diff --git a/provider/aws/aws.go b/provider/aws/aws.go
index db1ce06c1..cbc656e47 100644
--- a/provider/aws/aws.go
+++ b/provider/aws/aws.go
@@ -1161,8 +1161,10 @@ func isAWSAlias(ep *endpoint.Endpoint) string {
 
 // canonicalHostedZone returns the matching canonical zone for a given hostname.
 func canonicalHostedZone(hostname string) string {
-	for suffix, zone := range canonicalHostedZones {
-		if strings.HasSuffix(hostname, suffix) {
+	parts := strings.Split(hostname, ".")
+	for i := 0; i < len(parts); i++ {
+		suffix := strings.Join(parts[i:], ".")
+		if zone, exists := canonicalHostedZones[suffix]; exists {
 			return zone
 		}
 	}
diff --git a/provider/aws/aws_test.go b/provider/aws/aws_test.go
index 12d9f6940..ecee7efe9 100644
--- a/provider/aws/aws_test.go
+++ b/provider/aws/aws_test.go
@@ -1882,6 +1882,14 @@ func TestAWSCanonicalHostedZone(t *testing.T) {
 	assert.Equal(t, "", zone, "no canonical zone should be returned for a non-aws hostname")
 }
 
+func BenchmarkTestAWSCanonicalHostedZone(b *testing.B) {
+	for i := 0; i < b.N; i++ {
+		for suffix, _ := range canonicalHostedZones {
+			_ = canonicalHostedZone(fmt.Sprintf("foo.%s", suffix))
+		}
+	}
+}
+
 func TestAWSSuitableZones(t *testing.T) {
 	zones := map[string]*profiledZone{
 		// Public domain