How to Redirect an Apex Domain on Route 53 (Without the S3 Workaround)

Route 53 rejects CNAME records at the zone apex outright — AWS's own documented answer is to configure an S3 bucket for website redirects and point an Alias A record at it. It works, but it means managing an S3 bucket purely as DNS plumbing. If you're already using a redirect service for www, there's a simpler path: skip the apex workaround entirely and let your registrar or Route 53 forward the bare domain to www, which already has a proper CNAME and HTTPS.

Why Route 53 blocks CNAME at the apex

Same underlying reason as most DNS providers: the apex often needs to hold other record types (MX, TXT) that can't coexist with a CNAME per the DNS specification. Route 53 enforces this strictly — there's no flattening feature like Cloudflare's.

The AWS-documented workaround (if you need the apex to redirect on its own)

Step A — create an S3 bucket configured for website redirects:

aws s3api create-bucket --bucket yourdomain.com --region us-east-1 && \
aws s3api put-bucket-website --bucket yourdomain.com --website-configuration \
  '{"RedirectAllRequestsTo":{"HostName":"www.yourdomain.com","Protocol":"https"}}'

Step B — add an Alias A record pointing at the S3 website endpoint:

aws route53 change-resource-record-sets \
  --hosted-zone-id YOUR_ZONE_ID \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "yourdomain.com",
        "Type": "A",
        "AliasTarget": {
          "HostedZoneId": "Z3AQBSTGFYJSTF",
          "DNSName": "yourdomain.com.s3-website-us-east-1.amazonaws.com",
          "EvaluateTargetHealth": false
        }
      }
    }]
  }'

Z3AQBSTGFYJSTF is AWS's fixed hosted-zone ID for S3 website endpoints in us-east-1 — not your own zone ID. Only replace YOUR_ZONE_ID with your actual hosted zone.

This gets the apex redirecting, but it has real limits: the S3 bucket has no SSL certificate of its own (so the apex hop isn't HTTPS), and it can't do path passthrough — every request lands on the same destination regardless of the original path.

The simpler alternative

Set up www.yourdomain.com with a normal CNAME to your redirect service — full HTTPS, path passthrough, analytics, all of it, on any DNS provider including Route 53. Then handle the apex with whichever forwarding your registrar offers, pointed at www.yourdomain.com (permanent, forward path). This skips the S3 bucket entirely; the apex just needs to get visitors to www, where the real redirect logic — and the valid certificate — actually lives.

Add both yourdomain.com and www.yourdomain.com in your redirect service's dashboard. RedirectIQ automatically groups a matched www/apex pair onto a single plan slot once both exist in your account, so covering both doesn't cost anything extra.

Verifying it worked

Check the result with the free redirect checker — confirm the status code, destination, and certificate are what you expect on both the apex and the www version.

RedirectIQ handles the www side of this with automatic SSL and path passthrough — no S3 bucket to provision or maintain. Start free →