Home / AWS / Fix AWS EKS ExternalDNS Not Updating Route53

AWS

Fix AWS EKS ExternalDNS Not Updating Route53

Resolve ExternalDNS Route53 update issues by checking IAM permissions, service account annotations, and DNS record configurations.

Published: Apr 2, 20266 min readBy FixWikiHub Editorial Team

Abstract illustration for a troubleshooting knowledge base category.

Introduction

ExternalDNS automatically creates DNS records in Route53 for Kubernetes Ingress and Service resources. When it stops updating, new services don't get DNS entries, and removed services leave stale DNS records pointing to non-existent endpoints.

Symptoms

DNS records not created:

```bash $ kubectl get ingress my-ingress

NAME CLASS HOSTS ADDRESS PORTS AGE my-ingress alb * 80 10m

$ dig my-app.example.com

;; ANSWER SECTION: # No record or old IP ```

ExternalDNS logs showing errors:

```bash $ kubectl logs -n external-dns deployment/external-dns

E0115 10:00:00.000000 controller.go:123] failed to create records: AccessDenied: User is not authorized ```

Service annotations ignored:

```bash $ kubectl get svc my-service -o yaml | grep external-dns

# Annotations present but no DNS record created ```

Common Causes

1.IAM permissions missing - Can't access Route53
2.Service account not annotated - IRSA not configured
3.Hosted zone not found - Zone ID incorrect or not accessible
4.Annotation format wrong - Incorrect annotation syntax
5.Domain filter mismatch - Domain doesn't match hosted zone
6.RBAC issues - Service account can't watch resources
7.ExternalDNS not running - Deployment issues

Step-by-Step Fix

1.Check logs for specific error messages
2.Verify configuration settings
3.Test network connectivity
4.Review recent changes
5.Apply corrective action
6.Verify the fix

Step 1: Check ExternalDNS Pod Status

```bash # Check if ExternalDNS is running kubectl get pods -n external-dns

# Check logs kubectl logs -n external-dns deployment/external-dns --tail=100

# Look for errors: # - AccessDenied: IAM permissions issue # - NoSuchHostedZone: Zone not found # - InvalidChangeBatch: DNS record format issue ```

Step 2: Verify IAM Permissions

```bash # Get service account annotation kubectl get sa external-dns -n external-dns -o yaml | grep eks.amazonaws.com/role-arn

# Check role policy aws iam get-role-policy --role-name ExternalDNSRole --policy-name Route53Access

# Required permissions for Route53: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "route53:ChangeResourceRecordSets", "route53:ListResourceRecordSets" ], "Resource": "arn:aws:route53:::hostedzone/HOSTED_ZONE_ID" }, { "Effect": "Allow", "Action": [ "route53:ListHostedZones" ], "Resource": "*" } ] } ```

Add missing permissions:

bash

aws iam put-role-policy \
  --role-name ExternalDNSRole \
  --policy-name Route53Access \
  --policy-document file://route53-policy.json

Step 3: Check OIDC Provider

```bash # Verify OIDC provider exists aws iam list-open-id-connect-providers \ --query 'OpenIDConnectProviderList[*].Arn'

# Get cluster OIDC issuer aws eks describe-cluster --name my-cluster \ --query 'cluster.identity.oidc.issuer'

# Verify trust policy matches aws iam get-role --role-name ExternalDNSRole \ --query 'Role.AssumeRolePolicyDocument' ```

Step 4: Verify Hosted Zone Access

```bash # List hosted zones aws route53 list-hosted-zones \ --query 'HostedZones[*].[Id,Name]'

# Get specific zone aws route53 get-hosted-zone --id Z1234567890ABC

# Check if zone matches domain filter # In ExternalDNS args: --domain-filter=example.com ```

Step 5: Check Service/Ingress Annotations

```bash # For Service type LoadBalancer kubectl get svc my-service -o yaml

# Required annotations: annotations: external-dns.alpha.kubernetes.io/hostname: my-app.example.com

# For Ingress kubectl get ingress my-ingress -o yaml

# Host in spec.rules automatically creates DNS spec: rules: - host: my-app.example.com http: paths: ... ```

Step 6: Verify ExternalDNS Configuration

```bash # Check ExternalDNS deployment args kubectl get deployment external-dns -n external-dns -o yaml | grep args -A 20

# Key arguments: # --source=service,ingress # --domain-filter=example.com # --provider=aws # --policy=upsert-only # or sync (deletes records) # --registry=txt # --txt-owner-id=my-cluster ```

Step 7: Test DNS Record Creation

