Weird Route 53 wildcard behavior

Question

I have *.example.com Route 53 alias record which pointed to distribution1.cloudfront.net.
Distribution1 has static.example.com as alternative name.
So far so good - it's standard DNS behavior.

I created another CF distribution - distribution2.cloudfront.net, with dynamic.example.com alternative name.
And, without adding dynamic.example.com DNS record, which points to the second distribution, web requests to dynamic.example.com are going to distribution2.cloudfront.net, not according to DNS.
I.e., 'nslookup dynamic.example.com' returns distribution1.cloudfront.net IPs, but HTTP request - objects from distribution2.cloudfront.net.

It's definitely a feature, but 
1) I'd like to understand how it's implemented technically
2) I already RTFM, but couldn't see any documentation regarding this

TIA, Vitaly

re:Post Agent · Accepted Answer

The behavior you're experiencing is indeed a feature of Amazon CloudFront and its integration with Route 53, but it's not standard DNS behavior. This is actually a result of how CloudFront handles requests at the edge locations.

When you create a CloudFront distribution with an alternate domain name (CNAME), CloudFront associates that domain name with the distribution at its edge locations. In your case, when you created distribution2 with dynamic.example.com as an alternate name, CloudFront registered this association.

Now, even though your DNS (Route 53) is still pointing *.example.com to distribution1, when a request reaches a CloudFront edge location for dynamic.example.com, CloudFront recognizes that this specific subdomain is associated with distribution2 and routes the traffic accordingly.

This behavior allows for more flexible and granular routing at the CloudFront level, without requiring changes to DNS records for every subdomain. It's particularly useful when you want to serve different content for different subdomains without managing multiple wildcard DNS entries.

However, this can lead to the discrepancy you've observed:
1. DNS lookups still return the IPs for distribution1 because that's where the wildcard record points.
2. HTTP requests are served by distribution2 because CloudFront recognizes the specific alternate domain name association.

As for why this isn't well-documented, it's because this behavior is more of an implementation detail of how CloudFront works with alternate domain names rather than a specific feature. It's a result of CloudFront's architecture designed to provide flexibility in content delivery.

To avoid confusion, it's generally a good practice to create specific DNS records for subdomains that you want to associate with different CloudFront distributions, even if you have a wildcard record in place. This ensures that both DNS lookups and HTTP requests behave consistently and as expected.  
**Sources**  
[Choosing between alias and non-alias records - Amazon Route 53](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resource-record-sets-choosing-alias-non-alias.html)  
[DNS best practices for Amazon Route 53 | Networking & Content Delivery](https://aws.amazon.com/blogs/networking-and-content-delivery/dns-best-practices-for-amazon-route-53/)  
[Amazon Route 53 features - Amazon Web Services](https://aws.amazon.com/route53/features/)

Weird Route 53 wildcard behavior

Add your answer

Relevant content