Link a GoDaddy, Namecheap or Google Domains domain to AWS Route 53

Linking is not transferring#

If you are reading this, you probably have a domain registered with GoDaddy, Google Domains or Namecheap and want to manage its DNS from your AWS account. This guide walks through it step by step: create the hosted zone in Route 53, copy your records and switch the nameservers at each registrar.

First, be clear about what you are doing. Pointing a domain registered elsewhere at AWS does not transfer the domain. The registration stays with your current registrar, where you keep renewing and paying for it. What changes is who answers DNS queries: you create a hosted zone in Amazon Route 53 and tell your registrar to delegate the domain to that zone's nameservers.

Moving the registration itself to AWS is a separate process, a domain transfer to Route 53, with its own requirements. You do not need it here.

An important update since this guide was first published in 2023: Google Domains no longer exists as a registrar. Squarespace completed its acquisition of the Google Domains assets on September 7, 2023, and moved those accounts to Squarespace Domains. If your domain used to live in Google Domains, you now manage it in Squarespace; the updated steps are below.

Documentation: AWS · Making Route 53 the DNS service for a domain in use ↗ · AWS · Transferring a domain to Route 53 ↗ · Squarespace · Completes acquisition of Google Domains assets (2023) ↗

Before you start: migrating without downtime#

If the domain already serves traffic, such as a live website or email, AWS recommends a specific order to avoid an outage:

• Capture your current DNS configuration: export a zone file if your provider supports it, or write down every record (A, AAAA, CNAME, MX, TXT and so on).
• Create the hosted zone in Route 53 and recreate all of those records there.
• Lower the TTL on the NS record at both your current provider and Route 53. A typical NS TTL is 172800 seconds (two days); AWS suggests 60 to 900 seconds during the migration.
• If DNSSEC is enabled, remove the DS record from the parent zone (your registrar) before switching nameservers. You cannot have DNSSEC signing active across two providers at once.
• Wait for the old TTL to expire (up to two days), and only then switch the nameservers.
• Monitor traffic, raise the NS TTL again and, if you need it, re-enable DNSSEC in Route 53.

When you create a hosted zone, Route 53 automatically adds an SOA record and an NS record listing the four nameservers assigned to that zone. Those four names are what you will paste into your registrar.

Documentation: AWS · Making Route 53 the DNS service for a domain in use ↗ · AWS · NS and SOA records in a hosted zone ↗ · AWS · Configuring DNSSEC in Route 53 ↗

Step 1: create the hosted zone in AWS#

A hosted zone is the container for your domain's DNS records in Route 53. You can create it in the AWS console, with the AWS CLI or as code; the result is the same: a public zone with its SOA and an NS record listing four nameservers. If a deployment platform creates the zone for you, still check in Route 53 that there is exactly one public zone for the domain before you continue.

• In the AWS console, open Route 53 and go to Hosted zones > Create hosted zone.
• In Domain name, enter the apex domain (for example example.com, without www).
• Under Type, keep Public hosted zone, the kind that answers queries from the internet. Optionally add a description and tags.
• Click Create hosted zone. When you open the zone you'll see two records created automatically: SOA and NS. The NS record named after your domain holds the four nameservers you'll paste into your registrar.

Avoid creating two public hosted zones with the same name: each gets its own set of nameservers, and it's easy to paste the wrong zone's set into your registrar. Also note that Route 53 charges per hosted zone and per query; check the pricing page before creating throwaway zones.

# Create the public hosted zone (caller-reference must be unique per request)
aws route53 create-hosted-zone \
  --name example.com \
  --caller-reference "migration-$(date +%s)" \
  --hosted-zone-config Comment="DNS for example.com"

# List the four assigned nameservers (use the ID returned by the previous command)
aws route53 get-hosted-zone --id Z0123456789ABCDEFGHIJ \
  --query 'DelegationSet.NameServers' --output text

To load records in bulk, Route 53 can import a BIND-format zone file through the hosted zone's Import zone file button. Keep the documented limits in mind: Route 53 ignores the SOA in the file and any NS records named after the zone, imports at most 1000 records, rejects files that use $GENERATE or $INCLUDE, and fails if the zone already contains any of the records in the file.

If you manage infrastructure as code, you can declare the zone, the records and the NS TTL in Terraform or OpenTofu:

resource "aws_route53_zone" "main" {
  name = "example.com"
}

# Records copied from your current DNS provider (example)
resource "aws_route53_record" "www" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "www.example.com"
  type    = "CNAME"
  ttl     = 300
  records = ["my-app.example.net"]
}

resource "aws_route53_record" "mx" {
  zone_id = aws_route53_zone.main.zone_id
  name    = "example.com"
  type    = "MX"
  ttl     = 3600
  records = ["10 mail.example.net"]
}

# Low NS TTL while the migration runs (AWS recommends 60-900 s)
resource "aws_route53_record" "ns" {
  allow_overwrite = true
  zone_id         = aws_route53_zone.main.zone_id
  name            = "example.com"
  type            = "NS"
  ttl             = 300
  records         = aws_route53_zone.main.name_servers
}

output "name_servers" {
  value = aws_route53_zone.main.name_servers
}

Documentation: AWS · Creating a public hosted zone ↗ · AWS CLI · route53 create-hosted-zone ↗ · AWS CLI · route53 get-hosted-zone ↗ · AWS · Creating records by importing a zone file ↗ · Terraform Registry · aws_route53_zone ↗ · Terraform Registry · aws_route53_record ↗ · AWS · Route 53 pricing ↗

Linking a GoDaddy domain to AWS#

With GoDaddy there are two parts: copy your records into Route 53, then switch the nameservers.

