What routing policies does Route 53 offer, and when is an alias record better than a CNAME?
Show the answer
Say this first
Simple, weighted, latency-based, failover, geolocation, geoproximity, multivalue answer and IP-based. Weighted shifts a percentage of traffic, latency sends users to the closest region by measured latency, failover returns a standby when the primary's health check fails. An alias record points to an AWS resource, works at the zone apex where a CNAME is not allowed, and alias queries to AWS resources are free.
Go deeper
Policies
| Policy | Answers with | Typical use |
|---|---|---|
| Simple | One record set | A single endpoint |
| Weighted | Records in proportion to weights | Canary or blue-green, 90/10 |
| Latency | The region with lowest latency for the resolver | Active-active multi-region |
| Failover | Primary, or secondary if the primary is unhealthy | Active-passive DR |
| Geolocation | By continent, country or US state | Compliance, localized content |
| Geoproximity | By distance with a bias | Shift load between regions |
| Multivalue answer | Up to 8 healthy records | Simple client-side spreading |
| IP-based | By the client's source network (CIDR collections) | Steer known ISPs or offices |
Health checks
- Checkers in several AWS regions probe the endpoint, every 30 seconds by default (10 seconds as an option), and mark it unhealthy after 3 failures by default.
- They run from the internet, so they cannot probe a private IP. For private endpoints, base the health check on a CloudWatch alarm.
- Failover is only as fast as the record TTL lets clients notice. Keep TTLs short (60 seconds or less) on records you expect to fail over.
Alias vs CNAME
- A CNAME cannot sit at the apex (
example.com) because the apex already has SOA and NS records and a CNAME cannot coexist with other data. - An alias is a Route 53 feature that returns the target's A or AAAA records directly, follows the target's address changes, and is free for queries to AWS targets such as ELB, CloudFront and S3 websites.
Private hosted zones
Answer only inside the VPCs they are associated with. Useful for internal names and split-horizon DNS.
They will ask next
Why does latency routing sometimes send a user to the wrong region?
Route 53 sees the recursive resolver's address, not the user's. A user on a far-away public resolver gets the region closest to that resolver. EDNS Client Subnet helps when the resolver sends it.
What is the Azure equivalent?
Traffic Manager, a DNS-based traffic router with priority, weighted, performance, geographic, multivalue and subnet methods. Front Door does it at layer 7 with anycast instead of DNS.
Traps
- Promising instant DNS failover. Clients and resolvers cache answers for the TTL, and some ignore it.
- Pointing a Route 53 health check at a private IP.