Route 53 Should Identify Any Expired Domains

Using Console

To remediate the misconfiguration of Route 53 not identifying any expired domains in AWS, you can follow the below steps:

Log in to the AWS Management Console and navigate to the Route 53 service.
Click on the “Registered domains” option in the left-hand menu.
In the list of registered domains, identify the domain that is expired and select it.
Click on the “Renew domain registration” button in the top-right corner of the page.
Follow the on-screen instructions to complete the domain renewal process.
Once the domain is renewed, Route 53 will automatically start identifying it again.

It is important to note that if the domain is not renewed within a certain period of time, it may become permanently unavailable and cannot be renewed. Therefore, it is recommended to set up auto-renewal for domains in Route 53 to avoid such misconfigurations in the future.

Using CLI

To remediate the misconfiguration in AWS Route 53 using AWS CLI, follow these steps:

Open the AWS CLI on your local system or EC2 instance.
Run the following command to list all the hosted zones in your AWS account:

aws route53 list-hosted-zones

Identify the hosted zone that contains the expired domain.
Run the following command to get the details of the expired domain:

aws route53 list-resource-record-sets --hosted-zone-id <hosted-zone-id> --query "ResourceRecordSets[?Name == '<expired-domain-name>']"

Replace <hosted-zone-id> with the ID of the hosted zone that contains the expired domain and <expired-domain-name> with the name of the expired domain.

If the output of the above command returns any records for the expired domain, run the following command to delete those records:

aws route53 change-resource-record-sets --hosted-zone-id <hosted-zone-id> --change-batch '{"Changes":[{"Action":"DELETE","ResourceRecordSet":{"Name":"<expired-domain-name>","Type":"<record-type>","TTL":<ttl>,"ResourceRecords":[{"Value":"<record-value>"}]}}]}'

Replace <hosted-zone-id> with the ID of the hosted zone that contains the expired domain, <expired-domain-name> with the name of the expired domain, <record-type> with the type of record that needs to be deleted (e.g. A, CNAME, MX, etc.), <ttl> with the TTL value of the record, and <record-value> with the value of the record.

Verify that the expired domain records have been deleted by running the following command:

aws route53 list-resource-record-sets --hosted-zone-id <hosted-zone-id> --query "ResourceRecordSets[?Name == '<expired-domain-name>']"

This command should not return any records for the expired domain.By following these steps, you can remediate the misconfiguration in AWS Route 53 and ensure that any expired domains are identified and deleted.

Using Python

To remediate the misconfiguration in AWS Route 53 using Python, follow the below steps:Step 1: Install and configure the AWS CLI on your local machine.Step 2: Create a Python script that uses the boto3 library to interact with AWS Route 53.Step 3: Use the list_hosted_zones() method to get a list of all the hosted zones in your AWS account.Step 4: Loop through the hosted zones and use the list_resource_record_sets() method to get a list of all the resource record sets in each hosted zone.Step 5: Check the Expiration field of each resource record set to see if it is expired.Step 6: If a resource record set is expired, use the change_resource_record_sets() method to delete the record set.Step 7: Save and run the Python script.Here is a sample Python script that you can use as a starting point:

import boto3
import datetime

# Create a Route 53 client
client = boto3.client('route53')

# Get a list of all the hosted zones
response = client.list_hosted_zones()
hosted_zones = response['HostedZones']

# Loop through the hosted zones
for zone in hosted_zones:
    zone_id = zone['Id']
    zone_name = zone['Name']

    # Get a list of all the resource record sets in the zone
    response = client.list_resource_record_sets(HostedZoneId=zone_id)
    record_sets = response['ResourceRecordSets']

    # Loop through the resource record sets
    for record_set in record_sets:
        # Check if the record set is expired
        if 'Expiration' in record_set and record_set['Expiration'] < datetime.datetime.now():
            # Delete the record set
            response = client.change_resource_record_sets(
                HostedZoneId=zone_id,
                ChangeBatch={
                    'Changes': [
                        {
                            'Action': 'DELETE',
                            'ResourceRecordSet': record_set
                        }
                    ]
                }
            )
            print(f"Deleted expired record set {record_set['Name']} in zone {zone_name}")

Note: This script assumes that the Expiration field is already set in the resource record sets. If it is not set, you may need to modify the script to check for other indicators of expiration.

Using Terraform

Terraform cannot renew or restore Route 53 registered domains; the AWS provider does not expose a renew-domain or equivalent operation, so this remediation must be done via CLI or console.To match the verified CLI fix, use the AWS CLI:

# 1. Get current expiration year
aws route53domains get-domain-detail \
  --domain-name YOUR_DOMAIN_NAME

# Note the 4‑digit year in the "ExpirationDate" field, e.g. 2026

# 2. Renew for 1 year (auto‑renewal grace period only)
aws route53domains renew-domain \
  --domain-name YOUR_DOMAIN_NAME \
  --duration-in-years 1 \
  --current-expiry-year 2026

If the status in StatusList is redemptionPeriod, follow the AWS console/docs to restore via the more complex update-domain-contact flow. Renewing or restoring will incur costs billed to your AWS account.

AWS Introduction

AWS Pricing

AWS Threats

AWS Misconfigurations

Route 53 Should Identify Any Expired Domains

More Info:

Risk Level

Address

Compliance Standards

Triage and Remediation

Remediation

Additional Reading:

​More Info:

​Risk Level

​Address

​Compliance Standards

​Triage and Remediation

​Remediation

​

​Additional Reading: