Skip to main content
provisioning · aws

Route 53 Hosted Zones

category
DNS

What does zop.dev create for Route 53 Hosted Zones?

zop.dev creates a Route 53 hosted zone for each cluster you give a domain, named after the cluster under that domain, plus a wildcard CNAME with a 300-second TTL pointing at the cluster's ingress load balancer. Delegating the zone from your registrar or parent zone is up to you. Route 53 bills 0.50 USD per hosted zone per month.

Module backing Route 53 Hosted Zones.
Field Value
Cloudaws

Amazon Route 53 hosts the DNS zones that route traffic to your environments. When you give a cluster a domain, zop.dev creates a zone for that cluster and points it at the cluster’s ingress.

A hosted zone with one wildcard record

A hosted zone named after the cluster under your domain, and a wildcard CNAME for every name in it pointing at the cluster’s ingress load balancer.

Zone name comes from the cluster and your domain

Terminal window
Zone: <cluster>.<domain>; record: *.<cluster>.<domain> CNAME to the ingress load balancer, TTL 300.

Delegation is yours to add

zop.dev writes no NS delegation records anywhere. Until you add the zone’s NS records at your registrar or in the parent zone, names in the new zone do not resolve publicly. When DNS misbehaves for an environment, check the delegation first, then the zone itself.

DNS never blocks the cluster

If zone creation fails, the DNS step is skipped and the cluster comes up without DNS. If the ingress load balancer has no address yet, zop.dev creates the zone without the wildcard record. zop.dev adds no CAA records, so any certificate authority your issuer uses can issue for names in the zone.

The meter on a zone

A hosted zone bills 0.50 USD per month plus per-query charges (trivial for one zone, worth watching once every environment carries its own). The sharper issue with stale zones is not cost but correctness: a zone left behind by a deleted environment keeps resolving, and dangling records pointing at released load balancers or IPs are a well-documented takeover surface. Tearing down an environment should include its zone and its delegation records, in that order.

See it fire on your bill.

Connect an account read-only. The first findings land in minutes.

472 rule families across 353 resource types on 22 platforms. Every threshold, metric, and IAM action is documented on these pages before you grant anything.

472 rule families documented
353 resource types covered
read-only default access level
Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console· Multi-cloud automation· Production-ready in 30 min· SOC 2 · ISO 27001· 20–60% off the bill, first month· 4 platforms · 1 console·