For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/integrations/amazon-route-53.md. A documentation index is available at /llms.txt.

Amazon Route53

Integration version1.1.0

To find out if this integration is available in your organization, see your Datadog Integrations page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email support@ddog-gov.com.

Route53 graph

Overview

Amazon Route 53 provides DNS and traffic management along with availability and performance monitoring through health checks. You can view the health check information in Datadog to provide context around other metrics and events in your environments. Here’s an example dashboard of Route 53’s health check status graph:

For information about the rest of the AWS services, see the AWS tile

Setup

Installation

If you haven’t already, set up the Amazon Web Services integration first.

Metric collection

  1. In the AWS integration page, ensure that Route53 is enabled under the Metric Collection tab.

  2. Add those permissions to your Datadog IAM policy in order to collect Amazon Route 53 metrics:

    • route53:listHealthChecks: List available health checks.
    • route53:listTagsForResources: Add custom tags on Route53 CloudWatch metrics.

    For more information, see the Route53 policies on the AWS website.

  3. Install the Datadog - Amazon Route53 integration.

Note: To get Amazon Route 53 metrics using CloudWatch, you must choose US East (N. Virginia) as the region. Amazon Route 53 metrics are not available if you select any other region. See Monitoring health check status and getting notifications for more information.

Log collection

Configure Amazon Route 53 to log information about the queries that Route 53 receives, such as the following:

  • The domain or subdomain that was requested
  • The date and time of the request
  • The DNS record type (such as A or AAAA)
  • The Route 53 edge location that responded to the DNS query
  • The DNS response code, such as NoError or ServFail
  • Resolver Query logs for you VPC

Enable Route53 DNS query logging

  1. Go to your Route 53 AWS console and click Hosted zones.
  2. Click the radio button for the hosted zone you want to configure logs for.
  3. Click View Details.
  4. Click Configure query logging.
  5. Select the CloudWatch log group or create a new one to send the logs to. Make sure “route53” is included in the log group name.

Enable Route53 resolver query logging

  1. In the Route 53 settings pane on the left, select Query Logging under Resolver.
  2. Click Configure Query Logging.
  3. Enter a name for your Resolver query.
  4. Select the CloudWatch Logs group you want the Resolver to send the query logs to. Make sure “route53” is included in the log group name.
  5. Add the VPCs that you want to log Resolver queries for.
  6. Optionally, add tags.
  7. Click Configure query logging.

Send logs to Datadog

  1. If you haven’t already, set up the Datadog Forwarder Lambda function in your AWS account.
  2. Once set up, go to the Datadog Forwarder Lambda function. In the Function Overview section, click Add Trigger.
  3. Select the CloudWatch Logs trigger for the Trigger Configuration.
  4. Select the CloudWatch log group that contains your Route53 logs.
  5. Enter a name for the filter.
  6. Click Add to add the trigger to your Lambda.

Go to the Log Explorer to start exploring your logs.

For more information on collecting AWS Services logs, see Send AWS Services Logs with the Datadog Lambda Function.