```bash # Create test service with annotation kubectl apply -f - <<EOF apiVersion: v1 kind: Service metadata: name: test-service annotations: external-dns.alpha.kubernetes.io/hostname: test.example.com spec: type: LoadBalancer ports: - port: 80 targetPort: 80 selector: app: test EOF

# Watch ExternalDNS logs kubectl logs -f -n external-dns deployment/external-dns

# Check Route53 aws route53 list-resource-record-sets \ --hosted-zone-id Z1234567890ABC \ --query 'ResourceRecordSets[?Name==test.example.com.]' ```

Step 8: Debug RBAC Issues

```bash # Check ClusterRole kubectl get clusterrole external-dns -o yaml

# Required permissions: rules: - apiGroups: [""] resources: ["services", "pods", "nodes", "endpoints"] verbs: ["get", "list", "watch"] - apiGroups: ["extensions", "networking.k8s.io"] resources: ["ingresses"] verbs: ["get", "list", "watch"]

# Check ClusterRoleBinding kubectl get clusterrolebinding external-dns -o yaml

# Should bind to correct service account subjects: - kind: ServiceAccount name: external-dns namespace: external-dns ```

Step 9: Check for Record Conflicts

bash # ExternalDNS uses TXT records for ownership # Check for existing TXT records aws route53 list-resource-record-sets \ --hosted-zone-id Z1234567890ABC \ --query 'ResourceRecordSets[?Type==TXT`]'

# If ownership conflict, update txt-owner-id kubectl set env deployment/external-dns -n external-dns \ TXT_OWNER_ID=my-cluster-name ```

Step 10: Enable Debug Logging

```bash # Increase log level kubectl set env deployment/external-dns -n external-dns \ LOG_LEVEL=debug

# Watch logs for detailed information kubectl logs -f -n external-dns deployment/external-dns

# Look for: # - "Creating records" messages # - API calls to Route53 # - Error responses from AWS ```

ExternalDNS Common Arguments

Argument	Purpose	Example
--source	Resource types to watch	service,ingress
--provider	DNS provider	aws,google,cloudflare
--domain-filter	Limit to domains	example.com
--policy	Sync behavior	upsert-only, sync
--registry	Ownership tracking	txt
--txt-owner-id	Owner identifier	my-cluster
--aws-zone-type	Zone visibility	public,private

Verification

bash # Check DNS record created aws route53 list-resource-record-sets \ --hosted-zone-id Z1234567890ABC \ --query 'ResourceRecordSets[?contains(Name,my-app`)]'

# Test DNS resolution dig my-app.example.com

# Should return the LoadBalancer IP

# Check ExternalDNS logs for success kubectl logs -n external-dns deployment/external-dns | grep -i "created" ```

[Fix AWS EKS Load Balancer Controller Failed](/articles/fix-aws-eks-load-balancer-controller-failed)
[Fix AWS EKS IAM Role for Service Account](/articles/fix-aws-eks-iam-role-for-service-account)
[Fix DNS Resolution Failure](/articles/fix-dns-resolution-failure)

[AWS troubleshooting: Fix IAM Permission Denied - Complete Tro](fix-iam-permission-denied)
[AWS cloud troubleshooting: AWS ACM Certificate Pending Validation Because the](aws-acm-certificate-pending-validation-wrong-route53-zone)
[AWS cloud troubleshooting: AWS ALB Returns 502 Because the Target Closed the ](aws-alb-502-target-closed-connection-keepalive-timeout-mismatch)
[AWS cloud troubleshooting: Fix AWS ALB CreateListener TargetGroupNotFound Err](aws-alb-createlistener-targetgroupnotfound)
[AWS cloud troubleshooting: Fix Aws Alb Lambda 502 Bad Gateway Issue in AWS](aws-alb-lambda-502-bad-gateway)

Was this guide helpful?

Related search paths

People also search for

If the symptom is close but not identical, these search paths usually surface the right neighboring fixes faster than scrolling the full archive.

