Connect Amazon Route 53 to DNS Spy

Connecting Amazon Route 53 to DNS Spy imports every record from your public hosted zones and keeps them monitored automatically. This guide walks through creating a least-privilege IAM credential and connecting it to your team.

What You Get

• Full import – every record from every public hosted zone in your AWS account is imported into DNS Spy.

• Recurring sync – DNS Spy periodically re-reads your zones and picks up new or changed records, so your monitoring never drifts out of date.

• Resolver-based monitoring – imported records are monitored by querying your authoritative nameservers from multiple regions, the same way the rest of the internet sees your DNS.

Step 1: Create the IAM Policy

Sign in to the AWS Management Console and open the IAM console. Go to Policies → Create policy, switch to the JSON editor, and paste this least-privilege policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "route53:ListHostedZones",
        "route53:ListResourceRecordSets",
        "route53:GetHostedZone"
      ],
      "Resource": "*"
    }
  ]
}

Give the policy a recognizable name such as "DNSSpyReadOnly" and create it. These three actions only allow listing zones and reading record sets — nothing in this policy can create, change, or delete DNS records.

Step 2: Create a Dedicated IAM User

Still in the IAM console, go to Users → Create user. Name it something like "dnsspy-sync" and do not enable console access — this user only needs programmatic access. On the permissions step, choose Attach policies directly and attach the policy you created in Step 1.

Step 3: Create an Access Key

Open the new user, go to the Security credentials tab, and choose Create access key. When AWS asks for the use case, choose Third-party service. Copy both the Access Key ID and the Secret Access Key — AWS shows the secret only once. If you lose it, delete the key and create a new one.

Step 4: Connect in DNS Spy

1. In DNS Spy, go to Team Settings → DNS Providers and click Add.

2. Choose Amazon Route 53 as the provider.

3. Paste the Access Key ID and Secret Access Key.

4. Click Test Connection to verify the credentials work.

5. Click Import Domains, pick the hosted zones you want to monitor, and DNS Spy imports their records.

What DNS Spy Does and Does Not Do

• Read-only by construction – the policy above grants list and read actions only, so DNS Spy cannot modify your DNS even if it wanted to.

• Credentials are encrypted – your access key is stored encrypted and is never displayed again after you save it.

• Alias records – Route 53 alias records (for example, an alias to a CloudFront distribution or load balancer) are monitored by what they resolve to, since alias targets are an AWS-internal construct that public DNS resolvers see as ordinary A/AAAA answers.

• Private hosted zones are not importable – DNS Spy monitors DNS the way the public internet sees it, using public resolvers. A private hosted zone only answers inside your VPC, so public resolvers cannot see it and there is nothing DNS Spy could meaningfully monitor. Only public hosted zones appear in the import list.

• IAM user access keys only – DNS Spy needs a long-lived IAM user access key. Temporary STS credentials (session tokens) are not supported because they expire and would break the recurring sync.

Troubleshooting

• SignatureDoesNotMatch – the Secret Access Key is wrong (often a copy/paste issue with trailing whitespace). Since AWS only shows the secret once, delete the access key and create a new one.

• InvalidClientTokenId or AccessDenied – the Access Key ID is wrong, the key was deactivated or deleted, or the IAM user is missing the policy from Step 1. Verify the key is active and the policy is attached.

• Empty domain list – all hosted zones in the account are private (only public zones are importable), or the access key belongs to a different AWS account than the one holding your zones.

• Throttling – AWS rate-limits Route 53 API requests. DNS Spy retries throttled requests automatically; large accounts may just take a little longer to import.

Security Guidance

• Never use root account keys – always create a dedicated IAM user with only the policy above. Root keys grant unrestricted access to your entire AWS account.

• Rotate keys periodically – create a new access key, update the connection in DNS Spy with the new values, then deactivate and delete the old key.

• The policy cannot modify DNS – even if the key were leaked, the three allowed actions can only read zone data. They cannot change records, transfer domains, or touch any other AWS service.

Amazon Route 53 is a trademark of Amazon.com, Inc. DNS Spy is not affiliated with or endorsed by Amazon.