How do I resolve DNS and routing issues when I connect to Route 53 hosted domains that are mapped to CloudFront distributions?

Resolution

To resolve DNS resolution and routing issues when you connect to your domains that you mapped to CloudFront distributions, check the following configurations.

Verify your domain DNS settings

To confirm that you correctly set up your domain in Route 53, see How do I troubleshoot and resolve website access issues in Amazon Route 53?

Check your CloudFront distribution settings

Take the following actions:

• Check that the CloudFront distribution has an alternate domain name (CNAME) that matches the name of the Route 53 record that you want to create. If the distribution doesn't have a CNAME, then add one. 
• Confirm that you correctly set up an SSL certificate for the domain name. If you used AWS Certificate Manager (ACM) to issue the certificate, then verify that the certificate is in the "Issued" state.
• In the Origin settings, confirm that the Origin path points to your origin server. For a list of origin servers that you can use, see Use various origins with CloudFront distributions.

Confirm that your alias record is correct

To route traffic from your domain to the CloudFront distribution, provide the correct alias record in Route 53.

Complete the following steps:

1. Open the Route 53 console.
2. In the navigation pane, choose Hosted zones, and then select your hosted zone.
3. For Alias, check that you have the correct A - IPv4 record for the domain or subdomain that points to your CloudFront distribution.
4. If you configured IPv6 and you're creating a second record, then choose the AAAA - IPv6 alias record type.

For more information, see Configuring Amazon Route 53 to route traffic to a CloudFront distribution.

Check the IP address resolution, HTTP responses, and blocked requests

If your domain doesn't resolve to the CloudFront distribution after you configure the alias record, then check IP address resolution, HTTP responses, and blocked requests.

Note: In the following commands, replace domain-name with your fully qualified domain name.

To confirm that your domain resolves to the correct IP address, run one of the following commands for your operating system (OS).

Linux or Unix:

dig domain-name

Windows:

nslookup domain-name

To check the HTTP response, run the following curl command:

curl -ivL domain-name

The command's output shows the HTTP headers that your domain returned and whether the request is reaching the correct server.

Example output:

HTTP/1.1 200 OK  
Server: CloudFront  
X-Cache: Hit from cloudfront  
Via: 1.1 example-id.cloudfront.net (CloudFront)

If there are other server entries or errors such as "403 Forbidden" without CloudFront headers, then traffic might not be routing through your CloudFront distribution.

If you use AWS WAF, then review your AWS WAF logs for detailed information about blocked requests.

Related information

Why can't I access my website that uses Route 53 DNS services?

How can I identify and troubleshoot DNSSEC configuration issues in Route 53?

Routing traffic to an Amazon CloudFront distribution by using your domain name

Troubleshooting Amazon Route 53