71

Yes, if you know what you're doing (edit: and everyone else with access to it does, too...), you can ignore this warning. It exists because even large organizations who should know better have accidentally placed private data into public buckets. Amazon will also send you heads-up emails if you leave buckets public in addition to the in-console warnings. ...


57

See a similar issue in Route 53 forum: Unfortunately the 255 character limit per string on TXT records is not a Route53 limit but rather one imposed by the DNS protocol itself. However, each TXT record can have multiple strings, each 255 characters long. You will need to split your DKIM into multiple strings for your TXT record. You can do this via the ...


51

If you're already using Route 53, you can use their proprietary alias "record" to solve this problem. With standard DNS, you cannot do this at all and you have to have a web site send a 301 redirect. Of course, you still need to send the 301 redirects or deal with the fact that some requests will come in without the www (though you should send 301s for SEO ...


42

You can chop it up into chunks of quoted text with a max length of 255 per chunk. You don't have to make each chunk exact. For example, if your value looks something like: "v=DKIM1; k=rsa; p=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyza ...


40

The way described is the way you create multiple records on Route 53. Entering two values in the textarea separated by a newline will result in two distinct records in the DNS. This is why Amazon call it a "record set" - it is a set of records.


37

If you are adding it in the WebUI, then your text box with have multiple entries supported in quotes, one per line. Example: "ms=M23445345" "v=spf1 include:spf.protection.outlook.com -all"


35

You would enter all the TXT values at the same time... even the one that already exists. Example: route53 --zone example.com -c --type TXT --name example.com --values "text1","text2","text3" See here as well: https://superuser.com/questions/573305/unable-to-create-txt-record-using-amazon-route-53


35

The privacy issue featured in ceejayoz's answer is not the only problem. Reading objects from an S3 bucket has a price. You will be billed by AWS for each download from this bucket. And if you have a lot of traffic (or if someone who wants to hurt your business starts to heavily download files all day long) it will quickly become expensive. If you want ...


33

The A-record alias you create has to be the same as the name of the bucket, because virtual hosting of buckets in S3 requires that the Host: header sent by the browser match the bucket name. There's not really another practical way in which virtual hosting of buckets could be accomplished... the bucket has to be identified by some mechanism, and that ...


31

I had to wrap my SPF record in quotation marks for it to work. "v=spf1 include:_spf.google.com ~all"


29

How to I tell the master account to push requests for .testing.example.com down to the child account. The requests are referred, not pushed, but you can achieve the desired outcome by delegating the subdomain to a different set of Route 53 servers from those that host the parent zone. Look at the new hosted zone you created for testing.example.com. This ...


27

Yes, it can be more friendly way. I suggest using cli53 tool, https://github.com/barnybug/cli53 After you setup it, just try cli53 export --full sciworth.com And you get the export zone in bind format.


27

Michael is correct in regards to where your point of confusion is coming from. I'm going to proceed with my usual stuffiness and answer the larger question for those who might happen by from a Google search. Multiple TXT records are completely legal per the DNS standards. Multiple TXT records implementing a specific standard can potentially be illegal, but ...


25

Both CNAMEs and alias records provide a level of indirection, i.e. it's a pointer to another location which requires an additional step to find the answer. The difference is who performs this additional step. With CNAME records the additional step is done by the client. The server simply returns the configured value of the CNAME record, and the client is ...


25

Nah you can't, there's nothing to refer to anyway (e.g. logical ID). Just create your own main table ;-). This is probably one of the reason it can't be used: One way to protect your VPC is to leave the main route table in its original default state (with only the local route), and explicitly associate each new subnet you create with one of the custom ...


24

If you're using the AWS console, then you can associate your desired hostname (e.g., www.example.com) with the IP address of the EC2 instance using a CNAME record to the external DNS name for the instance. For example: Navigate to the hosted zone you created (double click works) Click [Create Record Set] at top Name: www.example.com Type: CNAME Value: ec2-...


