Our company controls the domain
example.com. We have a partner to whom we would like to delegate the subdomain
sub.example.com, so that they can use it to create any records from and under this node (CNAME, SPF records, etc.). They would like to use Amazon's Route53 DNS service to manage this zone.
As I understand the AWS documentation, what our partner needs to do is:
- create a DNS zone named
- create whatever records they want in this zone.
Then on our side we need to update the NS records for the
sub.example.com subdomain to our partner's DNS service name servers, and voilà, the subdomain is delegated.
But what prevents a malicious company with an account in Amazon Route53 to create its own
sub.example.com zone and use it to conflict with our partner's? I can create a zone named
www.google.com in Route53, surely there's no verification at this point. Is it just AWS Route53 that forces unicity for each pair "name servers / DNS zone", so that no two AWS accounts can have the same zone with the same name servers?