Migrating Route53 DNS records to Azure
Tags: aws, azure, devops
Published: 2020-10-12 06:13:18

Recently I've been notified that we need to move our operations away from AWS to Azure. I'll keep my feelings about that decision to myself for now, but one of the steps I found interesting (and never did before) was migrating the DNS provider from AWS Route 53 to Azure DNS Zone.

There are steps we need to take before we export the AWS DNS records. Since AWS has a lot of built in services, there are DNS records that aren't proper DNS records. They works as ones, but they are _A_ type records, pointing to various AWS services. Those services can be load balancers, cloudfront distributions, S3 static websites and other services you aliased under your domain. 

Cleaning up these records is pretty easy. You have to edit the mappings to be readable by any other DNS service. In these cases you will have to create _CNAME_ records for those AWS aliases. ALB/ELB and CloudFront mappings stay the same but you have to change them from _A_ records to _CNAME_ and update the values. The mappings are in the table below:

| DNS entry before | DNS entry after |
---|---
subdomain.acme.inc | subdomain.acme.inc.s3-website.eu-central-1.amazonaws.com

Be sure to set the TTL (Time to live) on these entries to a value you feel comfortable (300 seconds should be okay for DNS records).

After you cleaned up your Route53 from AWS specific aliases, you can export the bind file with this awesome [cli53](https://github.com/barnybug/cli53) tool. 

After you have installed the tool and set the AWS credentials, you can run it with: `cli53 export acme.inc > acme.inc.txt`. This will export all your domain's DNS records into a BIND file format, readable by other DNS services.

Next thing we need to set up is the Azure CLI following the [installation instructions](https://docs.microsoft.com/en-gb/cli/azure/install-azure-cli?view=azure-cli-latest) for your OS. After you have set it up and authenticated, you can create a new DNS zone using this CLI.

`az network dns zone import -g resourceGroup -n acme.inc -f acme.inc.txt`

The whole procedure for creating a resource group and importing/verifying the DNS at Azure is described [here](https://docs.microsoft.com/en-us/azure/dns/dns-import-export)

After you import all your DNS records, you have to verify that they resolve to the correct place. You will need to fetch your domain's NS records with 
`az network dns record-set ns list -g resourceGroup -z acme.inc  --output json`
and take one of the `nsRecords > nsdname` values to test using `nslookup`

```
$> nslookup www.acme.inc ns1-03.azure-dns.com
  
  Server: ns1-03.azure-dns.com
  Address:  40.90.4.1

  Name: www.acme.inc
  Addresses:  134.170.185.46
  134.170.188.221
```
You should test multiple entries to make sure they get resolved to the correct place.

After you have verified the records resolve properly, you can update the DNS delegation in your domain registrar. Since you have the name servers you fetched in the previous step, you can use those in the specific domain registrar you are using. [Here](https://www.domain.com/help/article/domain-management-how-to-update-nameservers) is an example of how it looks like on the domain.com registrar. After they have been propagated (give it 5-10 minutes), you can verify them in your DNS Zone page on Azure.

Resources:
- [CLI53 tool](https://github.com/barnybug/cli53)
- [Azure DNS import/export](https://docs.microsoft.com/en-us/azure/dns/dns-import-export)
- [Delegate domain to Azure DNS](https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns)