Colin Percival mounted my hosted zone over NFS. Every record is a file. echo creates one, sed edits it, and rm does exactly what you're afraid it does, to the authoritative name servers, in about 72 seconds. I've been making this joke for years. Somebody finally shipped it.
Free. You pay only for the S3 Files, EventBridge, and NFS bits it creates in your account, which means the bill is technically your fault. Some things never change.
Trusted by folks who edit DNS at 3 a.m. and regret it by 3:02
I measured every number on this page myself, on a real delegated zone, from an EC2 instance, with dig, against Route 53's own name servers. I did not round in Colin's favor. I didn't have to.
tee'd into a file and answered by 8.8.8.8 before I'd finished typing the dig to check.rm -r'd my MX records and mail stopped arriving on schedule. Nobody has ever said that about Route 53 before.sed -iname/TYPE is a record. @ is the apex, because some traditions are load-bearing. One value per line, so round-robin is tee -a. TTLs live in a sibling file, which makes this the first TTL interface I've used that didn't involve a form.
$ echo 1.2.3.4 | sudo tee @/A $ echo 60 | sudo tee @/A.TTL
ls -l shows you where it points, readlink tells you the truth, and cross-zone aliases dangle, as they should. Get the syntax wrong and an .A.error file turns up six minutes later to explain what you did, which is more than the API has ever done for me.
$ ln -s Z2FDTNDATAQYW2/d1234.cloudfront.net. cdn/A
rm -rf attempts to delete every DNS record you have. What else would it do? Route 53 won't let you remove the SOA or the apex NS, so those two silently reappear in the directory like the last two guests at a party who didn't take the hint.
$ sudo rm -r mail # 90 seconds $ dig +short MX mail.example.com $
Anything that can write a file can publish DNS. Log rotation. A Makefile. An AI agent with file tools and the confidence of a golden retriever. Colin's demo has a cron job writing date into a TXT record every five minutes, and it works, and I hate that it works.
*/5 * * * * root date > /mnt/r53fs/example.com/now/TXT
*Route 53 has no modification timestamps, which is a hell of a thing for a database. So when the file and the console disagree, Colin makes an educated guess from when the file changed and the window the record moved in. It's usually right. So is my toddler.
You generate every IAM role in your browser with the network unplugged. Ten policy documents, an external id on every cross-account trust, and the only role that can delete anything hides behind its own flag. I've read a lot of launch-day IAM. This is tighter than most of what AWS ships. Don't tell them I said that.
Under the hood it's S3 Files. Your writes fire S3 events into an EventBridge bus, Colin's reconciler assumes a role in your account, and it calls Route 53 like a normal person. The other direction polls, because Route 53 emits no events (it's a database, just not a good one) and CloudTrail turned out to be slower than a five-minute loop that costs a nickel a month.
In your browser, offline. A tarball with ten JSON documents and a shell script. Read them. They're the entire ask.
./create-roles.sh makes four roles. The fifth, the only one that can delete anything, hides behind --deprovisioning for the day you leave.
One POST. A bucket and a file system appear in your account. Records land in 15–20 minutes. Get coffee. Get two.
aws s3files create-mount-target, open TCP/2049, wait five minutes. If it says "Failed to resolve," wait ten more or turn off Tailscale. Ask me how I know.
mount -t s3files. Your DNS is a directory. Whatever happens next is between you, bash, and your incident commander.
For side projects and people who have never been paged.
For on-call engineers reverting each other's changes with sed at 3 a.m.
.error files instead of stack tracesStill free, but Colin will take the call so procurement can feel something.
You pay for the S3 Files file system, bucket, mount target ENI, and EventBridge rule created inside your own AWS account. Since Route 53's control plane lives entirely in us-east-1, a us-east-1 outage means your files stop updating DNS. They'll remain perfectly readable, the way a photograph of a loved one is.
"This insane thing is miles better than the actual Route 53 API, which is an embarrassment to databases everywhere. I wrote a record with echo, it was live in 72 seconds, and at no point did anyone make me construct a ChangeBatch."
"I ran sed -i against the apex and dug it every three seconds waiting for the outage. It never came. I've been in this industry far too long to find that reassuring."
"We replaced our GitOps DNS pipeline with a Makefile and a mount. Change review isgit diff. Rollback isgit checkout. Postmortems arels -la --time-style=full-iso."
God, no. It's Colin Percival's. Colin says he'd happily let them have it if they're crazy enough to want to maintain it. Nobody at Amazon knew. If they had, they'd have been obligated to try to stop him, and he likes his friends there too much to put them in that spot.
rm -rf on the mount?It attempts to delete all of your DNS records. I keep saying this and people keep looking surprised. Route 53 refuses to delete the SOA and apex NS, so those two reappear. Everything else is gone in about 90 seconds. There's a toggle in the top right if you'd like to feel it without paying for it.
Colin's answer: because it's funnier. Also because that's what S3 Files does, which is the same answer wearing a badge.
A 100% refund of fees paid in any month where availability drops below 110%. Fees are zero. The SLA is undefeated and mathematically unbeatable, which puts it ahead of most SLAs I've been asked to read.
Please do not store patient information in DNS. I can't believe this needs a FAQ entry. I absolutely believe this needs a FAQ entry.
A symlink can't express EvaluateTargetHealth. If your alias has it set (the console flips it on for plenty of targets), you get a .r53fs-unsupported file saying so instead. It's a dotfile, so you'll find it on your second ls, after the panic.
Colin aims for last-write-wins. That isn't strictly possible when the database on the other end has no timestamps, so sometimes it's an educated guess. He'd like to stress "educated." I'd like to stress "guess."
S3 Files launched in early April and Colin wasn't about to sit on this until April 2027. Neither would I.
Create the one role that can delete things, POST once, and the bucket, file system, and event rule are gone in under two minutes. Your DNS is untouched: this thing only ever mirrored it. Unmount first, or discover what hard means as an NFS option the way I very nearly did.
This page is a shitpost. The software isn't. Route 53 Files is a real, working, unofficial project by Colin Percival, announced on his blog, with the real onboarding page at daemonology.net/r53fs. It is not an AWS product, AWS had nothing to do with it, and Amazon and AWS show up here only as commentary on things they've publicly shipped. Every number on this page is one I measured. Every joke about deleting production describes something this tool will do if you ask it to.
If you enrol a production zone: read all ten IAM documents before you run the script, mount read-only until you trust your own shell history, never point an autonomous agent at it, and keep the external id somewhere you'll find it, because nobody can recover it for you. "Last-write-wins" is a best effort against an API with no timestamps, so keep a second source of truth for any record you can't afford to lose.
The customers above are me, me again, and one person I made up. The pricing is accurate because there isn't any. None of this is legal, security, or DNS advice, and if you run rm -rf on your hosted zone, the outcome is between you and your SOA record.
This link goes nowhere, on purpose. The real onboarding page generates IAM roles in your browser, and you should not arrive there by clicking through a shitpost. Run this in your head first:
$ sudo rm -rf /mnt/r53fs/production.example.com $ dig +short A production.example.com $
If your stomach dropped, good. That instinct is the access control. Go read Colin's post, read all ten policy documents, and start with a zone nobody will miss.