Lecture 215: Route 53 - Subdomain Zones
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:50
- 来源：Udemy Lecture 28556465
- Slide 数量：8
- 画面切换：01:39、02:26、03:28、04:22、05:09、06:24、07:10
扫描说明
逐条读取了 Udemy 页面中的 184 条英文 Transcript cue，并按时间轴扫描全长约 07:50 的视频。依据重叠 Namespace 的 Most-specific Match、Subdomain NS Delegation、第三方 Parent 场景、创建 Subdomain Zone、委派前 NXDOMAIN、Parent NS Record、TTL 后解析成功、Cross-account 与 IAM 用途划分为 8 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Hosted Zone 重叠时，Route 53 Resolver 选择最具体的 Namespace
时间范围：00:00–01:39
总结 / Summary
中文
Route 53 创建 Hosted Zone 时自动生成 NS 与 SOA Record。当 Public/Private Zone 或多个 Private Zone 的 Namespace 重叠时，Resolver 按 Most-specific Match 选择 Zone：例如 example.com 与 accounting.example.com 并存，accounting.example.com 及其更深名称会进入后者，其余名称进入前者。拆分 Zone 也便于按 Zone 施加不同 IAM 权限。
English
Route 53 automatically creates NS and SOA records for a hosted zone. When public and private zones, or multiple private zones, overlap, the resolver chooses the most-specific matching namespace. With example.com and accounting.example.com, names under accounting go to the latter and other names go to the former. Separate zones also enable different IAM controls at zone scope.
Transcript
00:00 Okay, so now that's use advance concepts
00:01 around Hosted Zones.
00:03 So, when you create a Hosted Zone,
00:04 Route 53 will automatically create the Name Servers
00:08 and the SOA Records.
00:10 And in case you have both, a Public or Private,
00:13 and Private Hosted Zones,
00:15 that will have overlapping Name Spaces
00:17 and I will show this diagram right now,
00:19 then the resolvers of Route 53 will route traffic
00:22 to the most specific match. So what does that mean?
00:25 That means you have your EC2 instance inside your VPC
00:28 and you have a Public Hosted Zone
00:29 for example.com, the domain you own,
00:32 and also Private Hosted Zone
00:34 for accounting.example.com
00:37 Now, if you're EC2 Instance issues some DNS queries
00:40 such as example.com or hr.example.com,
00:44 they will be matched obviously to the first one, because,
00:46 well, they don't comply with the accounting.example.com
00:50 But if your EC2 Instance is going for accounting.example.com
00:54 or seattle.accounting.example.com or whatever,
00:57 as you can see, the most specific match
01:00 is going to be around the Private Hosted Zone.
01:02 So, no matter what Records you will have
01:04 in that Public Hosted Zones for these DNS,
01:07 for these host names,
01:08 you will be redirected to the most specific Hosted Zone.
01:13 So this is also true, if you have two Private Zones, again,
01:16 one for example.com and one for accounting.example.com
01:20 Again, the most specific Records
01:21 will go to the most specific Zone.
01:24 Now, why would you do that?
01:25 Why would you have two Hosted Zones?
01:26 Well, maybe you want to apply some permissions
01:28 around AIM about who can manage a Public Hosted Zone,
01:31 or who can manage a Private Hosted Zone
01:33 that is more specific, in which case it's reliable
01:36 and more advised to have two Hosted Zones.
2. Parent Zone 用 NS Record 把 Subdomain 委派给独立 Hosted Zone
时间范围：01:39–02:26
总结 / Summary
中文
为 acme.example.com 创建独立 Hosted Zone 后，它会获得自己的四个 Name Server。要让公共 DNS 链找到这个 Subdomain Zone，必须在 Parent example.com Zone 中创建名为 acme.example.com 的 NS Record，Value 精确填写子 Zone 的四个 Name Server；这就是 Subdomain Delegation。
English
A separate hosted zone for acme.example.com receives its own four name servers. To make the public DNS hierarchy reach it, create an NS record named acme.example.com in the parent example.com zone and use exactly those four child-zone name servers as the values. This is subdomain delegation.
