Configure Azure DNS for Public and Private Resolution

Implement DNS Zones and Records

DNS Zones and Records

Azure DNS is a hosting service for managing your domain names. A DNS zone is the container that holds all the DNS records for a specific domain, like contoso.com. Within that zone, you create individual records that tell computers how to find your resources. For example, an A record points a name like www.contoso.com to an IPv4 address, while a CNAME record can point that same name to another domain name instead. Other common records include AAAA for IPv6 addresses, MX for mail servers, and TXT for verification text.

Azure DNS Features and Management

You manage Azure DNS zones and records just like any other Azure resource, using the Azure portal, PowerShell, or the CLI. This integration means you can use Azure role-based access control to decide who can change records and view audit logs to track those changes. For security, Azure Public DNS supports DNSSEC, which adds digital signatures to DNS data to prevent spoofing attacks by ensuring the answers you get are authentic.

Integration with Other Services

Azure DNS works with other Azure services to direct traffic. For instance, you can use Azure Traffic Manager for advanced routing, like sending users to the closest healthy endpoint. The DNS zone holds the record that points your domain name to the Traffic Manager profile, which then decides the best destination based on its rules. This separation means you manage the domain in Azure DNS and the traffic logic in Traffic Manager.

Integrate Azure DNS with On-Premises and Hybrid Environments

The Azure DNS Private Resolver

For hybrid networks where Azure resources need to talk to on-premises servers and vice versa, the Azure DNS Private Resolver is a key managed service. It replaces the need to run your own DNS servers on virtual machines. The resolver uses two main components: inbound endpoints and outbound endpoints. An inbound endpoint gives you an IP address inside your Azure virtual network where your on-premises DNS servers can send queries. An outbound endpoint lets your Azure resources send queries out to your on-premises or other external DNS servers.

DNS Forwarding Rulesets

To control where queries go, you configure a DNS forwarding ruleset. This is a collection of rules that say, "queries for the corp.contoso.com domain should be sent to this specific on-premises DNS server IP." This is called conditional forwarding. You can link one ruleset to many virtual networks, which is useful in a hub-and-spoke network design to centralize DNS management. The resolver uses the outbound endpoint to send these forwarded queries.

Azure Private DNS Zones

For internal name resolution within Azure, you use Azure Private DNS zones. These zones host records for your private domains (like private.contoso.com) and are only accessible from virtual networks you link to them, not the public internet. To make a virtual machine use a private zone, you must create a virtual network link between the zone and the VM's network. You can also enable autoregistration, which lets VMs automatically create their own A records in the private zone when they get an IP address.

Configure Custom DNS Settings for Azure Virtual Networks

Using Custom DNS Servers

Sometimes you need to use your own custom DNS servers for a virtual network, such as when joining VMs to an on-premises Active Directory domain. You specify the IP addresses of these servers in the virtual network's settings. A common setup is to have your custom server handle queries for your internal corporate domains and then forward all other queries (like for public Azure services) to the Azure recursive resolver at the special IP address 168.63.129.16. This ensures VMs can resolve both internal and Azure hostnames.

Precedence and Propagation of DNS Settings

DNS settings can be configured at two levels: the virtual network or directly on a network interface (NIC). The NIC-level settings always win over the network-level settings. If you enable custom DNS for a network but don't list any server IPs, Azure will ignore the setting and use its default DNS. When you change the DNS servers for a virtual network, running VMs won't see the change until they renew their DHCP lease, which you can force with a command like ipconfig /renew on Windows. Avoid setting DNS inside the VM's operating system, as Azure may overwrite it during maintenance.

Advanced Configuration and the Private Resolver

For complex forwarding, like sending queries for a specific domain to a particular server, you set up conditional forwarding rules on your custom DNS servers. If using Windows Server as a forwarder, you must set the forwarding timeout to more than four seconds. This gives the Azure resolver enough time to respond and prevents it from incorrectly returning a public IP address for a private name. As a managed alternative, the Azure DNS Private Resolver simplifies this with built-in high availability and scalability. It integrates with Network Security Groups (NSGs), so you can control DNS traffic on port 53 while ensuring the resolver's necessary traffic is allowed.