Issue Summary
Route53 ALIAS record for API Gateway custom domain shows different IPs between test-dns-answer API and actual authoritative nameserver queries. The authoritative nameservers are serving stale/cached data.
Evidence of Bug
Route53 API (test-dns-answer) - CORRECT:
aws route53 test-dns-answer
--hosted-zone-id Z007884011C6EPZSLAHEH
--record-name api.dev.purposepath.app
--record-type A
Response: 44.205.182.192, 44.212.214.71 ✅ (Current API Gateway IPs)
Route53 Authoritative Nameservers - WRONG (STALE):
ALL FOUR nameservers return same stale IP:
nslookup api.dev.purposepath.app ns-503.awsdns-62.com
Result: 18.204.152.241 ❌
nslookup api.dev.purposepath.app ns-1081.awsdns-07.org
Result: 18.204.152.241 ❌
nslookup api.dev.purposepath.app ns-733.awsdns-27.net
Result: 18.204.152.241 ❌
nslookup api.dev.purposepath.app ns-1762.awsdns-28.co.uk
Result: 18.204.152.241 ❌
Configuration Details
Hosted Zone: Z007884011C6EPZSLAHEH (purposepath.app)
Record: api.dev.purposepath.app (A record, ALIAS type)
ALIAS Target: d-pwdbwa990g.execute-api.us-east-1.amazonaws.com
Target HostedZoneId: Z1UJRXOUMOOFQ8 (correct for us-east-1 REGIONAL API Gateway)
API Gateway Status: AVAILABLE
Endpoint Type: REGIONAL
Certificate: Valid ACM certificate
What We've Tried
✅ Verified all Route53 and API Gateway configurations - ALL CORRECT
✅ Deleted and recreated ALIAS record via Pulumi - ISSUE PERSISTS
✅ Waited 3 days for DNS propagation - ISSUE PERSISTS
✅ Tested multiple global DNS servers - all return stale IP (because they query Route53 nameservers)
✅ Verified no VPC configuration or load balancers involved
✅ This issue persisted even after migrating to new AWS account
Analysis
The stale IP 18.204.152.241 is:
AWS EC2 range: 18.204.0.0/14 (us-east-1)
Old API Gateway infrastructure IP from previous deployment
This appears to be a Route53 internal bug where:
Control plane (Route53 API) knows the correct ALIAS resolution
Data plane (authoritative nameservers) serves stale cached data
There's a sync/cache issue between Route53's control and data planes
Questions
Is this a known Route53 bug with ALIAS records to API Gateway REGIONAL endpoints?
How can we force Route53 authoritative nameservers to refresh their cache for this ALIAS record?
Why does test-dns-answer return different IPs than actual nameserver queries?
Is there a Route53 service limit or quota we might have hit?
Impact
Production deployment blocked
SSL/TLS errors for all clients (certificate doesn't match stale IP)
Cannot use custom domain, only direct API Gateway domain works
Any help from AWS engineers or community members would be greatly appreciated!
I have exactly the same problem with my domain, and it's returning the exact same ip address (18.204.152.241) as you. Clearly this is a pervasive issue with AWS's Route53 service. I never entered that ip address anywhere, so it's not an issue with anything being stale. The issue even persists if I change the record type to CNAME a domain that does in fact return the correct ip address when queried separately. I can see the CNAME update, but the ip address returned never does.