Should dig display the API gateway when I query the custom domain?

Question

I'm still struggling with getting my custom domain name working for my regional REST API, and I'm trying to find where it is broken.

In Route 53 I have a hosted Zone, mysite.com, with 4 records:
* mysite.com, A, d1111111111111.cloudfront.net, Alias:Yes
* mysite.com, NS, ns-1332.awsdns-38.org, ns-623.awsdns-13.net, ns-1606.awsdns-08.co.uk, ns-206.awsdns-25.com, Alias:No
* mysite.com, SOA, ns-1332.awsdns-38.org awsdns-hostm.amazon.com..., Alias:No
* api.mysite.com, A, d-yyyyyyyyyy.execute-api.us-east-1.amazonaws.com, Alias: Yes

If I execute 'dig mysite.com', it returns in the answer section:
mysite.com 600 IN CNAME dd1111111111111.cloudfront.net

Next, if I execute 'dig api.mysite.com', I get in the answer section:
api.mysite.com 600 IN CNAME dd1111111111111.cloudfront.net,
still pointing at my CloudFront distribution, not the API Gateway. Is this expected behavior?

Accepted Answer

Is it possible that your domain hasn't been properly delegated to Route53? If that were the case, another name server somewhere else could be answering queries. Check the SOA record with 
```
dig SOA example.com
```
and verify that an awsdns nameserver is listed in the answer.

Answer

as per the following references

https://docs.aws.amazon.com/apigateway/latest/developerguide/how-to-custom-domains.html

There are two types of custom domain names in API Gateway: Edge-optimized and Regional. When you create a custom domain name for an edge-optimized API, API Gateway sets up an Amazon CloudFront distribution. You must then set up a DNS record to map the custom domain name to the CloudFront distribution domain name. For a Regional API, you need to set up a DNS record to map the custom domain name to the Regional domain name​

For both types of custom domain names, you must provide a certificate. This can be requested from AWS Certificate Manager (ACM) or imported from a third-party certificate authority

In your specific situation, you mentioned that you have an 'A' record in Amazon Route 53 for api.mysite.com that points to d-yyyyyyyyyy.execute-api.us-east-1.amazonaws.com, which I assume is your API Gateway endpoint. However, when you run dig api.mysite.com, the result points to dd1111111111111.cloudfront.net, which is a CloudFront distribution.

If your API Gateway is regional (which is typically the case if the domain name includes execute-api), you would expect the dig api.mysite.com to show the API Gateway URL (d-yyyyyyyyyy.execute-api.us-east-1.amazonaws.com) in the results. If it is showing a CloudFront URL instead, it could be that there is a configuration issue with your DNS records in Route 53 or there is a propagation delay for the changes.

Please verify the following:

Check your Route 53 setup again to ensure that your api.mysite.com record is correctly set to alias your API Gateway endpoint (d-yyyyyyyyyy.execute-api.us-east-1.amazonaws.com), not a CloudFront distribution.
It might take some time for the DNS changes to propagate. Depending on various factors, DNS changes can take up to 48 hours to fully propagate globally.
Confirm that you have correctly set up the custom domain name in the API Gateway console, and it is correctly associated with your API deployment.

Should dig display the API gateway when I query the custom domain?

Relevant content