Amazon Route 53 pricing

 

Get Started With DNS Failover At No Additional Cost*

New and existing customers can create up to 50 health checks for AWS endpoints that are within or linked to the same AWS account for free.

The monthly health check prices listed above are prorated for partial months.

Need more than 200 health checks? Please contact us.

*New and existing customers are not charged for health checks on up to 50 AWS endpoints (described below) that are within or linked to their AWS account (the “Offer”). The Offer is subject to the AWS Customer Agreement and is a Special Pricing Program under the AWS Service Terms. You will be charged AWS’s standard rates for any use that exceeds the usage amount provided at no additional cost under the Offer. Unused usage amounts remaining at the end of the Offer term do not roll over. When calculating your use of AWS services under the Offer, we will aggregate your use across all AWS Regions.

An AWS endpoint is a resource running within AWS (e.g., an Amazon EC2 instance) that is provisioned within the same AWS account as the health check or billed to the same account as the health check. Calculated health checks and metric based health checks are billed as health checks of an AWS endpoint. You are not billed for health checks of Elastic Load Balancing resources or Amazon S3 buckets that are configured as website endpoints. Health checks of Elastic Load Balancing resources and S3 website bucket endpoints are provisioned automatically by AWS and are available at no additional charge as part of Route 53.

 

Resolver Endpoints

You can configure Route 53 Resolver endpoints with or without DNS over HTTPS (DoH)* to resolve DNS queries between your on-premises resources and VPCs in the Regions, or between AWS Outposts racks and your other on-premises resources. A Route 53 Resolver endpoint requires two or more IP addresses. Each IP address corresponds with one Elastic Network Interface (ENI). A single outbound endpoint can be used by multiple VPCs that were created by multiple accounts within the same region.

• $0.125 per ENI per hour

Recursive DNS Queries To and From On-Premises Networks

Only queries that pass through a Route 53 Resolver endpoint (either inbound or outbound) will be charged. Queries that resolve locally using the Route 53 Resolver will not be charged.

• $0.40 per million queries (first 1 billion queries per month)
• $0.20 per million queries (over 1 billion queries per month)

*Resolver endpoints support for DoH is not currently available for AWS Outposts rack.

Resolver Query Logs

Route 53 does not charge for Resolver query logs. However, when you configure DNS query logging, you incur Amazon CloudWatch, Amazon S3 or Amazon Kinesis Data Firehose charges depending upon the target destination you choose for your logs. For information about log charges, see the Logs section on the CloudWatch pricing page.

 

 

Domains

Pricing for domain names varies by TLD. View a full list of current pricing by TLD. Domain names are registered in annual increments. Prices listed are per domain per year unless otherwise noted. We do not currently offer volume discount pricing for domain registrations.

You may not use Promotional Credit for any fees or charges for Route 53 domain name registration. For more information regarding use of Promotional Credits, please click here.

There is a default limit of 20 domain name registrations per account. To request a higher limit, please contact us.

Route 53 Profiles

For Route 53 Profiles, the hourly rate is $0.75 per AWS account for up to 100 Profile-VPC associations pertaining to the Profiles created by an account in an AWS Region. Beyond the initial 100 associations, there is a charge of $0.0014 per Profile-VPC association per hour per AWS Region. The hourly rate of the base tier of the first 100 Profile-VPC associations includes associations across all Profiles owned by the AWS account in an AWS Region.

Pricing Example #1
An AWS account creates 3 Profiles in the US East (N. Virginia) region. Each Profile is associated with 30 VPCs in the account, totaling 90 VPCs across 3 Profiles.

Total Profile-VPC associations = 30 + 30 + 30 = 90

At the end of a 30-day month, your AWS account would incur the following costs for Route 53 Profiles =
[$0.75 (per hour) (for first 100 VPCs) + Total of VPC associations beyond 100 * $0.0014] x [24 hours x 30 days]
= [$0.75 + $0] x 720
= $540

Pricing Example #2
An AWS account creates a Profile in the US East (N. Virginia) region. The Profile is associated with 50 VPCs in the account. The Profile is also shared with another AWS Account (using AWS Resource Access Manager) which associates the Profile to 50 VPCs in its account.

Total Profile-VPC associations = 100 (50 in owner account + 50 in shared account)

At the end of a 30-day month, your AWS account would incur the following costs for Route 53 Profiles =
[$0.75 (per hour) (for first 100 VPCs) + Total of VPC associations beyond 100 * $0.0014] x [24 hours x 30 days]
= [$0.75 + $0] x 720
= $540

Pricing Example #3
An AWS account creates a Route 53 Profile in the US East (N. Virginia) region that is associated with 200 VPCs in its account.

