Routing an External Registered Apex Domain to an AWS S3 Bucket
Tags: dns, apexdomain, aws, tutorial
Published: 2020-03-12 19:40:02

Your website will be accessible with HTTP. To access it with HTTPS do these three extra steps:

1. [Create a certificate](https://docs.aws.amazon.com/acm/latest/userguide/gs-acm-request-public.html) with the AWS Certificate Manager for your domain
2. [Create an AWS CloudFront distribution](https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-serve-static-website/) for your "root" S3 bucket. Associate the certificate to it
3. Point the `ALIAS` record of your apex domain to the new CloudFront distribution

## How to Point a Naked Domain - Not Registered with Route 53 - to an AWS S3 Hosted Static Website

_So people can access your website through `example.com` instead of `www.example.com`._

In this post, we're going to connect an [apex domain] (https://www.quora.com/What-is-an-apex-domain) with an AWS S3 hosted website. The naked domain is bought in a domain name registrar other than AWS Route 53. In this case [OVH](https://www.ovh.com/). **For other registrars the steps are similar.**

Apex domains, generally, cannot make use of `CNAME` records. Allowed are `A` or `AAAA` records, pointing to static IPs. This makes it harder to use our naked domain for our website: `example.com`. This is because of the dynamic nature of AWS S3 instances. They expose a subdomain endpoint, so they can route the internal traffic with freedom.

_Let's start._

### Copy your current zone file

[Log in to your OVH account](https://www.ovh.com/auth/), go to: _Domains > DNS zone_, and reduce the `TTL` (Time to Live). The authoritative name servers cache will expire faster now. This is good because we're going to change the `NS` (Name Server) records.

Now click on: _DNS zone > Change in text format_, and copy your RRs (Resource Records).

It should look like:

```
$TTL 3600
@	IN SOA dns18.ovh.net. tech.ovh.net. (2019112215 86400 3600 3600000 300)
                          IN NS     dns18.ovh.net.
                          IN NS     ns18.ovh.net.
                          IN MX     100 mx3.mail.ovh.net.
                          IN MX     1 mx1.mail.ovh.net.
                          IN MX     5 mx2.mail.ovh.net.
                          IN A      ???
                          IN AAAA   ???
                          IN TXT    "1|www.rubenbelow.com"
                      600 IN TXT    "v=spf1 include:mx.ovh.com ~all"
_autodiscover._tcp        IN SRV    0 0 443 mailconfig.ovh.net.
_imaps._tcp               IN SRV    0 0 993 ssl0.ovh.net.
_submission._tcp          IN SRV    0 0 465 ssl0.ovh.net.
autoconfig                IN CNAME  mailconfig.ovh.net.
autodiscover              IN CNAME  mailconfig.ovh.net.
ftp                       IN CNAME  rubenbelow.com.
imap                      IN CNAME  ssl0.ovh.net.
mail                      IN CNAME  ssl0.ovh.net.
pop3                      IN CNAME  ssl0.ovh.net.
smtp                      IN CNAME  ssl0.ovh.net.
www                       IN CNAME  ???
```

_Some values are replaced with: ???_

In the next step, we're going to import our entries in AWS Route 53. Before, let us delete some entries.

Records to delete:

```
IN NS     dns18.ovh.net.
IN NS     ns18.ovh.net.
...
IN A      ???
IN AAAA   ???
...
www                       IN CNAME  ???
```

### Create an AWS Route 53 Hosted Zone

[Log in to your AWS console](https://console.aws.amazon.com/route53/home#hosted-zones:), go to Route 53, and click on: _Create Hosted Zone_. As: _Domain Name_, use the name of your apex domain: `example.com`.

### Modify your DNS file SOA record

Before starting with the next step we need to change the `SOA` (Start of Authority) record to match the new one.

**Change:**

```
@	IN SOA dns18.ovh.net. tech.ovh.net. (2019112215 86400 3600 3600000 300)
```

**To the `SOA` record in your new Hosted Zone.**

The entry should now be like:

```
@	IN SOA ns-289.awsdns-36.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
```

### Import your DNS file into Route 53

Now that we have a fresh hosted zone we'll import the `RR` records we exported from OVH.

**Do not import the previously deleted `NS`, `A`, and `AAAA` records!**

1. Click on your new Hosted Zone: `example.com` (you'll see a list of RRs)
2. Click on: _Import Zone File_
3. Paste your previously exported `DNS` records
4. Import your `DNS` records

If you get: _"Error parsing zone file: One resource cannot have multiple distinct TTL values"_. Delete the mismatching `TTL` from the zone file.

From:

```
600 IN TXT    "v=spf1 include:mx.ovh.com ~all"
```

To:

```
IN TXT    "v=spf1 include:mx.ovh.com ~all"
```

### Add an ALIAS record

_So far, so good._

Now we add an `A` `ALIAS` record for the naked domain; `example.com` pointing to our AWS S3 bucket.

![AWS Route 53 A record with ALIAS](https://dev-to-uploads.s3.amazonaws.com/i/gz70u7v6p981zwc5u7wc.png)

_It should be like this but with an S3 bucket URL instead of a CloudFront URL_

**Do the same now with an `AAAA` record.**

### Add a CNAME record

Add a `CNAME` record for your `www` subdomain pointing to your apex domain: `example.com`.

![AWS Route 53 CNAME record pointing to apex domain](https://dev-to-uploads.s3.amazonaws.com/i/wcknw28n3ljoqc4yelxj.png)

_It should be like this_

### Get your new NS entries

Get the values of your `NS` entry. We're going to use them at OVH in the next step.

They should be like:

```
ns-289.awsdns-36.com.
ns-1715.awsdns-22.co.uk.
ns-1241.awsdns-27.org.
ns-740.awsdns-28.net.
```

### Add your new AWS NS values to your domains registrar

In your OVH account go to: _DNS servers_

1. Delete the old OVH `NS` records
2. Add your new AWS `NS` records

_Good to go._

### Troubleshooting

The changes will take some time to propagate (sometimes up to 24h). We can check the state of the DNS (Domain Name Server) update on:

- [Zonemaster](https://www.zonemaster.net/domain_check)
- [MXToolBox](https://mxtoolbox.com/dnscheck.aspx)
- [DNS Checker](https://dnschecker.org/)

If the DNS update is done but you cannot access `example.com` through your computer, it could be that your ISP (Internet Service Provider) still did not update their RR cache. In this case, you should be able to [access your website through a VPN](https://www.hidemyass.com/en-eu/proxy).

---

Thanks for learning with this tutorial.

**_Follow me on [GitHub](https://github.com/rbelow)._**

_If for some casual the indications did not work for you; don't mind to [drop me a line with the infringing points](mailto:hello@rubenbelow.com?subject=Infringing%20Point). I'll update the post correspondingly._

## References

- [Migrating DNS](https://docs.aws.amazon.com/de_de/Route53/latest/DeveloperGuide/MigratingDNS.html)
- [Migrate DNS Domain in Use](https://docs.aws.amazon.com/de_de/Route53/latest/DeveloperGuide/migrate-dns-domain-in-use.html)
- [How to Resolve Error in AWS Route 53 Import Zone File](https://stackoverflow.com/questions/34478249/how-to-resolve-error-in-aws-route-53-import-zone-file-error-multiple-distinc)

## More Posts

- [Welcome](https://rubenbelow.com/posts/welcome/)