The Most Requested Provider
When we launched DNS provider sync with six providers, one name came up in nearly every "what about..." email: Amazon Route 53. That makes sense. Route 53 runs DNS for an enormous share of production infrastructure, and it does not support zone transfers — so until now, monitoring a Route 53 zone meant relying on autodiscovery's educated guesses.
Today that gap closes. Connect your AWS account and DNS Spy imports every record from every hosted zone you select — including the unusually named ones no wordlist would ever find — and re-checks Route 53 on a schedule so new records are monitored automatically.
Read-Only by Construction
AWS credentials deserve extra care, so the integration is built around a least-privilege IAM policy with exactly three read-only actions: list your hosted zones, list their record sets, and read zone details. It cannot modify DNS. It cannot touch any other AWS service. It cannot spend a cent of your AWS bill.
Our step-by-step setup guide includes the exact policy JSON to paste into IAM — create a dedicated user, attach the policy, generate an access key, and connect. About two minutes end to end. Credentials are stored encrypted and never displayed again.
Alias Records, Done Right
Route 53's alias records — the ones pointing at load balancers, CloudFront distributions, and S3 buckets — have no fixed value at all. The API stores a target name; resolvers answer with whatever IPs that target resolves to right now. A monitoring tool that compares your zone file against the API would either miss alias records entirely or alert on them constantly.
DNS Spy monitors alias records by what they actually resolve to, from resolver locations around the world. When your load balancer re-IPs, that's visible history in your record timeline. When an alias suddenly resolves somewhere it never has before, that's an alert.
A 100% SLA Still Deserves a Witness
Route 53 famously offers a 100% availability SLA — and it earns it. But the SLA covers Route 53 answering queries, not answering with what you meant. A fat-fingered record edit, a Terraform apply that drifted, a deleted record nobody noticed, or a compromised AWS credential quietly rewriting your MX records: Route 53 will serve all of those flawlessly.
Independent monitoring from outside AWS is the witness. DNS Spy watches your records from the world's perspective, keeps a versioned history of every value, and alerts you the moment reality diverges from intent — through email, Slack, Discord, or PagerDuty.
Get Started
Follow the Route 53 setup guide — including the copy-paste IAM policy.
Connect under Team Settings → DNS Providers, test the connection, and import your zones.
Or learn how provider sync works on the DNS Provider Sync feature page.
Route 53 joins Cloudflare, DNSimple, DigitalOcean, Bunny DNS, Linode/Akamai, and Vultr — seven providers, one read-only connection each, complete monitoring coverage on every paid plan and during trials. If your provider is not on the list yet, tell us which one should be next.
Amazon Route 53 is a trademark of Amazon.com, Inc. Provider names are trademarks of their respective owners. DNS Spy is not affiliated with or endorsed by these providers.