Total Profile-VPC associations = 200

At the end of a 30-day month, your AWS account would incur the following costs for Route 53 Profiles =
[$0.75 (per hour) (for first 100 VPCs) + Total of VPC associations beyond 100 * $0.0014] x [24 hours x 30 days]
= [$0.75 + 100 x $0.0014] x 720
= $640.8

Resolver DNS Firewall

DNS Queries

We charge for DNS queries originating from within VPCs that have firewall rule group associations and DNS queries traversing inbound Resolver endpoints from on-premises networks into VPCs that have firewall rule group associations. Please note that any DNS queries that result from following CNAMEs are also charged.

• $0.60 per million queries (first 1 billion queries per month)
• $0.40 per million queries (over 1 billion queries per month

Domain Names

We charge a fee for each domain name stored in a domain list within a rule group. No fees are charged for domain names within managed domain lists.

• $0.0005 per month (prorated hourly)

Resolver DNS Firewall Advanced

We charge an hourly fee for each DNS Firewall rule group which contains one or more DNS Firewall Advanced rules, per VPC association in an AWS Region. All charges are aggregated per month and prorated hourly. A VPC association for a DNS Firewall rule group can be made by an account within a region.

• $0.16 per hour

Managed Domain Lists

When using managed domain lists within your firewall rules, you are not charged for the domain names fee above, but you are charged for the DNS queries that are inspected against the rules which use managed domain lists.

 

Pricing Examples

Example #1

An AWS account associates DNS Firewall rule groups to a single VPC, containing DNS Firewall rules for blocking domains listed in the Managed Domain List. The rule group inspects 1 billion queries during the billing month.

At the end of a 30-day month, your AWS account would incur the following costs for Route 53 Resolver DNS Firewall

= $0.60 per million queries * (1 billion queries)

= $600 per month

 

Example #2

An AWS account associates DNS Firewall rule groups to a single VPC, containing DNS Firewall rules for blocking domains listed in the Managed Domain List. The rule group inspects 2 billion queries during the billing month.

At the end of a 30-day month, your AWS account would incur the following costs for Route 53 Resolver DNS Firewall

= $0.60 per million queries * (1 billion queries) + $0.40 per million queries * (1 billion queries)

= $600 +$400

= $1,000 per month

 

Example #3

An AWS account associates DNS Firewall rule groups to a single VPC, containing DNS Firewall Advanced rules for blocking DNS traffic associated with Domain Generated Algorithms (DGAs) and DNS Tunneling. The rule group is associated to the VPC for 24 hours and 30 days, during the billing month. The account does not have any other DNS Firewall rules associated to the VPC, besides the DNS Firewall Advanced rules.

At the end of the month, your AWS account would incur the following costs for Route 53 Resolver DNS Firewall

= $0.16 per hour * (24 hours *30 days)

= $115.20 per month

 

Example #4

An AWS account associates DNS Firewall rule groups to a single VPC, containing DNS Firewall Advanced rules for blocking DNS traffic associated with Domain Generated Algorithms (DGAs) and DNS Tunneling. The rule group is associated to the VPC for 24 hours and 30 days, during the billing month. Besides the DNS Firewall Advanced rules, the rule group also contains rules to block domains listed in the Managed Domain Lists and inspects 1 billion queries during the billing month.

At the end of the month, your AWS account would incur the following costs for Route 53 Resolver DNS Firewall

= $0.16 per hour * (24 hours *30 days) + $0.60 per million queries * (1 billion queries)

= $115.20 + $600

= $715.20 per month

 

Example #5

An AWS account associates DNS Firewall rule groups to a single VPC, containing DNS Firewall Advanced rules for blocking DNS traffic associated with Domain Generated Algorithms (DGAs) and DNS Tunneling. The rule group is associated to the VPC 24 hours per day for 10 days, during the billing month.

At the end of the month, your AWS account would incur the following costs for Route 53 Resolver DNS Firewall. The costs will be prorated for only the 10 days of the month when the rule group, containing DNS Firewall Advanced rules were associated to the VPC.

= $0.16 per hour * (24 hours * 10 days)

= $38.40 per month

 

 

DNSSEC

Route 53 does not charge you to enable DNSSEC signing on your public hosted zones or to enable DNSSEC validation for Route 53 Resolver. However, when you enable DNSSEC signing on your public hosted zones, you incur AWS Key Management Service (KMS) charges for storing the private key and using the instances of the key to sign your zones. For more information about KMS charges, see section KMS key and ZSK management in Route 53 in the Route 53 Developer Guide and the KMS pricing page.

Note that you can choose to use a single customer-managed AWS KMS key that is stored in KMS across multiple public hosted zones.