AWS Route53 high security documentation change
Summary
Updated DNSSEC transfer procedure to explicitly require removal of DS records and 24-hour propagation wait
Security assessment
This change addresses a specific DNSSEC misconfiguration risk during domain transfers. The added requirement to remove DS records and wait 24 hours prevents potential DNS resolution failures and security vulnerabilities that could occur if DNSSEC records remain active during transfer. The explicit propagation period is critical for maintaining DNS security integrity.
Diff
diff --git a/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.md b/Route53/latest/DeveloperGuide/domain-transfer-to-route-53.md index 621aa5850..dbe0529b4 100644 --- a//Route53/latest/DeveloperGuide/domain-transfer-to-route-53.md +++ b//Route53/latest/DeveloperGuide/domain-transfer-to-route-53.md @@ -212 +212 @@ Disable DNSSEC for the domain** -If you use DNSSEC with a domain and you transfer the domain registration to Route 53, you must disable DNSSEC at the former registrar first. Then, after you transfer the domain registration, take steps to set up DNSSEC for the domain in Route 53. Route 53 supports DNSSEC for domain registration and for DNSSEC signing. For more information, see [Configuring DNSSEC signing in Amazon Route 53](./dns-configuring-dnssec.html). +If you use DNSSEC with a domain and you transfer the domain registration to Route 53, you must remove the DS records for your domain at your current registrar before transferring. After removing the DS records, wait at least 24 hours for the change to propagate before proceeding with the transfer. Then, after you transfer the domain registration, you can set up DNSSEC for the domain in Route 53. Route 53 supports DNSSEC for domain registration and for DNSSEC signing. For more information, see [Configuring DNSSEC signing in Amazon Route 53](./dns-configuring-dnssec.html).