Teach the internet
where to ask.

Keep the live domain out of the exercise

DNS is the address book. Your registrar records who registered the domain. The authoritative DNS provider keeps the address-book entries. Your web host serves the actual page. They can be three different companies.

Namecheap being your registrar does not prove Namecheap currently hosts your DNS. Check the domain's NS records first. If Cloudflare is authoritative, the parent records are managed there. A Cloudflare Pages site and a DNS zone are different things.

For hands-on creation, you need an unused lab.YOUR-OWNED-DOMAIN, permission to manage that child name at the current parent DNS provider, and an authorized AWS deployment session. Do not use GuidewellCloud's live apex, www, email records, Pages custom-domain verification records, or a child name already used by someone else. example.com below is a placeholder, not a domain you own.

No web server, certificate, A record, health check, resolver endpoint or domain registration is created by this recipe. It publishes only a test TXT record. DNS does not require opening a VM firewall.

1. Inspect first—change nothing

Resolve-DnsName -Name example.com -Type NS
Resolve-DnsName -Name example.com -Type MX
Resolve-DnsName -Name www.example.com -Type CNAME

dig NS example.com
dig MX example.com
dig CNAME www.example.com

Record the current authoritative provider privately. A CNAME lookup can return no CNAME because the name uses an A/AAAA record or provider flattening; absence alone is not a website failure. Resolver caches can preserve older answers.

2. Know which job each record does

Route 53 record typesAWS subdomain routing

3. Create only the lab child zone with Terraform

Use Ubuntu/WSL and the AWS CLI/Terraform setup from the AWS server guide. Sign into the intended account and inspect aws sts get-caller-identity. Use a new local folder/state for DNS; never put the live site's state or credentials into this website.

Download these examples and create terraform.tfvars privately with your unused lab child name:

lab_zone_name = "lab.YOUR-OWNED-DOMAIN"

The validation guards the lab prefix; it cannot verify domain ownership or whether the child name is unused. Check those yourself. This public zone is not associated with a VPC. Parent delegation is deliberately NOT automated by this recipe.

terraform init
terraform fmt
terraform validate
terraform plan -out=dns.tfplan
# Expect one new public hosted zone and one TXT record only.
# Apply only after reviewing ownership, scope and cost.
terraform apply dns.tfplan
terraform output lab_name_servers
terraform output proof_name

Stop if the plan touches existing records or any unrelated resource. Save the four nameservers from this exact zone, not nameservers copied from another tutorial. Duplicate same-name zones can have different nameservers and still incur charges.

Terraform Route 53 zoneTerraform Route 53 record

4. Delegate only the unused lab child

First query the test record directly against one new Route 53 nameserver, as in the next section. Only then decide whether you need public recursive resolution. Direct authoritative testing works without changing the parent.

Optional: at the current authoritative provider for your parent domain, add an NS delegation for only the lab child, with all four returned Route 53 nameservers. Keep the existing parent/apex NS, SOA, mail, www and website records unchanged.

• Cloudflare authoritative parent: use DNS → Records, add NS records named lab, one per returned nameserver. Follow Cloudflare's subdomain-delegation instructions; these are delegation records, not proxied web records.
• Another authoritative provider: use that provider's child-delegation workflow. A registrar's “Custom DNS / nameservers” setting normally changes the entire domain—do not use it for this child exercise.
• Conflicts: if lab already has a CNAME, delegation, records below it, or any dependent application, stop and choose a different dedicated learning name. Do not delete existing data to make this lab fit.
• DNSSEC: this beginner child zone does not enable signing. Do not create a DS record for it. A stale/incompatible DS at an existing child delegation requires a proper DNSSEC migration, not this exercise.

Record exactly which parent delegation records you added, their previous state and their TTL for cleanup. Do not change the domain's registration contact details or registrar nameservers.

5. Verify authoritative and recursive answers separately

Replace the proof name and server with your actual Terraform outputs:

Resolve-DnsName -Name proof.lab.example.com -Type TXT -Server YOUR-ROUTE53-NAMESERVER -DnsOnly
# Only after optional parent delegation:
Resolve-DnsName -Name lab.example.com -Type NS
Resolve-DnsName -Name proof.lab.example.com -Type TXT

dig @YOUR-ROUTE53-NAMESERVER proof.lab.example.com TXT
# Expect NOERROR, the marker answer and the authoritative aa flag.
# Only after optional parent delegation:
dig NS lab.example.com
dig TXT proof.lab.example.com

A direct authoritative answer proves that nameserver has the record. A recursive answer through your usual resolver proves that resolver can follow the delegation, subject to its cache. Check the response status, server and exact marker, not just whether a command returned text.

6. Change only the marker

Change the TXT value in main.tf from contoso-dns-baseline to contoso-dns-updated, keeping its quoted TXT representation. Create a fresh reviewed plan:

terraform fmt
terraform validate
terraform plan -out=dns-update.tfplan
# Expect an update to only the marker record.
terraform apply dns-update.tfplan

Retest authoritative first, recursive second. TTL 300 applies to this TXT answer, not every NS or negative cache. Do not repeatedly create zones because an old answer remains cached. Ansible is useful for host configuration; Terraform owns these DNS records so two tools do not compete over the same desired state.

7. Remove delegation before deleting the zone

1. If you delegated the child, remove only the exact parent NS records added for this lab. Check no child DS record or application depends on it.
2. Allow previously cached delegations to age out using their recorded TTL before deleting the child zone. Do not assume the TXT TTL is the delegation TTL. Keep the zone under your control during that interval.
3. Confirm the folder/state and intended AWS account. Review a destroy plan containing only this TXT record and dedicated child zone.
4. Apply the reviewed destroy plan, verify the zone is gone, and check costs after reporting catches up. A partially used month's zone charge may remain.

terraform plan -destroy -out=dns-destroy.tfplan
terraform apply dns-destroy.tfplan

force_destroy = false avoids blindly removing records added outside this recipe. If deletion fails because someone added other records, investigate ownership rather than enabling force deletion. Never leave a parent delegation pointing to a zone you no longer control.