects to that IP; DNS is not in the data path afterwards.

Record types

TTL

TTL tells a resolver how long to cache an answer. A high TTL reduces queries and cost but slows changes; a low TTL supports faster cutovers at the cost of more queries. Before a planned migration, lower the TTL (for example from 86400 to 60) at least one old-TTL period in advance, switch, then raise it again. Alias records use the target's TTL.

When a client still sees an old value after a change, investigate TTL caching before blaming Route 53 — resolvers, operating systems and browsers can all cache.

Private hosted zones

A private zone resolves names such as db.internal.example.com only inside the VPCs you associate with it, even from other accounts. The VPC needs enableDnsSupport and enableDnsHostnames, and queries go to the VPC resolver at the VPC base address +2 (for example 10.0.0.2). For hybrid networks, Route 53 Resolver endpoints forward queries between the VPC and on-premises DNS.

A private zone must be associated with the correct VPC, and VPC DNS settings must support resolution. If public and private zones share a name, VPC clients see only the private zone's records.

Traps: expecting a change to appear instantly everywhere; forgetting to associate a private zone with the VPC; using CNAME where a MX or Alias is needed.