As with all of the other services in AWS, shared responsibility comes into effect. Even though the service is made highly available and ultra resilient, we should still ensure our DNS records are correct and reflect the best practices for security. When designing services on Route 53, we should be adhering to the following best practices:
- Domain auto renew can automatically renew your domain and protect it from hijacking on expiry
- Domain transfer lock can also help to prevent your domain from being hijacked at any time
- Privacy protection can be used to hide contact information
- Private records should not be entered into public zones
- You can protect your Route 53 configuration with AWS Config or CloudTrail so you can detect any rouge actions