Find Unused Route 53 Hosted Zones

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListZonesAndQueryMetrics",
      "Effect": "Allow",
      "Action": ["route53:ListHostedZones", "cloudwatch:GetMetricData"],
      "Resource": "*"
    },
    {
      "Sid": "ReadZoneNameServers",
      "Effect": "Allow",
      "Action": "route53:GetHostedZone",
      "Resource": "arn:aws:route53:::hostedzone/*"
    }
  ]
}

// find-unused-route-53-hosted-zones.ts
// Flags Route 53 hosted zones that hold only the default SOA and NS records, public zones whose
// domain isn't delegated to the zone's name servers, and public zones that answered no DNS queries
// in the last 14 days. Read-only: it never deletes a record or a zone.
// Usage: npx tsx find-unused-route-53-hosted-zones.ts
import { Resolver } from "node:dns/promises";
import { Route53Client, GetHostedZoneCommand, paginateListHostedZones, type HostedZone } from "@aws-sdk/client-route-53";
import { CloudWatchClient, GetMetricDataCommand } from "@aws-sdk/client-cloudwatch";

const route53 = new Route53Client({ region: "us-east-1" });
const cloudwatch = new CloudWatchClient({ region: "us-east-1" }); // Route 53 metrics live in us-east-1 only
const resolver = new Resolver();
resolver.setServers(["1.1.1.1", "8.8.8.8"]); // ask public resolvers, not a split-horizon office DNS
const LOOKBACK_DAYS = 14;

interface Row { Zone: string; Id: string; Type: string; Records: number; Delegated: string; Queries14d: string; Verdict: string }

const bare = (n: string): string => n.replace(/\.$/, "").toLowerCase();

async function delegated(zone: string, zoneId: string): Promise<boolean> {
  const own = (await route53.send(new GetHostedZoneCommand({ Id: zoneId }))).DelegationSet?.NameServers ?? [];
  try {
    const live = (await resolver.resolveNs(bare(zone))).map(bare);
    return own.some((ns) => live.includes(bare(ns)));
  } catch {
    return false; // NXDOMAIN or no NS records: the registrar or parent zone points nowhere
  }
}

async function queryCounts(ids: string[]): Promise<Map<string, number>> {
  const out = new Map<string, number>();
  const end = new Date();
  const start = new Date(end.getTime() - LOOKBACK_DAYS * 86_400_000);
  for (let i = 0; i < ids.length; i += 500) {
    const batch = ids.slice(i, i + 500);
    let NextToken: string | undefined;
    do {
      const res = await cloudwatch.send(new GetMetricDataCommand({
        StartTime: start,
        EndTime: end,
        NextToken,
        MetricDataQueries: batch.map((id, n) => ({
          Id: `z${n}`,
          MetricStat: {
            Metric: { Namespace: "AWS/Route53", MetricName: "DNSQueries", Dimensions: [{ Name: "HostedZoneId", Value: id }] },
            Period: 86_400,
            Stat: "Sum",
          },
        })),
      }));
      for (const r of res.MetricDataResults ?? []) {
        const id = batch[Number((r.Id ?? "z0").slice(1))];
        out.set(id, (out.get(id) ?? 0) + (r.Values ?? []).reduce((a, b) => a + b, 0));
      }
      NextToken = res.NextToken;
    } while (NextToken);
  }
  return out;
}

async function main(): Promise<void> {
  const zones: HostedZone[] = [];
  for await (const page of paginateListHostedZones({ client: route53 }, {})) zones.push(...(page.HostedZones ?? []));

  const shortId = (z: HostedZone): string => (z.Id ?? "").replace("/hostedzone/", "");
  const publicZones = zones.filter((z) => !z.Config?.PrivateZone);
  const queries = await queryCounts(publicZones.map(shortId));

  const rows: Row[] = [];
  for (const z of zones) {
    const id = shortId(z);
    const records = z.ResourceRecordSetCount ?? 0;
    const isPrivate = z.Config?.PrivateZone === true;
    const isDelegated = isPrivate ? undefined : await delegated(z.Name ?? "", id);
    const q = isPrivate ? undefined : queries.get(id) ?? 0;
    let verdict = "in use";
    if (z.LinkedService) verdict = `managed by ${z.LinkedService.ServicePrincipal ?? "another service"}: leave it`;
    else if (records <= 2) verdict = "UNUSED: only SOA and NS";
    else if (isDelegated === false && q === 0) verdict = "UNUSED: not delegated, no queries";
    else if (isDelegated === false) verdict = "not delegated: check registrar";
    else if (q === 0) verdict = "delegated but no queries in 14 days";
    rows.push({
      Zone: z.Name ?? "",
      Id: id,
      Type: isPrivate ? "private" : "public",
      Records: records,
      Delegated: isDelegated === undefined ? "n/a" : isDelegated ? "yes" : "NO",
      Queries14d: q === undefined ? "n/a" : String(q),
      Verdict: verdict,
    });
  }
  console.table(rows);
  const unused = rows.filter((r) => r.Verdict.startsWith("UNUSED"));
  // $0.50 per zone per month for the first 25 zones, $0.10 after that (us-east-1 price list, September 2026).
  const rate = zones.length > 25 ? 0.1 : 0.5;
  console.log(`${zones.length} hosted zones; ${unused.length} look unused (at least $${(unused.length * rate).toFixed(2)}/month).`);
  console.log("Read-only: nothing was deleted.");
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-route-53 @aws-sdk/client-cloudwatch
npm install --save-dev tsx typescript

AWS_PROFILE=readonly npx tsx find-unused-route-53-hosted-zones.ts

┌─────────┬─────────────────────┬─────────────────────────┬───────────┬─────────┬───────────┬────────────┬───────────────────────────────────────────────────────┐
│ (index) │ Zone                │ Id                      │ Type      │ Records │ Delegated │ Queries14d │ Verdict                                               │
├─────────┼─────────────────────┼─────────────────────────┼───────────┼─────────┼───────────┼────────────┼───────────────────────────────────────────────────────┤
│ 0       │ 'example.com.'      │ 'Z0123456789ABCDEFGHIJ' │ 'public'  │ 24      │ 'yes'     │ '1843221'  │ 'in use'                                              │
│ 1       │ 'example.com.'      │ 'Z0987654321ZYXWVUTSRQ' │ 'public'  │ 22      │ 'NO'      │ '0'        │ 'UNUSED: not delegated, no queries'                   │
│ 2       │ 'test-idea.dev.'    │ 'Z05566778899AABBCCDDE' │ 'public'  │ 2       │ 'NO'      │ '0'        │ 'UNUSED: only SOA and NS'                             │
│ 3       │ 'old-campaign.com.' │ 'Z0A1B2C3D4E5F6G7H8I9J' │ 'public'  │ 6       │ 'yes'     │ '0'        │ 'delegated but no queries in 14 days'                 │
│ 4       │ 'internal.corp.'    │ 'Z0FEDCBA9876543210ABC' │ 'private' │ 41      │ 'n/a'     │ 'n/a'      │ 'in use'                                              │
│ 5       │ 'sd.local.'         │ 'Z0112233445566778899A' │ 'private' │ 5       │ 'n/a'     │ 'n/a'      │ 'managed by servicediscovery.amazonaws.com: leave it' │
└─────────┴─────────────────────┴─────────────────────────┴───────────┴─────────┴───────────┴────────────┴───────────────────────────────────────────────────────┘
6 hosted zones; 2 look unused (at least $1.00/month).
Read-only: nothing was deleted.