How to route both www and apex level domains via a CNAME using AWS Route 53

amazon-route53amazon-web-servicesdns-zone

I am hosting an Elixir application using Gigalixir (a PaaS like Heroku). For custom domains, it asks you to add a CNAME record to point to their custom DNS domain, e.g. www.example.com.gigalixirdns.com. — this works great for the www version of the domains.

However, because of the RFC rules for DNS, you cannot define a CNAME rule for the non-www/apex/root domain. Some registrars allow an ALIAS record to deal with this (like namecheap). But Route 53 doesn't work the same way. It has "aliases", but I cannot make them point to an external domain for resolution.

My domain Hosted Zone (i.e. Zone File) only has an NS, SOA, and a CNAME for the www version of the domain (which works). It does not need to support email or anything else. I cannot make an alias for the apex domain point to the existing CNAME either.

I know similar questions have been asked, but so far I cannot come up with any combination that makes the root level domain work for HTTPS requests. Can someone shed light on this?

Best Answer

This is not allowed with Route53 ALIAS records.

Alias records

An alias record can only redirect queries to selected AWS resources, such as the following:

  • Amazon S3 buckets
  • CloudFront distributions
  • Another record in the same Route 53 hosted zone

...

Alias records

In most configurations, you can create an alias record that has the same name as the hosted zone (the zone apex). The one exception is when you want to redirect queries from the zone apex (such as example.com) to a record in the same hosted zone that has a type of CNAME (such as zenith.example.com). The alias record must have the same type as the record you're routing traffic to, and creating a CNAME record for the zone apex isn't supported even for an alias record.

https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html

You'd need to use some type of redirection service or a different DNS provider who will handle it.

Related Topic