80

Yes, if you know what you're doing (edit: and everyone else with access to it does, too...), you can ignore this warning. It exists because even large organizations who should know better have accidentally placed private data into public buckets. Amazon will also send you heads-up emails if you leave buckets public in addition to the in-console warnings. ...


79

The way described is the way you create multiple records on Route 53. Entering two values in the textarea separated by a newline will result in two distinct records in the DNS. This is why Amazon call it a "record set" - it is a set of records.


77

If you are adding it in the WebUI, then your text box with have multiple entries supported in quotes, one per line. Example: "ms=M23445345" "v=spf1 include:spf.protection.outlook.com -all"


77

See a similar issue in Route 53 forum: Unfortunately the 255 character limit per string on TXT records is not a Route53 limit but rather one imposed by the DNS protocol itself. However, each TXT record can have multiple strings, each 255 characters long. You will need to split your DKIM into multiple strings for your TXT record. You can do this via the ...


60

You can chop it up into chunks of quoted text with a max length of 255 per chunk. You don't have to make each chunk exact. For example, if your value looks something like: "v=DKIM1; k=rsa; p=abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyza ...


54

If you're already using Route 53, you can use their proprietary alias "record" to solve this problem. With standard DNS, you cannot do this at all and you have to have a web site send a 301 redirect. Of course, you still need to send the 301 redirects or deal with the fact that some requests will come in without the www (though you should send 301s for SEO ...


47

How to I tell the master account to push requests for .testing.example.com down to the child account. The requests are referred, not pushed, but you can achieve the desired outcome by delegating the subdomain to a different set of Route 53 servers from those that host the parent zone. Look at the new hosted zone you created for testing.example.com. This ...


46

You would enter all the TXT values at the same time... even the one that already exists. Example CLI: route53 --zone example.com -c --type TXT --name example.com --values "text1","text2","text3" Example WebUI: "txt=ABC123" "txt=CDE456" See here as well: https://superuser.com/questions/573305/unable-to-...


41

Michael is correct in regards to where your point of confusion is coming from. I'm going to proceed with my usual stuffiness and answer the larger question for those who might happen by from a Google search. Multiple TXT records are completely legal per the DNS standards. Multiple TXT records implementing a specific standard can potentially be illegal, but ...


41

The privacy issue featured in ceejayoz's answer is not the only problem. Reading objects from an S3 bucket has a price. You will be billed by AWS for each download from this bucket. And if you have a lot of traffic (or if someone who wants to hurt your business starts to heavily download files all day long) it will quickly become expensive. If you want ...


36

The A-record alias you create has to be the same as the name of the bucket, because virtual hosting of buckets in S3 requires that the Host: header sent by the browser match the bucket name. There's not really another practical way in which virtual hosting of buckets could be accomplished... the bucket has to be identified by some mechanism, and that ...


34

The dot at the end is correct. It's a little-known fact, but fully-qualified (unambiguous) DNS domain names have a dot at the end. People running DNS servers usually know this (if you miss the trailing dots out, your DNS configuration is unlikely to work) but the general public usually doesn't. A domain name that doesn't have a dot at the end is not fully-...


27

Nah you can't, there's nothing to refer to anyway (e.g. logical ID). Just create your own main table ;-). This is probably one of the reason it can't be used: One way to protect your VPC is to leave the main route table in its original default state (with only the local route), and explicitly associate each new subnet you create with one of the custom ...


26

There is a recommendation that the SOA serial number use a format that is four digits of year, two digits of month, two digits of day and two digits of count of changes in the same day. This format is common, but far from universal (look at .COM for a high-profile example of a zone that doesn't). The tool you got the error message from is oversensitive and ...


25

If you are using Google Domains, when you edit the TXT record, there's a plus(+) symbol next to the TXT value... click that to add multiple values.


20

Route53 alias records is an own concept separate from DNS protocol record types: e.g. A is an address record and CNAME is a canonical name record. CNAME is the one that acts like an alias pointing to the canonical name, while A has nothing to do with aliases. (See RFC 1035.) An alias record is an internal Amazon specific pointer working on a higher level; on ...


