blog post error? Route 53 PHZ migration to GovCloud

Question

Hi all

I'm following the instructions in https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-amazon-route-53-authoritative-dns-service-for-public-hosted-zones-in-aws-govcloud-us-regions/ to migrate my Route 53 PHZ from commercial account to GovCloud account.

In Step 5 of the instructions, I'm directed to "updating the public key" as follows:

![Enter image description here](/media/postImages/original/IMxyNWzxyzSdGqINoKhyt9fg)

However, I've found that the "Registered domains" menu, which is necessary to complete this step, does not appear in the GovCloud navigation pane; it seems to be exclusive to commercial accounts.

![Enter image description here](/media/postImages/original/IMB_GRjwCoQjiZKPJGeckhWQ)

How can I resolve that? Or how can I reach out to the authors?

Thanks.

AWS-Rakesh · Accepted Answer

@Sonic, to update the DS record in the TLD for a domain registered with Amazon Route 53 has to be done in AWS Standard account for commercial regions. *This steps remains the same because Domain Registration is currently available only through AWS Standard accounts*.

To elaborate, follow step 3 in this [configuring DNSSEC blog](https://aws.amazon.com/blogs/networking-and-content-delivery/configuring-dnssec-signing-and-validation-with-amazon-route-53/) if you haven't enabled your hosted zone already for DNSSEC in the AWS GovCloud (US) region. After completing this step, retrieve the Public key information from your AWS GovCloud (US) hosted zone. The final step requires switching to your AWS Standard account to access the Registered Domains section. The [configuring DNSSEC blog](https://aws.amazon.com/blogs/networking-and-content-delivery/configuring-dnssec-signing-and-validation-with-amazon-route-53/) provides detailed guidance on this process in the "Establishing chain of trust" section.

Note that this action is necessary only for the parent domain (example.com). For subdomains (like, service.example.com), create a DS record within your new hosted zone for the parent domain in the AWS GovCloud (US) region.

re:Post Agent · Answer

You're correct that the "Registered domains" menu is not available in AWS GovCloud. This is because domain registration services are not supported in GovCloud regions.

To properly set up DNS for a domain that will be used with GovCloud resources, you need to:

1. Register and manage your domain in a standard AWS commercial account
2. Create a public hosted zone in your GovCloud account with the same domain name
3. Update the name servers at your domain registrar (in the commercial account) to point to the name servers provided by the GovCloud hosted zone

This creates a delegation where the domain registration remains in the commercial account, but the DNS authority (hosted zone) is managed from GovCloud.

For DNSSEC configuration, you would need to:
1. Enable DNSSEC signing in your GovCloud public hosted zone
2. Get the DS record information from GovCloud
3. Add this DS record to your domain in the commercial account to establish the chain of trust

Since the blog post appears to have some instructions that don't align with the actual GovCloud console interface, I'd recommend reaching out to AWS Support or posting a question on AWS re:Post to get clarification from AWS directly or potentially reach the blog authors.  
**Sources**  
[How can I purchase a domain and configure DNSSEC in AWS GovCloud? | AWS re:Post](https://repost.aws/questions/QUqmEk7NL2R5-ZnnsXPwGsnQ/how-can-i-purchase-a-domain-and-configure-dnssec-in-aws-govcloud)

blog post error? Route 53 PHZ migration to GovCloud

Add your answer

Relevant content