AWS EKS ExternalDNS Not Updating Route53 AWS EKS ExternalDNS Not Updating Route53 AWS AWS EKS ExternalDNS Not Updating Route53 troubleshooting AWS EKS ExternalDNS Not Updating Route53 fix Resolve ExternalDNS Route53 update issues by checking IAM permissions, service account annotations, and DNS record configurations AWS Resolve ExternalDNS Route53 update issues by checking IAM permissions, service account annotations, and DNS record configurations

Explore Related Topics

Browse Guides from Other Categories

Discover troubleshooting guides from related categories to expand your knowledge.

FAQ

AWS Troubleshooting FAQs

Common questions about troubleshooting and preventing similar issues

How do I know if this aws-errors troubleshooting guide applies to my situation?

This guide is designed for aws-errors issues. If you're experiencing similar symptoms described in the article, follow the step-by-step instructions. Start with the most common causes and work through the diagnostic process.

Is it safe to follow these aws-errors troubleshooting steps?

Yes, all steps are designed to be safe and non-destructive. We recommend creating backups before making significant changes and testing each step before proceeding to the next.

How long does it typically take to resolve this type of aws-errors issue?

Most aws-errors issues can be resolved within 30 minutes to 2 hours, depending on the complexity and root cause. Follow the troubleshooting flow to identify and fix the problem efficiently.

How can I prevent this aws-errors issue from happening again?

Regular maintenance, monitoring, and following best practices for aws-errors configuration can help prevent recurrence. Consider implementing automated checks and alerts for early detection.

Written by

FixWikiHub Editorial Team

Our editorial team consists of experienced DevOps engineers, systems administrators, and cloud architects with hands-on experience in production environments across AWS, Azure, GCP, and on-premises infrastructure.

Every guide undergoes technical review for accuracy and is updated when software versions, commands, or best practices change.

Last updated: Apr 2, 2026

About our team

Important Notice

Disclaimer & Safety Guidelines

The troubleshooting steps in this guide are provided for educational and informational purposes. Before applying any changes to production systems:

Test in a staging environment first — Always verify commands and configurations in a non-production environment before deploying to live systems.
Create backups — Ensure you have current backups of databases, configurations, and critical files before making changes.
Understand the impact — Review how each step may affect your specific environment, dependencies, and users.
Consult official documentation — This guide supplements, but does not replace, official vendor documentation and best practices.

FixWikiHub is not responsible for any damages arising from the use of this content. See our Terms of Use for more information.

Resources

Official Documentation & Further Reading

For authoritative information, consult the official documentation for the technologies discussed in this guide. Our troubleshooting content supplements, but does not replace, vendor documentation.

AWS Documentation — Official Amazon Web Services guides and API references
Kubernetes Documentation — Official Kubernetes documentation
Nginx Documentation — Official Nginx web server documentation
Apache Documentation — Official Apache HTTP Server documentation
Docker Documentation — Official Docker container documentation

Fix AWS EKS ExternalDNS Not Updating Route53

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check ExternalDNS Pod Status

Step 2: Verify IAM Permissions

Step 3: Check OIDC Provider

Step 4: Verify Hosted Zone Access

Step 5: Check Service/Ingress Annotations

Step 6: Verify ExternalDNS Configuration

Step 7: Test DNS Record Creation

Step 8: Debug RBAC Issues

Step 9: Check for Record Conflicts

Step 10: Enable Debug Logging

ExternalDNS Common Arguments

Verification

People also search for

Browse Guides from Other Categories

WordPress

SSL

DNS

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading

Fix AWS EKS ExternalDNS Not Updating Route53

Introduction

Symptoms

Common Causes

Step-by-Step Fix

Step 1: Check ExternalDNS Pod Status

Step 2: Verify IAM Permissions

Step 3: Check OIDC Provider

Step 4: Verify Hosted Zone Access

Step 5: Check Service/Ingress Annotations

Step 6: Verify ExternalDNS Configuration

Step 7: Test DNS Record Creation

Step 8: Debug RBAC Issues

Step 9: Check for Record Conflicts

Step 10: Enable Debug Logging

ExternalDNS Common Arguments

Verification

Related Issues

Related Articles

People also search for

Share this guide

More AWS Troubleshooting Guides

Browse Guides from Other Categories

AWS Troubleshooting FAQs

FixWikiHub Editorial Team

Disclaimer & Safety Guidelines

Official Documentation & Further Reading