COREDNS-ROUTE53(7)

okay so bestie, welcome to COREDNS-ROUTE53(7) — literally the CoreDNS Plugins manual, section 7, the route53 one. grab a lil snack 🍓 and let's get into it, no cap.

✨ NAME ✨

route53 — bestie, it enables serving zone data from AWS route53. that's it, that's the vibe. 💅

🔥 DESCRIPTION 🔥

The route53 plugin is genuinely iconic for serving zones straight from resource record sets in AWS route53. it supports all Amazon Route 53 records (yes, all of them, go look: https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html ⟨https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html⟩).

and the best part?? the route53 plugin can be used when CoreDNS is deployed on AWS or elsewhere. not me being flexible, we love range 🌈

🎀 SYNTAX 🎀

route53 [ZONE:HOSTED_ZONE_ID...] {
    aws_access_key [AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY] # Deprecated, uses other authentication methods instead.
    aws_endpoint ENDPOINT
    credentials PROFILE [FILENAME]
    fallthrough [ZONES...]
    refresh DURATION
}

okay now the rundown, one by one 🫶

• ZONE — the name of the domain to be accessed. when there are multiple zones with overlapping domains (private vs. public hosted zone, iykyk), CoreDNS does the lookup in the given order right here. so for a non-existing resource record, the SOA response will come from the rightmost zone. periodt.
• HOSTED_ZONE_ID — the ID of the hosted zone that contains the resource record sets to be accessed.
• AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY — the AWS access key ID and secret access key to be used when querying AWS (optional, no pressure). if they're not provided, CoreDNS tries to access AWS credentials the same way as AWS CLI does — environment variables, shared credential file (and optionally shared config file if AWS_SDK_LOAD_CONFIG env is set), and lastly EC2 Instance Roles. 💀 heads up tho: the usage of aws_access_key has been deprecated and may be removed in future versions. instead, user can use other methods to pass credentials, e.g., with environmental variable AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, respectively.
• aws_endpoint — can be used to control the endpoint to use when querying AWS (optional). ENDPOINT is the URL of the endpoint to use. if this is not provided, the default AWS endpoint resolution will occur. letting AWS decide, main character energy 👑
• credentials — used for overriding the shared credentials FILENAME and the PROFILE name for a given zone. PROFILE is the AWS account profile name — defaults to default. FILENAME is the AWS shared credentials filename — defaults to ~/.aws/credentials. lowkey important: CoreDNS will only load the shared credentials file and not the shared config file (~/.aws/config) by default. set the AWS_SDK_LOAD_CONFIG env variable to a truthy value to enable also loading of ~/.aws/config (e.g. if you want to provide assumed IAM role configuration, slay). will be ignored if static keys are set via aws_access_key.
• fallthrough — if zone matches and no record can be generated, pass request to the next plugin. if ZONES is omitted, then fallthrough happens for all zones for which the plugin is authoritative. if specific zones are listed (for example in-addr.arpa and ip6.arpa), then only queries for those zones will be subject to fallthrough. selective queen 🌸
• refresh — can be used to control how long between record retrievals from Route 53. it requires a duration string as a parameter to specify the duration between update cycles. each update cycle may result in many AWS API calls depending on how many domains use this plugin and how many records are in each 😭 adjusting the update frequency may help reduce the potential of API rate-limiting imposed by AWS.
• DURATION — a duration string. defaults to 1m. if units are unspecified, seconds are assumed. so 1m is your default bestie, remember it.

---

💖 EXAMPLES 💖

okay these are the ones you'll actually copy-paste, let's go ✨

Enable route53 with implicit AWS credentials and resolve CNAMEs via 10.0.0.1:

example.org {
    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7
}

. {
    forward . 10.0.0.1
}

Enable route53 with explicit AWS credentials:

example.org {
    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7 {
      aws_access_key AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY # Deprecated, uses other authentication methods instead.
    }
}

Enable route53 with an explicit AWS endpoint:

example.org {
    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7 {
      aws_endpoint https://test.us-west-2.amazonaws.com
    }
}

Enable route53 with fallthrough:

. {
    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7 example.gov.:Z654321543245 {
      fallthrough example.gov.
    }
}

Enable route53 with multiple hosted zones with the same domain:

example.org {
    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7 example.org.:Z93A52145678156
}

Enable route53 and refresh records every 3 minutes:

example.org {
    route53 example.org.:Z1Z2Z3Z4DZ5Z6Z7 {
      refresh 3m
    }
}

---

🦋 AUTHENTICATION 🦋

so the Route53 plugin uses the AWS Go SDK (https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html ⟨https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html⟩) for authentication, where there is a list of accepted configuration methods — go read it, fr fr 👀

⚠️ and again, because it matters: note the usage of aws_access_key in the Corefile has been deprecated and may be removed in future versions. instead, user can use other methods to pass credentials, e.g., with environmental variable AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY, respectively. don't say I didn't warn you 💀

---

and that's the whole page bestie, you ate that 🫶 this was COREDNS-ROUTE53(7) from the CoreDNS plugins manual — source: CoreDNS, dated March 2026. now go serve some zones, mwah 💋🎀