Features
Resources
DNS Provider Sync · Amazon Route 53
Route 53 answers queries with a 100% SLA. Whether it answers with what you intended is a different question — one AWS can't answer for you. DNS Spy connects with a read-only IAM access key and watches every record from resolvers outside AWS.
No credit card required · 7-day trial · Read-only API access
Route 53 alias records are pointers to AWS resources — an Elastic Load Balancer, a CloudFront distribution, an S3 website endpoint — not values you typed. Ask the API what an alias A record contains and you get a target name; ask a resolver and you get whatever IPs AWS is serving for that resource right now. DNS Spy imports alias records from the Route 53 API for coverage, then monitors the resolver answers — the IPs your users actually receive. When an ELB re-IPs or CloudFront rotates its edge answers, that becomes visible, versioned history in DNS Spy instead of invisible churn, and a genuinely wrong answer stands out from routine AWS rotation.
Route 53's SLA promises the service will answer queries, and it has earned that reputation. What no SLA can promise is that it answers with what you meant. A fat-fingered record set, Terraform or CloudFormation drift from an apply nobody reviewed, a record deleted by the wrong script, a compromised AWS access key quietly repointing a subdomain — Route 53 serves every one of those "correctly," with a 100% SLA. DNS Spy watches your zones from resolvers outside AWS entirely and alerts the moment what resolves stops matching what you intended. Route 53 health checks don't fill this gap either: they cost extra per check and watch whether endpoints respond, not whether your records are right.
Route 53 pricing is metered: $0.50 per hosted zone per month, $0.40 per million standard queries, and health checks billed separately, per check, every month. That per-check meter is why teams monitoring Route 53 with AWS's own tooling end up watching a handful of endpoints and hoping the rest of the zone behaves. DNS Spy takes the opposite approach: a flat plan monitors every record in every imported zone from resolvers worldwide, with change history and alerting included. Route 53 is excellent infrastructure, fairly priced for what it does — just don't let per-check pricing talk you into watching only the records you think matter. The record nobody was watching is always the one that changes.
In the AWS console, create an IAM policy granting only route53:ListHostedZones, route53:ListResourceRecordSets, and route53:GetHostedZone — read access to your DNS and nothing else.
Create a dedicated IAM user with no console access, attach that policy, and generate an access key for it.
Paste the access key ID and secret access key into DNS Spy under Team Settings → DNS Providers, then click Test Connection.
Import your hosted zones — every record arrives, alias records included, and resolver monitoring starts immediately. The full walkthrough with screenshots and the exact policy JSON lives at /learning/dns-providers/connect-route53.
Read more about how imports, recurring sync, and resolver-based monitoring work on the DNS Provider Sync feature page, or follow the step-by-step Amazon Route 53 setup guide.
Create a dedicated IAM user limited to three read-only Route 53 actions, generate an access key, connect it to DNS Spy, and import your hosted zones. Every record is monitored from multiple resolver locations worldwide, with alerts via email, Slack, Discord, or PagerDuty when any record changes, disappears, or goes out of sync between nameservers.
Yes, correctly. Alias records have no fixed value — they resolve to whatever IPs AWS is currently serving for the target ELB, CloudFront distribution, or S3 endpoint. DNS Spy imports them from the API for coverage and monitors what they actually resolve to, so AWS's routine re-IPs become recorded history rather than a stream of false alarms.
No. Private hosted zones only answer queries from inside the VPCs you associate with them — public resolvers cannot reach them by design, which is the entire point of a private zone. DNS Spy monitors public hosted zones: the DNS your users, mail, and certificates actually depend on.
No. DNS Spy needs a dedicated IAM user with no console access and a policy granting exactly three read-only actions: route53:ListHostedZones, route53:ListResourceRecordSets, and route53:GetHostedZone. The exact policy JSON is in our setup guide. That key cannot touch EC2, S3, billing, or write to your DNS — and it's stored encrypted, never displayed again after saving.
No. Route 53 does not offer AXFR, so the API is the only way to enumerate a complete hosted zone — which is exactly what DNS Spy's provider sync automates, with recurring re-checks so records you add later are discovered automatically.
Connect with a read-only token, import every record, and get alerted the moment anything changes. Free for 7 days.
Amazon Route 53 is a trademark of its respective owner. DNS Spy is not affiliated with or endorsed by Amazon Route 53.
Features
Resources