On this page

Fixing DNSSEC in AWS Route 53

What this fixes

DNSSEC signs your DNS records so resolvers can verify they haven't been tampered with, protecting against DNS spoofing. See Enabling DNSSEC for Your Domain for what it does and why it matters — this guide covers the Route 53-specific steps.

This assumes you already have a hosted zone in Route 53 for your domain, and IAM permissions to edit it.

How to fix it

  1. In the Route 53 console, go to your hosted zone → DNSSEC signing.
  2. Click Enable DNSSEC signing.
  3. You'll be prompted to create or select a KMS customer managed key (asymmetric, ECC_NIST_P256) — Route 53 uses this key to sign your zone.
  4. Once enabled, Route 53 generates a DS record.
  5. If your domain is registered through Route 53 Domains, add the DS record directly from the same console flow (Registered domains → your domain → DNSSEC keys tab → Add key), and Route 53 adds it to the parent zone automatically.
  6. If your domain is registered elsewhere, copy the DS record and add it at your registrar.
  7. Allow propagation time, then verify with a scan.

This is the most technical setup of the four providers covered in this section — it involves KMS, IAM permissions for the key, and (if the registrar is external) a manual step outside AWS. Budget more time for this one, and consider having whoever manages your AWS account involved.

Common pitfalls

  • Enabling DNSSEC signing without the right KMS permissions — if Route 53 creates the signing key for you, no extra permissions are needed; if you bring your own key, its key policy must grant the dnssec-route53.amazonaws.com principal kms:DescribeKey, kms:GetPublicKey, and kms:Sign.
  • Registering the domain through a different registrar than the one hosting DNS — the DS record step needs to happen at the registrar, not in Route 53, and it's easy to miss if a different team manages the registrar account.