A hosted zone is an administrative container that defines where a DNS provider stores and manages DNS records for a domain or subdomain. It acts as the authoritative source for DNS responses to queries about the location of services, and it is the place where domain administrators control routing, availability, and security behavior on the Internet.
When you register a domain and delegate it to a DNS service, that service creates a hosted zone that holds all the resource records for your domain, such as A, AAAA, CNAME, MX, and TXT records. Without a properly configured hosted zone, browsers, mail servers, and applications cannot reliably locate your services.
What Is a Hosted Zone
| Term | Definition | Related Record Types | Management Scope |
|---|---|---|---|
| Hosted Zone | An authoritative DNS namespace managed by a DNS provider for a domain or subdomain | A, AAAA, CNAME, MX, TXT, NS | Controls which servers answer DNS queries for the zone |
| Delegation | The process by which parent zone nameservers point to the authoritative nameservers for a child zone | NS, SOA | Establishes trust and authority from the root to your zone |
| Resource Record Set | A single DNS record entry with a type, name, TTL, and value | All DNS types depending on purpose | Determines how traffic is directed and secured |
| Authoritative DNS | The source of truth for DNS responses for a specific zone | SOA, NS, records within the zone | Returns answers without relying on cached data |
Key Concepts for Understanding Hosted Zones
Zone Apex and Subdomains
The zone apex is the root of a domain, such as example.com, while subdomains like www or mail are separate records within that zone. Each hosted zone can contain multiple subdomains, and each can have its own set of records and routing policies.
Record Sets and TTL Values
Record sets include the type, name, time to live (TTL), and the response data, such as an IP address. TTL tells recursive resolvers how long they may cache a record, which affects propagation speed and query load on your nameservers.
Failover and Health Checks
Many managed DNS platforms support health checks and failover within a hosted zone. They monitor endpoint availability and automatically adjust routing so traffic avoids unhealthy instances and reaches working endpoints instead.
Traffic Routing Policies
Routing policies such as simple, weighted, latency, geolocation, and multivalue answer allow you to control how queries are distributed. Choosing the right policy helps optimize performance, resilience, and user experience across global locations.
Hosted Zone Management and Operations
Effective hosted zone management involves monitoring records, automating changes, and integrating with infrastructure as code pipelines. Centralized zone management reduces mistakes, ensures consistency, and makes it easier to apply security and compliance rules across domains.
Security features like DNSSEC, query logging, and private zones help protect data integrity and confidentiality. DNSSEC adds digital signatures to records, while query logs provide insight into who is looking up your addresses and when.
Private hosted zones support internal name resolution without exposing records to the public internet. They are commonly used in virtual networks to enable service discovery and application communication that never traverses the public Internet.
Operational best practices include versioning changes, using automation, and regularly auditing access controls. These practices help teams respond quickly to incidents, roll back problematic updates, and maintain reliable and secure DNS infrastructure.
Operational Best Practices for Hosted Zones
- Automate record lifecycle management with infrastructure as code and CI/CD pipelines
- Use DNSSEC to protect against cache poisoning and response tampering
- Segment production, staging, and internal zones to limit blast radius
- Monitor query logs and health checks to detect misconfigurations quickly
- Tag and document records for cost allocation and operational clarity
FAQ
Reader questions
How does a hosted zone differ from a domain registrar?
A domain registrar registers and maintains ownership information for your domain name, while a hosted zone is a DNS service that stores records and answers queries. You can manage DNS at the registrar, but a hosted zone usually offers richer routing, security, and automation features.
Can I use multiple hosted zones for the same domain?
Yes, it is common to use multiple hosted zones for the same domain, such as a public zone for Internet traffic and a private zone for internal resources. This separation improves security, simplifies internal naming, and allows different teams to control different record sets.
What happens to existing records when I switch DNS providers?
Switching DNS providers involves exporting your existing record sets and importing them into the new hosted zone. During the transition, TTL values and delegation changes determine how quickly traffic shifts, and carefully planned cutovers help avoid downtime or misrouted requests.
Do hosted zones affect website loading speed?
The hosted zone itself does not serve content, but the latency, routing policies, and health checks defined within it influence how quickly users reach your endpoints. Optimized records, low TTLs for dynamic targets, and geolocation or latency routing can significantly improve perceived performance.