Transcript
01:39 So, now let's talk about Subdomains.
01:41 So, the idea is that we have Hosted Zone example.com,
01:45 but we want to create this Subhosted,
01:47 these smaller Subdomains Hosted Zones.
01:50 So, we reach a Hosted Zone, example.com
01:53 and under one Record, for example, acme.exaple.com
01:57 we're going to create a NS type of Record
02:00 with four named servers.
02:01 And it turns out that if we create the Hosted Zone
02:04 acme.example.com, we have to match the values
02:07 of the Hosted Zone to the one, to the one above.
02:10 But the idea is that now we delegate, okay,
02:12 all the Records from the first Hosted Zone
02:14 to the second Hosted Zone
02:15 when they match the Subdomain acme.example.com
02:18 And so, this is known as "Delegation Responsibility
02:21 for a Subdomain to Hosted Zone" or
02:23 "Delegating a Subdomain to Another Name Servers."
3. Subdomain 可分团队管理，也可只把部分 DNS 放到 Route 53
时间范围：02:26–03:28
总结 / Summary
中文
独立 Subdomain Zone 可让 accounting、engineering、internal 等子域由不同 Team 管理，因为 IAM 权限只能下放到 Hosted Zone Level，不能细到单条 Record。Parent Zone 不必位于 Route 53；第三方 DNS Provider 只需为子域创建 NS Record，指向 Route 53 Child Zone 的 Name Server，即可仅迁移部分 Namespace。
English
Separate subdomain zones let teams manage areas such as accounting, engineering, or internal because IAM permissions apply at hosted-zone level rather than per record. The parent zone does not need to be in Route 53: a third-party DNS provider can publish an NS record for the subdomain pointing to the Route 53 child-zone name servers, migrating only that namespace.
Transcript
02:26 And the use cases for this will be to have,
02:28 for example, different Subdomains
02:29 managed by different teams.
02:31 For example, you have accounting.example.com,
02:33 you have engineering.example.com, internal.example.com,
02:37 et cetera, et cetera.
02:38 Or, this is also very helpful as said,
02:39 because IAM permissions can be only applied
02:42 at the Hosted Zone level, not at the Records level.
02:44 And so therefore, you may want you to have
02:46 different Hosted Zones and different users
02:47 with different permissions to manage these Hosted Zones.
02:50 And you're going to apply this same logic
02:52 if the primary Hosted Zone is not even in Route 53.
02:56 So if we created these Subdomain Hosted Zone
02:58 for acme.example.com with these Name Servers,
03:02 then we can use any 3rd Party DNS Service again
03:05 for the Parent Domain example.com
03:06 and point the Subdomain NS Record
03:10 into the ones from Route 53.
03:12 And therefore, we'll have a Subdomain management
03:14 just for that Subdomain on the Route 53.
03:16 So this is some advanced use cases of Domain Name Services,
03:22 but at least we see how we can split them
03:24 and maybe partly use a 3rd Party DNS Service in Route 53.
4. 创建 sub.stephanetheteacher.com Public Hosted Zone 与测试 A Record
时间范围：03:28–04:22
总结 / Summary
中文
Hands-on 先创建 sub.stephanetheteacher.com Public Hosted Zone，并复制其四个 Name Server。随后在 Child Zone 内创建 test.sub.stephanetheteacher.com A Record，Value 为示例地址 11.22.33.44。到这一步，Record 虽已存在，但 Parent Zone 尚不知道应该把该子域 Query 交给谁。
English
The hands-on creates a public hosted zone for sub.stephanetheteacher.com and copies its four name servers. It then creates an A record for test.sub.stephanetheteacher.com with the example value 11.22.33.44. The record exists, but the parent zone does not yet know where queries for the subdomain should be delegated.
Transcript
03:28 So let's go into the UI to see how these things work.
03:32 So, the idea is that I would like to have a Subhosted Zone
03:34 for sub.stephanetheteacher.com
03:36 So, I'll go into my Hosted Zones
03:38 and I will create a new one.
03:39 And it's going to be called sub.stephanetheteacher.com
03:46 and it's going to be a Public Hosted Zone, okay.
