Azure DNS and Private DNS Zones

Azure DNS is a hosting service for DNS domains that provides name resolution using Microsoft's global network of DNS servers. It supports both public DNS (for internet-facing domains) and private DNS (for name resolution within Virtual Networks). This lesson covers both services, DNS record types, and how to integrate DNS with your Azure networking architecture.

---

What Is DNS?

The Domain Name System (DNS) translates human-readable domain names (like www.contoso.com) into IP addresses (like 52.168.1.100). Without DNS, users would need to remember IP addresses to access websites and services.

DNS resolution follows a hierarchy:

Client --> Recursive Resolver --> Root Servers --> TLD Servers --> Authoritative Server
                                                                      |
                                                               Returns IP address

Azure DNS acts as the authoritative DNS server for your domains — it responds to DNS queries with the records you configure.

---

Azure DNS (Public)

Azure DNS hosts your public DNS zones on Microsoft's global Anycast network, which means queries are answered by the nearest DNS server for optimal performance.

Key Features

Feature	Description
Global Anycast	DNS queries are routed to the nearest Azure DNS server worldwide.
100% SLA	Azure DNS offers a 100% availability SLA.
Fast propagation	Changes are propagated across all DNS servers within seconds.
Integration	Manage DNS alongside your other Azure resources using Portal, CLI, PowerShell, or Bicep.
RBAC	Control who can manage DNS records using Azure role-based access control.
Activity logs	Track who changed which record and when.
Alias records	Point directly to Azure resources (load balancer, Traffic Manager, CDN) without CNAME flattening issues.

DNS Record Types

Record Type	Purpose	Example
A	Maps a name to an IPv4 address	www → 52.168.1.100
AAAA	Maps a name to an IPv6 address	www → 2001:db8::1
CNAME	Alias to another domain name	blog → myapp.azurewebsites.net
MX	Mail exchange servers	@ → mail.contoso.com
TXT	Text data (SPF, DKIM, verification)	@ → v=spf1 include:spf.protection.outlook.com
NS	Nameserver delegation	@ → ns1-01.azure-dns.com
SRV	Service location	_sip._tcp → server and port
SOA	Start of authority (auto-managed)	Zone metadata
CAA	Certificate Authority Authorization	Which CAs can issue certs for the domain

Creating a Public DNS Zone

# Create the zone
az network dns zone create \
  --resource-group myResourceGroup \
  --name contoso.com

# Add an A record
az network dns record-set a add-record \
  --resource-group myResourceGroup \
  --zone-name contoso.com \
  --record-set-name www \
  --ipv4-address 52.168.1.100

# Add a CNAME record
az network dns record-set cname set-record \
  --resource-group myResourceGroup \
  --zone-name contoso.com \
  --record-set-name blog \
  --cname myapp.azurewebsites.net

After creating the zone, update your domain registrar's nameservers to point to the Azure DNS nameservers shown in the zone's NS records.

---

Alias Records

Alias records are a special Azure DNS feature that allows DNS records to point directly to Azure resources rather than static IP addresses.

Supported targets: