How to Create an AWS Route 53 Private Zone Without Breaking Public Subdomains

Select Language:

If you’re working with Amazon Route 53 and need to set up a private hosted zone for your domain, you might run into a common challenge. Here’s a straightforward solution to handle it effectively.

Suppose you have a public hosted zone with an A record like apigateway.example.com pointing to your API Gateway, and you want to add a private zone for the main domain, example.com, within your Virtual Private Cloud (VPC). The goal is to direct internal traffic correctly without causing DNS conflicts or delays.

The main issue is that when creating a private hosted zone, Route 53 requires you to specify the VPC at the same time. However, once the zone is associated with your VPC, it takes over DNS resolution for everything under example.com, including your subdomain apigateway.example.com. If your new private zone doesn’t have a record for that subdomain yet, DNS queries will fail with an NXDOMAIN response, breaking your internal API calls.

Adding the correct records immediately after creating the zone doesn’t fix the problem because negative caching of the NXDOMAIN results can cause temporary resolution failures, even after you’ve added the records.

The best way to get around this is to create the private hosted zone initially with a placeholder or dummy VPC. Then, add all the necessary DNS records to this zone. Once everything is configured, you can safely associate the zone with your actual VPC. This approach allows the records to be in place before the zone’s DNS resolution takes effect within the VPC, preventing resolution failures or caching issues.

Unfortunately, the API that creates hosted zones requires a VPC to be specified at creation, even though the documentation states that a VPC is not required. This means you can’t create a private hosted zone without specifying a VPC initially. To implement this workaround, you’ll need to create a temporary or dummy VPC, set up the zone and records there, and then associate it with the real VPC afterward. Remember to clean up the dummy VPC once everything is working correctly.

This method is supported and reliable, and it helps ensure your DNS records are in place before the zone begins handling internal DNS queries. By following these steps, you can avoid DNS resolution hiccups caused by the zone takeover and maintain smooth internal service operation.