03:48 And I will create it.
03:51 And as we can see now,
03:53 I look at the Hosted Zone details
03:54 and I get four named servers available
03:56 for that specific Hosted Zone.
03:58 Now you have to copy and paste them somewhere else.
04:00 So, the idea is that here,
04:02 we're going to have a Record in sub.stephanetheteacher.com
04:05 and we're going to create this Record.
04:08 So we can create, for example,
04:09 the Record test.sub.stephanetheteacher.com Okay?
04:12 And the value is going to be 11.22.33.44,
04:16 just a random Record, okay?
04:18 Let's create this Record,
04:21 and we're good to go.
5. 没有 Parent Delegation 时，Child Zone Record 仍返回 NXDOMAIN
时间范围：04:22–05:09
总结 / Summary
中文
在 CloudShell 中 dig test.sub.stephanetheteacher.com，结果没有 Answer，状态为 NXDOMAIN，Authority 仍来自 Parent Zone 的 SOA。这说明单独创建 Child Hosted Zone 不会自动改变 DNS Delegation；公开解析路径必须从 Parent Namespace 显式连接到 Child Name Server。
English
A CloudShell dig for test.sub.stephanetheteacher.com returns no answer and NXDOMAIN, with authority still coming from the parent zone's SOA. Creating a child hosted zone alone does not alter DNS delegation. The public resolution path must explicitly connect the parent namespace to the child name servers.
Transcript
04:22 So, as we can see right now, if I go into my shell,
04:28 any shell, really, so I'll use my cloud shell,
04:31 and I do a DNS query for sub, sorry
04:35 for test.sub.stephanetheteacher.com and press enter.
04:44 So, let me reinstall y bind-utils.
04:52 Okay, and let's run de query again.
04:57 So, as we can see, we don't have any answer
04:58 for test.sub.stephanetheteacher.com
05:00 As you can see, there's no answer in here.
05:02 That's because we don't know yet how to send
05:06 the queries into this Subhosted Zone.
6. 在 Parent Zone 建 sub NS Record，并填入 Child Zone 四个 NS
时间范围：05:09–06:24
总结 / Summary
中文
回到 stephanetheteacher.com Parent Zone，创建名为 sub 的 NS Record，Value 逐行粘贴 Child Zone 的四个 Name Server，并去掉多余空格。之后命中 sub.stephanetheteacher.com 的 Query 会先在 Parent Zone 看到委派，再交给 Child Zone，由后者返回 test Record。
English
In the stephanetheteacher.com parent zone, create an NS record named sub and paste the child zone's four name servers as separate values, removing extra whitespace. Queries matching sub.stephanetheteacher.com then encounter the parent delegation and are forwarded to the child zone, which can answer for the test record.
Transcript
05:09 And what I can do is go to my main Hosted Zone.
05:12 So this one, stephanetheteacher.com,
05:14 and what I'm going to do here is to create a Record.
05:17 And so the Record is going to be sub.stephanetheteacher.com
05:20 so should be link to my second Hosted Zone, okay?
05:23 And in here the Record type is going to be NS,
05:27 so it's Name Servers for a Hosted Zone.
05:29 And the value has to be the exact same value
05:31 we got from here, because we're saying
05:33 "Hey, for this Subdomain, really,
05:35 I go to these names servers, and these names servers
05:37 we'll know in here what to do."
05:40 So, what I'm going to do here is paste the value
05:44 and let's make sure to remove any white space
05:47 before these Records.
05:50 Okay. And let's make sure that we create
05:54 these Records right now.
05:56 So, this Record was successfully created.
05:58 And now if we look at sub, here's my Record.
06:01 And so, what was going to happen is on now,
06:02 any queries that goes into this Hosted Zone,
06:06 but that will match this sub.stephanetheteacher.com
06:09 is saying, "Hey, delegate these queries
06:11 to these Name Servers."
06:12 And these Name Servers are actually linked
06:15 to this Hosted Zone right here.