19

Good news! AWS has support for IPv6 in CloudFront and S3. AWS currently (2016-04-01) has very limited IPv6 support, only ELBs in EC2 Classic can do IPv6 – and they are being phased out in favour of VPCs. There is no support for IPv6 in Route53, S3, CloudFront, EC2 nodes or VPC-based load balancers (ELBs). Many are waiting for AWS to add IPv6 support, ...


18

Turns out I didn't try TTL and DependsOn. Works with both of those.


18

DKIM on AWS Route53 You must split the DMARC record into 255 character parts. If you happen to host your DNS using AWS Route53, insert each part quoted with "..." into the record. Do not use newlines to split the parts, because that would be separate TXT entries. v=DKIM1; k=rsa; p=ABC123longkeypart1ABC123longkeypart2 becomes "v=DKIM1; k=rsa; p=...


17

You can also set a ALIAS for WWW to A record of domain.com: www.domain.com A ALIAS domain.com 300 so your final DNS entries would be as follows: domain.com A xxx.xxx.xxx.xxx 300 domain.com NS stuff.awsdns-47.org 172800 domain.com SOA stuff.awsdns-47.org 900 www.domain.com A ALIAS domain.com (...


17

For poor souls who might have had the same question: you don't need to add NS RRs in Route53 in the hosted zone section. You need to go to your Registered Domains, click the domain you want to modify, and then Add/Edit the name servers there. Those are the domain NSes, and are associated with the registrar, they are different from the ones delegated inside ...


17

All prices below are current as of 26th June 2017 and may change. Q1: Route53 is a DNS service, not a domain registration service. To host DNS with Amazon, there is a flat fee of $0.50 per month, or $6 per year, per domain for use of the Route53 DNS service. Depending on the number of queries your domain receives, there are additional charges. $0.40 per ...


16

To just set the hostname (without Route53), you can use cloud-init configuration in the user-data #cloud-config hostname: mynode fqdn: mynode.example.com manage_etc_hosts: true


15

It's not actually correct that the SPF RR type is the newer standard (in the context of desired SPF behavior). The experimental phase of the SPF specification had a new record type assigned but the migration path was unclear and it has since been abandoned. The current version of the SPF spec specifically states: SPF records MUST be published as a DNS TXT (...


14

One way you could do this is make a new zone that's a subdomain of the main domain, like stuff.example.com and delegate the subdomain's NS to that secondary zone. Give them IAM privileges to that subdomain's zone and they'd be able to create subdomains like my.stuff.example.com. For records that you want to be first-class citizens, you could CNAME my.example....


13

DNS will always match the most specific record first. In your case, the wildcard record will act as a fallthrough, catching any requests that don't match the non-wildcard records.


12

This was the answer: The name servers displayed on/in the hosted zone are the ones you will want to use. When you have a domain registered with / transferred to AWS, you configure which name servers to use under "Registered domains" in the Route 53 Management Console. Select your domain there and you'll see the current name servers on the details page that ...


12

okay, after tinkering around. I finally got it working! thanks for everyone for their help. If anyone else is in the same situation as me. Here is what you have to do. I bought the domain from Godaddy, so under the nameserver, I used the name server from Cloudflare(there should only be 2 from cloudflare) Cloudflare manages all of my services, but I only ...


11

It looks like ANAME is just a standard-sounding name made up by DNS Made Easy to describe a service offering of theirs that is extremely similar to what a Route 53 Alias does. I described the differences betweeen an Alias and a CNAME recently on Stack Overflow, but to summarize here: A DNS server provisioned with a CNAME for a given host hands out a ...


11

The SOA SERIAL field is specified to be an an unsigned integer value that has special rules for how it wraps around, and consequently also for how serial numbers are compared, etc. RFC1035 defines this field as: SERIAL The unsigned 32 bit version number of the original copy of the zone. Zone transfers preserve this value. This value wraps and should be ...


Only top voted, non community-wiki answers of a minimum length are eligible