nmspc

Registrars / Amazon Route 53

Track your Amazon Route 53 domains.
nmspc reads your Route 53 domains and hosted zones with an IAM access key and reminds you before anything expires. It never changes them.

nmspc reads your domains through the Route 53 Domains API: when each one expires, whether auto-renew is on, its status codes and nameservers, and the DNS records of your Route 53 hosted zones. nmspc lists what it finds and you choose which domains to track; nothing is added by itself. On Free it syncs when you press Sync now, on Pro every day.

Connect Amazon Route 53

Steps

  1. Sign in to the AWS console as someone who may manage IAM, open IAM › Users and choose Create user. Name it nmspc and don't give it console access.
  2. On Set permissions, attach only the two AWS managed policies AmazonRoute53DomainsReadOnlyAccess and AmazonRoute53ReadOnlyAccess, then create the user. Give it nothing else.
  3. Open the user, go to Security credentials › Access keys and choose Create access key. Pick Other as the use case and copy the access key ID and the secret access key; AWS shows the secret only once.
  4. Paste both below. Don't use your root user's keys: nmspc refuses them. nmspc only reads, and stores the key encrypted.

Where to create the access key at Amazon Route 53 ↗

What nmspc reads

  • The domains registered in your AWS account.
  • Each domain's expiry and registration dates, auto-renew setting, status codes and nameservers.
  • Your public hosted zones, and the DNS records of domains that use Route 53's name servers.

What nmspc never does

  • Renew, transfer, register or delete a domain.
  • Change DNS records, nameservers, contacts or auto-renew.
  • Buy anything or touch your payment details.

Can the access key change your account?

nmspc can't check what an Amazon Route 53 access key is allowed to do, so treat it as one that can change your Amazon Route 53 account. nmspc only ever reads with it.

Before nmspc stores it, the workspace owner ticks “I allow nmspc to store an access key that can change my Amazon Route 53 account”.

If it doesn't connect

  • AWS didn't accept the access key. Paste the access key ID (it starts with AKIA) and the secret access key of an active key for an IAM user. Temporary keys (starting with ASIA) and keys that were deactivated or deleted don't work.
  • That key belongs to your AWS account's root user, which can do everything in the account. Create an IAM user with only the AWS managed policies AmazonRoute53DomainsReadOnlyAccess and AmazonRoute53ReadOnlyAccess and use its key instead.
  • AWS refused to list your Route 53 domains. Check that the IAM user has the AmazonRoute53DomainsReadOnlyAccess policy attached, and AmazonRoute53ReadOnlyAccess for DNS records, and that no other policy or service control policy denies them.
Connect Amazon Route 53

About Amazon Route 53

Website
aws.amazon.com/route53
API docs
docs.aws.amazon.com/Route53/latest/APIReference/API_Operations_Amazon_Route_53_Domains.html
IANA registrar ID
468 (Amazon Registrar, Inc.). Route 53 registers some endings through its registrar associate Gandi instead.
RDAP base URL
https://rdap.registrar.amazon.com/rdap/
API sign-in
An IAM user's access key, with the AWS managed policies AmazonRoute53DomainsReadOnlyAccess and AmazonRoute53ReadOnlyAccess.
Domain quota
20 registered domains per AWS account by default (50 for accounts that already had 50); a higher quota can be requested.

Try it free

Check any domain now, no account needed: when it expires and who it's registered with.

Certificate checkDomain health reportTakeover check

More Amazon Route 53 domains than projects? You're among friends. The Domain Support Group has a chair for you.

Moving a domain away from Amazon Route 53

  1. In the Route 53 console, open Registered domains and choose the domain. It can't move while its status is pendingDelete, pendingTransfer, redemptionPeriod, clientTransferProhibited or serverTransferProhibited, or within 14 days of registration.
  2. If Transfer lock is On, choose Turn off transfer lock from the Actions menu.
  3. From the Transfer out menu, choose Transfer to another registrar and copy the authorization code for the new registrar. .uk domains change their IPS tag instead; .be, .ru and .co.za have their own steps.
  4. If you keep Route 53 for DNS, give the new registrar your hosted zone's four name servers. Route 53 emails the registrant contact to approve or reject the transfer; without an answer it goes ahead on the date given.

How do I create an AWS access key for nmspc?

In the IAM console, create a user called nmspc without console access and attach only the AWS managed policies AmazonRoute53DomainsReadOnlyAccess and AmazonRoute53ReadOnlyAccess. Then open the user's Security credentials tab and choose Create access key.

Copy the access key ID and the secret access key: AWS shows the secret only once. Don't use your root user's keys; nmspc refuses them.

Can the AWS key change my account?

nmspc can't check what an Amazon Route 53 access key is allowed to do, so treat it as one that can change your Amazon Route 53 account. nmspc only ever reads with it.

AWS describes those two managed policies as giving read access to Route 53, but nmspc can't read an IAM user's policies without asking for more access, so the owner of the nmspc workspace ticks a box to allow storing it. The key is stored encrypted and only used for reading.

Why is the API in us-east-1?

Route 53 Domains only answers in the US East (N. Virginia) Region, wherever your other AWS resources are. nmspc signs its requests for that Region; there is nothing to choose.

How do I turn auto-renew on or off in Route 53?

Open Registered domains, choose the domain and use Turn on auto-renew or Turn off auto-renew in the Actions menu. Route 53 turns auto-renew on for every domain you register or transfer in, and with it on renews 35 days before the expiry date (30 for .com.ar and .com.br).

nmspc shows the new setting after its next sync.

Does Route 53 send renewal reminders?

Route 53 emails the registrant contact 45 days before a domain expires, whether auto-renew is on or off. With auto-renew off, the registrar also emails 30 and 7 days before, as ICANN requires; with it on, you get an email when the renewal went through or failed.

nmspc adds its own reminders 60, 30, 14, 7, 1 days before.

Why doesn't nmspc show DNS records for some of my Route 53 domains?

nmspc reads records only for domains whose nameservers are Route 53's, from the one public hosted zone with the same name. A domain pointed at another DNS provider, or with several public hosted zones of the same name, still gets expiry and auto-renew from Route 53.

Does nmspc renew my Amazon Route 53 domains?

No. nmspc never renews, transfers or changes a domain. It reads your Amazon Route 53 domains and reminds you 60, 30, 14, 7, 1 days before each one expires, by push notification on any plan and by email on Pro. Renewing stays with Amazon Route 53.

Sources

Checked against these pages on 28 October 2026. Amazon Route 53 changes its pages now and then; the source wins if it disagrees.

nmspc is independent and not affiliated with Amazon Route 53.