06:17 And this Hosted Zone will have a look at it,
06:19 look it up and say,
06:20 "Yes, I know test.sub.stephanetheteacher.com
06:22 it's this value."
7. 等待 Negative Cache TTL 后，dig 成功返回 11.22.33.44
时间范围：06:24–07:10
总结 / Summary
中文
刚创建 NS Delegation 后，重复 dig 仍可能因之前的 NXDOMAIN Negative Cache 而无结果；示例需要等待剩余约 159 秒。TTL 到期后再次查询，Answer Section 正确返回 test.sub.stephanetheteacher.com A 11.22.33.44，证明 Parent NS Record 与 Child Zone 组合生效。
English
Immediately after creating the delegation, dig may still show the earlier NXDOMAIN because of negative caching; the example waits for roughly 159 remaining seconds. Once the TTL expires, the answer section returns test.sub.stephanetheteacher.com A 11.22.33.44, proving the parent NS record and child zone work together.
Transcript
06:24 So let's obviously test it out and make sure that it works.
06:27 So let's clear the screen and repeat the command.
06:31 So, currently we still have no results
06:32 because while we have a TTL associated
06:35 with the previous query,
06:36 and it turns out that I need to wait 159 seconds now
06:40 for the new query to be issued.
06:41 So I'm going to have to wait a little bit
06:43 and get back to you.
06:44 Okay. So let's try the command again.
06:47 So test.sub.stephanetheteacher.com, press enter.
06:53 And, as we can see now,
06:54 well, we give the answer section,
06:56 which is an A Record as 11.22.33.44
06:59 So, the Subdomain delegation works,
07:01 and for this we have to set up a Name Services,
07:04 Name Server Record in the main Hosted Zone.
07:06 And in the Subhosted Zone would be able to answer
07:08 the queries for this one.
8. Subdomain Delegation 支持 Cross-account 与最小权限治理
时间范围：07:10–07:50
总结 / Summary
中文
Child Hosted Zone 可以位于完全不同的 AWS Account，因为 Parent 只需要发布它的 Name Server。这使组织能把特定 Subdomain 委派给业务 Account 或 Team，并只授予其管理 Child Zone 的 IAM 权限；主域 Hosted Zone 继续由中央 Administrator 控制，实现清晰的责任边界与最小权限。
English
The child hosted zone can live in a completely different AWS account because the parent only needs to publish its name servers. An organization can delegate a specific subdomain to an application account or team and grant IAM access only to that child zone, while central administrators retain control of the parent zone.
Transcript
07:10 So, I hope it made sense and a few things to note.
07:13 So first of all, this sub Hosted Zone
07:15 could be in a completely different AWS accounts. Okay?
07:18 So, this is something that could be living
07:20 in other accounts.
07:21 And so you could do like, Subdomain delegation
07:23 across accounts, which is quite nice,
07:24 because the only things you have to specify
07:26 are the Name Servers.
07:28 It's also very, very helpful from a security perspective,
07:30 because now thinks to IAM.
07:32 We can restrict maybe some users to only this sub,
07:35 the main name.
07:36 Whereas the main Hosted Zone is reserved for administrators,
07:38 something like this.
07:39 So, you have a lot of different combinations
07:41 you can do with this, but hopefully that makes sense.
07:43 You see the power of these kinds of Hosted Zone delegation.
07:47 So, I hope you liked this lecture
07:48 and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Subdomain Delegation 的核心是在 Parent Zone 创建 NS Record，Value 指向独立 Child Hosted Zone 的四个 Name Server。Route 53 对重叠 Namespace 采用 Most-specific Match；独立子 Zone 可跨 Account、跨 DNS Provider，并通过 Hosted Zone 级 IAM 权限实现团队隔离。委派后还需等待先前 Positive/Negative DNS Cache 的 TTL。
English
Subdomain delegation is implemented by publishing an NS record in the parent zone whose values are the four name servers of an independent child hosted zone. Route 53 uses the most-specific match for overlapping namespaces. Child zones can cross AWS accounts or DNS providers and support team isolation through hosted-zone IAM permissions. Existing positive or negative DNS caches must still age out according to TTL.
返回顶部 ↑