Delegating a subdomain to Route 53 without moving your domain

A subdomain on AWS, the domain where it is#

It is common to have your main domain registered and managed at a provider such as GoDaddy, Namecheap or Squarespace, and want one part of it, say develop.example.com or api.example.com, managed in AWS. That way your deployments can create and change DNS records for that subdomain without touching email or the main website.

The technique is called delegation. You create an Amazon Route 53 hosted zone named after the subdomain and, at the parent domain's provider, add NS records that say: for this subdomain, ask these name servers. AWS documents it as creating a subdomain that uses Route 53 without migrating the parent domain.

Many deployment platforms do the first step for you: registering a domain with them creates the hosted zone in your AWS account. The rest of the process is identical. If you want to move the entire main domain to Route 53, that is a different migration.

Documentation: Route 53 · Subdomain without migrating the parent ↗ · Route 53 · Routing traffic for subdomains ↗ · RFC 1034 · DNS concepts ↗

1. Create the subdomain's hosted zone#

In the Route 53 console, open Hosted zones, click Create hosted zone, enter the full subdomain name (develop.example.com) and choose the public type. Route 53 automatically creates the zone's NS and SOA records and assigns it four name servers.

AWS highlights two precautions: do not create extra NS or SOA records inside this hosted zone, and do not delete the existing ones. You can then add the records you need (A, AAAA, CNAME, alias), although they will not resolve on the internet until delegation is complete.

Documentation: Route 53 · Create a public hosted zone ↗ · Route 53 · NS and SOA records ↗ · Route 53 · Subdomain without migrating the parent ↗

2. Create the NS records at the parent provider#

Copy the hosted zone's four name servers and create records in the parent domain's DNS zone with these values:

• Name or Host: only the subdomain prefix (develop). Many providers append the domain automatically; typing the full name may duplicate it.
• Type: NS.
• Value: one AWS name server per record; you will create four records with the same name.
• TTL: 172800 seconds (two days), the typical NS value according to AWS.

Do not add an SOA record for the subdomain at the parent provider, and if the provider created one on its own, delete it. There also cannot be another record with the same name, such as a CNAME, because a CNAME cannot coexist with other data at that name.

# 1. Create the subdomain's public hosted zone
aws route53 create-hosted-zone \
  --name develop.example.com \
  --caller-reference "develop-$(date +%s)"

# 2. Get its four name servers
aws route53 get-hosted-zone --id Z0123456789EXAMPLE \
  --query 'DelegationSet.NameServers'

# 3. Records you add to the example.com zone at the parent provider.
#    These are the example name servers from the AWS docs.
#    develop.example.com.  172800  IN  NS  ns-2048.awsdns-64.com.
#    develop.example.com.  172800  IN  NS  ns-2049.awsdns-65.net.
#    develop.example.com.  172800  IN  NS  ns-2050.awsdns-66.org.
#    develop.example.com.  172800  IN  NS  ns-2051.awsdns-67.co.uk.

# 4. Verify the delegation
dig +short NS develop.example.com
dig +trace develop.example.com

If the parent domain is also in Route 53, even in another account, the procedure is the same: create the NS record named after the subdomain in the parent domain's hosted zone.

Documentation: Route 53 · Update the parent domain's DNS ↗ · Route 53 · Typical NS TTL ↗ · AWS CLI · create-hosted-zone ↗ · AWS CLI · get-hosted-zone ↗ · RFC 1034 · CNAME rules ↗

Where to do it at each provider#

Provider interfaces change often, so treat this as orientation and look for the option to add an NS record in the domain's DNS management:

• GoDaddy: in your domain list, open the domain's DNS management, click Add, choose the NS type and fill in host, name server and TTL.
• Namecheap: in Domain List, click Manage on the domain, open the Advanced DNS tab and use Add New Record with type NS; in Host enter only the prefix.
• Google Domains: no longer operates as a standalone registrar; its domains moved to Squarespace Domains, so DNS is managed from the Squarespace panel.

Documentation: GoDaddy · Add an NS record ↗ · Squarespace · New home for Google Domains ↗

3. Verify the delegation#

Query the subdomain's NS records with dig +short NS. When the answer lists the four awsdns servers of your hosted zone, delegation is live. dig +trace walks resolution from the root and shows where authority is handed to the subdomain.

The change is not always immediate. Resolvers may have cached earlier answers, and with a two-day TTL on NS records full propagation can take up to 48 hours in the worst case.

If it does not work, check in order: the record name is not duplicated (develop.example.com.example.com), all four servers are present, there is no conflicting CNAME or SOA, and you are looking at the right hosted zone, because if you delete and recreate it, Route 53 assigns different name servers.

Documentation: Route 53 · Migrating DNS and NS caching ↗ · Route 53 · Deleting a hosted zone ↗

Best practices#

• Use one subdomain per environment (dev, staging, app) so each has its own zone and permissions.
• Restrict who can edit NS records at the parent provider: whoever controls them controls the subdomain.
• To retire a subdomain, delete the NS records at the parent first, wait for their TTL to expire, and only then delete the hosted zone. AWS warns that doing it the other way round lets someone hijack the subdomain while resolvers still cache its name servers.
• Document the delegation next to your infrastructure as code so it does not become a forgotten manual step.

Documentation: Route 53 · Deleting a hosted zone ↗