# Route 53 Hosted Zones

> zop.dev creates a Route 53 hosted zone, applies CAA records by default, and writes NS delegation records into a master zone hosted on GCP Cloud DNS, the same cross-cloud pattern Azure DNS zones use. Route 53 bills 0.50 USD per hosted zone per month, plus per-query charges once traffic resolves against it.

Source: https://zop.dev/integrations/provision/aws/route-53-hosted-zones
Updated: 2026-08-19

---

Amazon Route 53 hosts the DNS zones that route traffic to your environments. zop.dev provisions the zone with certificate-authority restrictions and delegates it into the organization's master zone automatically.

## A hosted zone with CAA and NS delegation

Hosted zone, CAA records, and NS delegation records into a GCP-hosted master zone.

## Zone name, with CAA applied by default

```text
Zone name; CAA records applied by default.
```

## Delegation into the GCP master zone

Delegation targets a GCP master zone: the same cross-cloud pattern used by Azure DNS and OCI DNS zones.

## Delegation crosses a cloud boundary

The zone's NS delegation records are written into a master zone hosted on GCP Cloud DNS, not
into another Route 53 zone. Resolution for an AWS environment therefore begins at Google
nameservers: a resolver walks from the master zone's NS records down to the Route 53 zone that
actually holds the environment's records.

The consequence is a dependency most diagrams omit. The GCP master zone is shared, cross-cloud
infrastructure. A bad edit there can break name resolution for environments on AWS that have
nothing else to do with GCP. When DNS misbehaves for an AWS environment, the delegation chain
is the second place to look, right after the zone itself.

## CAA answers who may issue certificates

CAA records are applied by default, restricting which certificate authorities may issue for
names in the zone. The protective story is the reason they exist: a compromised or confused CA
cannot mint a certificate for your domain if it is not on the list.

The operational story is the one that bites. A certificate request through a CA that is not
listed fails, and the failure surfaces as a mysterious issuance error in whatever tool made
the request, nowhere near DNS. When a new cert workflow fails against a zone provisioned here,
check the CAA records before blaming the ACME client.

## The meter on a zone

A hosted zone bills 0.50 USD per month plus per-query charges (trivial for one zone, worth
watching once every environment carries its own). The sharper issue with stale zones is not
cost but correctness: a zone left behind by a deleted environment keeps resolving, and dangling
records pointing at released load balancers or IPs are a well-documented takeover surface.
Tearing down an environment should include its zone and its delegation records, in that order.