• Export your records. GoDaddy's DNS management offered a Unix zone file export (in the 2023 interface it lived under ‘Advanced Features’ > ‘Export Zone File (Unix)’; the location may have moved since).
• In Route 53, open the hosted zone, click ‘Import zone file’, paste the contents and delete the SOA and apex NS lines, since the AWS zone already has its own. Click ‘Import’.
• Open the hosted zone's NS record and copy the four nameservers under ‘Value/Route traffic to’.
• In GoDaddy, open your Domain Portfolio, select the domain and go to DNS > Nameservers. Choose to change nameservers and pick the option to use your own nameservers.
• Paste each AWS nameserver without the trailing dot (ns-123.awsdns-45.com rather than ns-123.awsdns-45.com.). Save and confirm with ‘Continue’.
• If Domain Protection is on, GoDaddy asks for a verification code before applying the change.

GoDaddy says most DNS changes take effect within an hour, but global propagation can take up to 48 hours. It also warns that switching nameservers can break your website or email if the records were not replicated first, which is exactly why we import before switching.

Documentation: GoDaddy · Change nameservers for my domains ↗ · AWS · Creating records by importing a zone file ↗

Google Domains, now Squarespace Domains#

The original guide described the Google Domains dashboard: ‘My domains’ > domain > ‘DNS’ > ‘Export resource records’, then ‘Disable DNSSEC’, ‘Custom name servers’ and ‘Switch to these settings’. That dashboard is gone: after the Squarespace acquisition, former Google Domains names are managed in Squarespace Domains.

The current flow, per Squarespace's documentation, looks like this:

• Before changing anything, copy every DNS record for the domain from the Squarespace dashboard and import or create them in the Route 53 hosted zone (skip SOA and NS).
• In the Squarespace domains dashboard, select the domain and go to DNS > Domain Nameservers.
• Click ‘Use Custom Nameservers’ and confirm your identity (password or two-factor authentication).
• When prompted, turn off DNSSEC. If you want DNSSEC with Route 53, enable it later in AWS and publish the new DS record at your registrar.
• Enter the Route 53 nameservers (Squarespace accepts between 2 and 13; paste all four) and click ‘Save’.

Squarespace notes the change can take up to 48 hours and that the domain disconnects from any Squarespace site, so every record you rely on must already exist in Route 53.

Documentation: Squarespace · Completes acquisition of Google Domains assets (2023) ↗ · Squarespace · Review, change, or reset your domain's nameservers ↗ · AWS · Configuring DNSSEC in Route 53 ↗

Linking a Namecheap domain to AWS#

• Sign in to Namecheap, open ‘Domain List’ in the sidebar and click ‘Manage’ next to the domain. On the ‘Advanced DNS’ tab, under ‘HOST RECORDS’, note every record you need to recreate.
• In Route 53, replicate each record exactly in the hosted zone, except NS and SOA if they appear.
• Back on Namecheap's ‘Domain’ tab, find the ‘NAMESERVERS’ section and select ‘Custom DNS’.
• Paste the four AWS nameservers one by one, without the trailing dot, and save with the green checkmark on the right.

Namecheap says nameserver changes can take up to 24 hours, and occasionally longer, while ISPs refresh their caches. The original guide said 48 hours; the real window depends on the TTLs your records had.

Documentation: Namecheap · How to change DNS for a domain ↗ · AWS · Making Route 53 the DNS service for a domain in use ↗

Verify the delegation before and after#

Do not rely on the registrar's dashboard alone. Use dig to confirm that Route 53 answers correctly before you switch nameservers, and that the delegation has propagated afterwards.

# 1. Before switching nameservers: query Route 53 directly
dig +short www.example.com @ns-123.awsdns-45.com

# 2. After the switch: which nameservers the registry publishes
whois example.com | grep -i "name server"

# 3. What public resolvers see (may lag because of caching)
dig +short NS example.com @1.1.1.1
dig +short NS example.com @8.8.8.8

# 4. Full walk from the root, bypassing caches
dig +trace NS example.com

Once public resolvers return the AWS nameservers and your website and email still work, raise the NS record TTL in Route 53 again (for example to 172800 seconds) to cut query volume and latency. From then on you manage every record in AWS, while the domain stays registered, and renewed, at your original registrar.

Documentation: AWS · Making Route 53 the DNS service for a domain in use ↗ · IETF · RFC 1034, DNS concepts ↗