Data Collected

Metrics

aws.route53.child_health_check_healthy_count
(gauge)
For a calculated health check, the number of health checks that are healthy among the health checks that Amazon Route 53 is monitoring.
Shown as check
aws.route53.connection_time
(gauge)
The average time that it took Amazon Route 53 health checkers to establish a TCP connection with the endpoint.
Shown as millisecond
aws.route53.dnsqueries
(count)
The number of DNS queries that Route53 responds to for all records in a hosted zone.
Shown as query
aws.route53.dnssecinternal_failure
(gauge)
The value is 1 if any object in the hosted zone is in an INTERNAL_FAILURE state, and 0 otherwise.
Shown as unit
aws.route53.dnsseckey_signing_key_age
(gauge)
The time elapsed since the key signing key (KSK) was created, not since it was activated.
Shown as second
aws.route53.dnsseckey_signing_key_max_needing_action_age
(gauge)
The time elapsed since the key signing key (KSK) was set to the ACTION_NEEDED state.
Shown as second
aws.route53.dnsseckey_signing_keys_needing_action
(gauge)
The number of key signing keys (KSKs) in the ACTION_NEEDED state due to an AWS Key Management Service (AWS KMS) failure.
Shown as key
aws.route53.health_check_percentage_healthy
(gauge)
The percentage of Amazon Route 53 health checkers that consider the selected endpoint to be healthy.
Shown as percent
aws.route53.health_check_status
(gauge)
The status of the health check endpoint that CloudWatch is checking. 1 indicates healthy, and 0 indicates unhealthy.
Shown as unit
aws.route53.sslhandshake_time
(gauge)
The average time that it took Amazon Route 53 health checkers to complete the SSL handshake.
Shown as millisecond
aws.route53.time_to_first_byte
(gauge)
The average time that it took Amazon Route 53 health checkers to receive the first byte of the response to an HTTP or HTTPS request.
Shown as millisecond
aws.route53resolver.average_response_time
(gauge)
The average response latency of DNS queries received by the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as microsecond
aws.route53resolver.conntrack_utilization
(gauge)
The connection tracking utilization of the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as percent
aws.route53resolver.endpoint_healthy_enicount
(gauge)
The number of elastic network interfaces in the OPERATIONAL status.
Shown as unit
aws.route53resolver.endpoint_response_time
(gauge)
The response time of DNS queries for the specified domain (Domain) in the specified Region (Region).
Shown as microsecond
aws.route53resolver.endpoint_unhealthy_enicount
(gauge)
The number of elastic network interfaces in the AUTO_RECOVERING status.
Shown as unit
aws.route53resolver.endpoint_unhealthy_enicount.maximum
(gauge)
The maximum number of elastic network interfaces in the AUTO_RECOVERING status.
Shown as unit
aws.route53resolver.firewall_rule_group_query_volume
(count)
The number of DNS Firewall queries that match a firewall rule group (specified by FirewallRuleGroupId).
Shown as query
aws.route53resolver.firewall_rule_group_vpc_query_volume
(count)
The number of DNS Firewall queries from a VPC (specified by VpcId) that match a firewall rule group (specified by FirewallRuleGroupId).
Shown as query
aws.route53resolver.firewall_rule_query_volume
(count)
The number of DNS firewall queries that match a firewall domain list (specified by FirewallDomainListId) within a firewall rule group (specified by FirewallRuleGroupId).
Shown as query
aws.route53resolver.form_error_queries
(count)
The number of FORMERR responses for DNS queries sent to the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as query
aws.route53resolver.inbound_query_volume
(count)
The number of DNS queries forwarded from your network to your VPCs through the endpoint specified by EndpointId.
Shown as query
aws.route53resolver.nx_domain_queries
(count)
The number of NXDOMAIN responses for DNS queries sent to the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as query
aws.route53resolver.outbound_query_aggregate_volume
(count)
The number of DNS queries forwarded from your VPCs to your network through the endpoint that is specified by EndpointId.
Shown as query
aws.route53resolver.outbound_query_volume
(count)
The number of DNS queries forwarded from your VPCs to your network through the endpoint specified by EndpointId.
Shown as query
aws.route53resolver.p90_response_time
(gauge)
The 90th percentile response latency of DNS queries for a Resolver IP (RniId) of an endpoint (EndpointId) or for a target name server IP (TargetNameServerIP) of an outbound endpoint.
Shown as microsecond
aws.route53resolver.refused_queries
(count)
The number of REFUSED responses for DNS queries sent to the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as query
aws.route53resolver.reply_count
(gauge)
The number of DNS replies sent by the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as response
aws.route53resolver.request_queries
(count)
The number of DNS queries sent to the target name server IP (TargetNameServerIP) through the Resolver endpoint (EndpointID).
Shown as query
aws.route53resolver.resolver_endpoint_capacity_status
(gauge)
The capacity status of the Resolver endpoint, where 0 is OK, 1 is Warning, and 2 is Critical. Warning means at least one elastic network interface exceeds 50% capacity utilization. Critical means at least one exceeds 75%.
Shown as unit
aws.route53resolver.resolver_endpoint_capacity_status.maximum
(gauge)
The maximum capacity status of the Resolver endpoint, where 0 is OK, 1 is Warning, and 2 is Critical. Warning means at least one elastic network interface exceeds 50% capacity utilization. Critical means at least one exceeds 75%.
Shown as unit
aws.route53resolver.serv_fail_queries
(count)
The number of SERVFAIL responses for DNS queries sent to the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as query
aws.route53resolver.tcp_request_count
(gauge)
The number of DNS requests received over TCP by the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as request
aws.route53resolver.timeout_count
(gauge)
The number of DNS queries that timed out for the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as timeout
aws.route53resolver.timeout_queries
(count)
The number of DNS queries that timed out for a Resolver IP (RniId) of an endpoint (EndpointId) or at a target name server IP (TargetNameServerIP) of an outbound endpoint.
Shown as query
aws.route53resolver.udp_request_count
(gauge)
The number of DNS requests received over UDP by the Resolver IP (RniId) associated with the Resolver endpoint (EndpointId).
Shown as request
aws.route53resolver.vpc_firewall_query_volume
(count)
The number of DNS Firewall queries from a VPC (specified by VpcId).
Shown as query

Each of the metrics retrieved from AWS are assigned the same tags that appear in the AWS console, including but not limited to host name, security-groups, and more.

Events

The Amazon Route 53 integration does not include any events.

Service Checks

The Amazon Route 53 integration does not include any service checks.

Troubleshooting

Need help? Contact Datadog support.