AWS Route 53 support
Until now DNScheck worked with Cloudflare and DigitalOcean. Route 53 was the provider people asked about most, so it's the first one we're adding. Connect an AWS account and DNScheck picks up every hosted zone it can see.
The IAM policy
DNScheck needs an access key for an IAM user or role with three permissions:
route53:ListHostedZonesroute53:ListResourceRecordSetsroute53:ChangeResourceRecordSets
The last one is only needed if you want to edit records from DNScheck. Leave it out and you get monitoring without write access. Edits will fail with a clear error, and sync carries on.
Paste the access key ID and secret into DNScheck. Region is optional. Route 53 is a global service, and we default to us-east-1 for the control plane.
Read-only records
Route 53 has records that look like ordinary DNS records but aren't really yours to edit. DNScheck marks these read-only:
- the SOA record
- the apex NS records, which AWS assigns to the hosted zone
- alias records that point at AWS resources such as load balancers and CloudFront
- records with a routing policy (weighted, latency, geolocation, failover)
Read-only doesn't mean ignored. DNScheck still syncs them, still records their history, and still alerts when they change. A weighted record whose weight shifts at 2am is exactly the kind of change you want to hear about. You just can't edit them from our dashboard, because writing them back through a simple form would lose the routing settings.
Record types
On top of the usual A, AAAA, CNAME, MX, TXT, NS, SRV, and CAA, Route 53 zones can edit DS, HTTPS, PTR, SSHFP, SVCB, and TLSA records. Setup steps are in the providers docs.