Supported provider
AWS Route 53 DNS, in the same place as everything else.
Does DNSMentor support AWS Route 53?
Yes. DNSMentor manages AWS Route 53 DNS through its API, showing its zones alongside the other 25 supported providers in a single estate view. Every AWS Route 53 change goes through the same 56 pre-flight checks, approval policy, independent verification and tamper-evident audit trail as every other provider.
Connecting AWS Route 53
- Create the credential in AWS Route 53 AWS console → IAM → Users → the user you created for DNSMentor → Security credentials → Create access key → 'Application running outside AWS'. Attach a policy granting only route53:ListHostedZones, route53:GetHostedZone, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets, and scope the last of those to the hosted zone ARNs you want DNSMentor to manage — an unrestricted Route53FullAccess key can also delete every zone in the account. The same policy can carry an aws:SourceIp condition restricting the key to DNSMentor's egress addresses, which is strongly recommended.
- Add the connection in DNSMentor Go to Admin → Providers & API keys, choose AWS Route 53, and paste the credential. DNSMentor stores it encrypted and strips it from every log and export.
- Sync the estate DNSMentor discovers every zone the AWS Route 53 account holds and imports every record in them. This is a read operation — nothing is written to any zone.
- Group by client and start working Assign the imported domains to client portfolios, and the estate view, health scoring, checks and audit trail apply from that point on.
What AWS Route 53 asks you for
The exact fields DNSMentor needs, and where in AWS Route 53 to create them. Every secret is encrypted at rest and stripped by name from logs, exports and the audit trail.
Access Key ID not secret AWS console → IAM → Users → the user you created for DNSMentor → Security credentials → Create access key → 'Application running outside AWS'. Attach a policy granting only route53:ListHostedZones, route53:GetHostedZone, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets, and scope the last of those to the hosted zone ARNs you want DNSMentor to manage — an unrestricted Route53FullAccess key can also delete every zone in the account. The same policy can carry an aws:SourceIp condition restricting the key to DNSMentor's egress addresses, which is strongly recommended.
Secret Access Key secret Shown once, on the screen where the access key is created, and never again — if it was not saved then, delete the key and create another. AWS cannot retrieve it for you.
Session Token secret Only for temporary credentials from AWS STS or IAM Identity Center. Leave empty for an ordinary IAM user access key. A session token expires — usually within hours — and every DNSMentor call fails until the connection is re-entered, so a long-lived IAM user key is the better fit here.
Signing Region not secret Leave empty. Route 53 is a global service and DNSMentor signs against us-east-1 regardless of where the customer's other AWS resources are. Set this only for the China partition (cn-northwest-1) or GovCloud (us-gov-west-1), which use different endpoints.
The sharp edge in AWS Route 53's API
Every provider API has one behaviour that catches integrations out. This is AWS Route 53's, and DNSMentor's adapter is written around it — the sort of thing you would otherwise discover during a migration.
What you get on top of the AWS Route 53 console
One estate, not one provider
AWS Route 53 zones sit beside every other provider your clients came with, grouped by the client who pays for them and searchable in one place.
56 checks before apply
The AWS Route 53 console will accept a second SPF record or an MX pointing at an address without comment. DNSMentor will not.
Approval and audit
A second pair of eyes where policy requires it, and a hash-chained record of who changed what — neither of which a provider console offers.
AWS Route 53 questions
Can I manage AWS Route 53 DNS alongside my other providers?
Yes. DNSMentor connects AWS Route 53 through its API and shows its zones in the same estate view as every other provider you connect — 26 are supported in total. Your engineers work in one interface instead of switching between provider portals, and the same checks, approval policy and audit trail apply regardless of which provider a domain happens to be with.
What credentials does DNSMentor need for AWS Route 53?
DNSMentor needs Access Key ID, Secret Access Key, Session Token, Signing Region for AWS Route 53. AWS console → IAM → Users → the user you created for DNSMentor → Security credentials → Create access key → 'Application running outside AWS'. Attach a policy granting only route53:ListHostedZones, route53:GetHostedZone, route53:ListResourceRecordSets and route53:ChangeResourceRecordSets, and scope the last of those to the hosted zone ARNs you want DNSMentor to manage — an unrestricted Route53FullAccess key can also delete every zone in the account. The same policy can carry an aws:SourceIp condition restricting the key to DNSMentor's egress addresses, which is strongly recommended.
Does DNSMentor move my zones away from AWS Route 53?
No. Your zones stay hosted at AWS Route 53 and remain authoritative there. DNSMentor reads and writes through the AWS Route 53 API, so nothing about your resolution path changes, and if you stop using DNSMentor the zones carry on exactly as they are.
Does DNSMentor validate AWS Route 53 changes before applying them?
Yes. All 56 checks run against the zone as it would exist after the change, whichever provider hosts it. The change is then simulated, routed for approval if policy requires it, written through the AWS Route 53 API after re-reading live state, and independently verified in public DNS afterwards.
Other providers DNSMentor manages
Connect AWS Route 53 in about five minutes.
Paste one credential, sync, and see every zone in that account. It is a read operation — nothing is written until somebody presses apply.
No card. No trial clock. UK-hosted, and we will tell you which providers we have actually proven before you ask.
Last updated