23

PTR is for setting up reverse IP lookups, and it's not something you should care about. Remove it. What you need is a CNAME for www: www.domain.com CNAME domain.com 300


21

To make things nice and clear, as some of the GoDaddy help articles are dead wrong: You just need to paste the two records from the server settings into your Route 53 control panel as a new record. The possible deception here is the the GD email panel will tell you you're wrong, but not what is right so you can make it right. Further, their help article ...


19

Good news! AWS has support for IPv6 in CloudFront and S3. AWS currently (2016-04-01) has very limited IPv6 support, only ELBs in EC2 Classic can do IPv6 – and they are being phased out in favour of VPCs. There is no support for IPv6 in Route53, S3, CloudFront, EC2 nodes or VPC-based load balancers (ELBs). Many are waiting for AWS to add IPv6 support, ...


19

There is a recommendation that the SOA serial number use a format that is four digits of year, two digits of month, two digits of day and two digits of count of changes in the same day. This format is common, but far from universal (look at .COM for a high-profile example of a zone that doesn't). The tool you got the error message from is oversensitive and ...


18

Turns out I didn't try TTL and DependsOn. Works with both of those.


17

A engineer on the Route 53 team informed me that creating the proprietary alias can be created in the Route 53 Console (the GUI). Here are the steps. click create record set for zone apex record just leave the name field blank select the type of alias you want to make A or AAAA (all steps after this are the same for both types) Select the yes radio button. ...


17

This is addressed in Controlling User Access with IAM, specifically in Route 53 ARNs: Resource is either hostedzone or change, and ID is the ID of the hosted zone or the change. The following are examples of a hosted zone ARN and a change ARN, respectively. arn:aws:route53:::hostedzone/Z148QEXAMPLE8V arn:aws:route53:::change/C2RDJ5EXAMPLE2 ...


17

Route53 alias records is an own concept separate from DNS protocol record types: e.g. A is an address record and CNAME is a canonical name record. CNAME is the one that acts like an alias pointing to the canonical name, while A has nothing to do with aliases. (See RFC 1035.) An alias record is an internal Amazon specific pointer working on a higher level; ...


16

For poor souls who might have had the same question: you don't need to add NS RRs in Route53 in the hosted zone section. You need to go to your Registered Domains, click the domain you want to modify, and then Add/Edit the name servers there. Those are the domain NSes, and are associated with the registrar, they are different from the ones delegated inside ...


16

The dot at the end is correct. It's a little-known fact, but fully-qualified (unambiguous) DNS domain names have a dot at the end. People running DNS servers usually know this (if you miss the trailing dots out, your DNS configuration is unlikely to work) but the general public usually doesn't. A domain name that doesn't have a dot at the end is not fully-...


15

Short answer - If you don't know reasons yourself, you probably don't need to switch - just stick with whatever you use. Route53 may be more reliable, may be faster, have some features that help integrate it with other AWS services, but you don't need any of it. If you care about the difference between 99.9 and 99.7, or if you care about 100ms vs 150ms, ...


15

It's not actually correct that the SPF RR type is the newer standard (in the context of desired SPF behavior). The experimental phase of the SPF specification had a new record type assigned but the migration path was unclear and it has since been abandoned. The current version of the SPF spec specifically states: SPF records MUST be published as a DNS ...


15

All prices below are current as of 26th June 2017 and may change. Q1: Route53 is a DNS service, not a domain registration service. To host DNS with Amazon, there is a flat fee of $0.50 per month, or $6 per year, per domain for use of the Route53 DNS service. Depending on the number of queries your domain receives, there are additional charges. $0.40 per ...


14

Route 53 DNS record changes propagate in less than a minute, but TTL times will impact on how quickly DNS resolvers check back for updated records. Q. How quickly will changes I make to my DNS settings on Amazon Route 53 propagate globally? Amazon Route 53 is designed to propagate updates you make to your DNS records to its world-wide network of ...


Only top voted, non community-wiki answers of a minimum length are eligible