Recently I started looking at AWS Route53.
I am able to create a Hosted Zone for any domain. What prevents someone to create a Hosted Zone for a domain which they don't own? This way it should be possible to redirect traffic.
1 Answers
4
votes
You can even create two (or more) hosted zones for the exact same domain within a single AWS account, and it still won't matter. Only one will be live on the Internet.
The reason is because Route 53 has at least 2,048 DNS server names and IP addresses allocated... but each hosted zone assigned to -- and is valid on -- exactly 4 of them. None of the others will respond to queries for your domain's data. These are shown in the console and automatically added as NS records in the hosted zone. Editing the NS records breaks your zone but doesn't actually change the 4 assigned server IP addresses.
Create a second hosted zone for the same domain, and it will be assigned to 4 different Route 53 nameserver IP addresses.
When you configure your authoritative name servers with your registrar, you provide the 4 nameserver addresses assigned by Route 53 to the hosted zone that you want to be live, and that's where the resolvers on the Internet will send queries for your domain... not any of the others. So, if someone does create a hosted zone for your domain, it doesn't matter -- their hosted zone will be on 4 different nameservers, none of which will actually by queried by any system trying to resolve your domain.
Note that there are 4 nameserver addresses assigned to your hosted zone, but that does not mean there are only 4 actual nameservers. The IP addresses assigned to the Route 53 name servers are anycast addresses. Multiple servers around the globe respond to the same set of 4 IP addresses.
If, for some reason, you still see this as a potential problem, consider the fact that this is no different than configuring a zone file for a domain you do not own, on a set of DNS servers that you control, located anywhere on the Internet. It won't impact the domain operationally, because nobody will ever query your servers -- they are not authoritative for the domain.
