Custom domain at Amazon Route 53

A guide for those whose domain records (DNS) are managed at Amazon Route 53. The general order of connecting is in Custom domain; here is only what differs in the Amazon Route 53 panel. Always take the records and their values from the connection wizard: it shows exactly what your address needs, with copy buttons.

Where to edit records at Amazon Route 53#

How to tell your domain’s DNS is at Amazon Route 53: on the first step the wizard names the provider by the domain’s DNS servers (NS). At Amazon Route 53 they look like ns-1496.awsdns-59.org, ns-1729.awsdns-24.co.uk. If the wizard named another provider, add the records there — even if you bought the domain at Amazon Route 53.

Open the panel: https://console.aws.amazon.com/route53/
Go to: Route 53 → Hosted zones → your domain → Create record.
A new record is created with the “Create record” button.
Changes are saved with the “Create records” button.

What the wizard shows	Field in the panel
Record type	“Record type”
Record name	“Record name”
Value (where it points)	“Value”
Time to live	“TTL (seconds)”

In the “Record name” field type only the left part of the name — without your domain: for www.example.com it is www, for _cenaly-verify.www.example.com — _cenaly-verify.www. The panel appends the domain itself.

For the root of the domain leave the name field empty.

Copy the value with the button in the wizard, exactly as shown. If after saving the panel appended your domain to it (….example.com), add a dot at the end of the value.

Ownership record#

The ownership record proves that the address is being connected by its owner — without it the domain is not reserved for your account. Often there is no separate record: for a subdomain the CNAME record itself (its value starts with the request code) or the certificate record can be the proof — the wizard shows which way applies to you. When it shows a separate ownership record, it is a TXT:

_cenaly-verify.www   TXT   cenaly-verify=<code from the wizard>

Create a record of type TXT.
Name — as in the wizard (_cenaly-verify + your subdomain); the naming rule is above.
Paste the whole value, including cenaly-verify=, without quotes.

Once the domain works, the ownership TXT can be deleted: it is only checked before activation. More — Custom domain → ownership record.

Delete old A, AAAA records and forwarding (if any) on this same name — a CNAME cannot live with other records on the same name. Do not touch records of other names (root, mail, MX).
Create a record of type CNAME.
Name: the left part of the address, for example www (the rule is in the section above).
Value (“Value”): the address from the wizard, via the “Copy” button.
TTL — the default or 300–3600 seconds.
Save (“Create records”).

Right after saving go back to the wizard — it checks the record at the provider’s DNS servers itself and tells you if the name got an extra domain or the value points elsewhere.

Root domain without www#

The root of the domain (example.com without a subdomain) is connected at Amazon Route 53 with an ALIAS record (in Route 53 — an A record with Alias switched on) pointing to the address from the wizard. Whether it works for your particular address the wizard tells you on the first step: on some clouds the root is more reliable via www. For the root the wizard shows one or two more records (ownership and certificate) — add them too.

Certificate record#

The secure connection (HTTPS) turns on by itself: the certificate is issued and renewed for free. For this the wizard sometimes asks for one more record — the certificate authority needs it:

_acme-challenge.www of type CNAME — to an address like ….cm.yandexcloud.net (Russian side);
_cf-challenge of type TXT — for the root of the domain (international side).

They are created like the other records: name by the rule above, value via the button in the wizard. If the name _acme-challenge already has records of a previous service (another hosting with a Let’s Encrypt certificate), delete them — otherwise the certificate is not issued. Do not delete these records after connecting: the certificate is renewed through them.

How long to wait#

New records at Amazon Route 53 usually reach all its servers within 1 min. The wizard checks the record right at the provider’s DNS servers, so it tells “the record is still spreading” from “the record is wrong” and in the first case shows an approximate waiting time. You can close the window — the connection continues on its own, and we will write when the site works.

If you changed an existing record, the old value may stay in caches for as long as its TTL was (often 1 hour, sometimes a day). This is not an error — the wizard shows “all correct, waiting”.

If a site already opens at the address#

If another site works at this address now, after changing the record visitors will start getting the new one. Before replacing the record at Amazon Route 53, prepare the move: If the domain already has a site. Do not want to touch the old site — connect a separate subdomain, for example menu.example.com or shop.example.com.

Email on the domain#

The domain’s email lives in MX, TXT (SPF, DKIM, DMARC) records and sometimes in a separate mail subdomain. Connecting the site does not touch them — do not delete or change them at Amazon Route 53. Only delete records on the name you are connecting, and only if the wizard pointed at them. More — Custom domain and email.

If the wizard shows an error#

Every wizard message leads to its own section of the errors page. The most common ones at Amazon Route 53:

RECORD_NAME_DOUBLED — the name was saved with the domain twice
CNAME_CONFLICT_A — an old A record is left on the same name
TRAFFIC_TARGET_MISMATCH — the record points elsewhere
PROPAGATING — all correct, the record is still spreading

How to disconnect and what to delete#

Disconnect the domain in the wizard (“Disconnect domain”), then delete at Amazon Route 53 the records it lists: the site record (CNAME or ALIAS) and, if any, the ownership and certificate records. Leave email and other records alone. While the site record points to us, the address stays reserved for your account — this protects it from being taken over by another account. The wizard checks the removal with the “Check removal” button. More — Disconnecting a custom domain.

Amazon Route 53 specifics#

For the root leave Record name empty (not “@”); a CNAME on the root is not allowed — you need an Alias (A, plus AAAA for IPv6).
An Alias can only point to AWS resources (CloudFront, S3, ELB…) or to a record in the same zone: for a location on the AWS side the root is an Alias to the distribution; for the Yandex side an Alias does not work — use www.
Changes usually reach all Route 53 servers within 60 seconds.

Sources#

This guide is based on Amazon Route 53’s documentation, checked 2026-11-06. Panels change — if a button or field is labelled differently for you, follow the meaning of the step, and the wizard will tell you if the record came out wrong.