Create and manage DNS zones and records

Implement and Manage Azure DNS Zones and Record Sets

Azure DNS is a hosting service for DNS domains that provides scalable, high-availability name resolution using Microsoft Azure infrastructure. It allows administrators to manage DNS records with the same credentials, APIs, tools, and billing as other Azure resources. Implementing these zones establishes reliable hybrid name resolution and secures connections across on-premises and cloud environments.

Creating DNS Zones and Records

A DNS zone hosts the DNS records for a specific domain, such as contoso.com, mapping domain names to IP addresses. Within a zone, you configure an apex record at the root of the domain and define a Time-To-Live (TTL) value to specify how long clients should cache each record before querying the server again. Azure DNS organizes these entries into record sets, which are collections of records that share the same name and record type.

Managing DNS Record Types

Azure DNS supports all common record types to guide traffic and verify domain ownership. An A record maps a host name to an IPv4 address, while an AAAA record maps a name to an IPv6 address. A CNAME record creates an alias that points one name to another canonical name, an MX record directs email traffic to mail servers, and a TXT record holds descriptive text often used for domain verification and security policies.

Administrators can create, modify, and delete these record sets using the Azure Portal, Azure PowerShell, or the Azure CLI. For high availability and load distribution, you can associate multiple IP addresses with a single DNS name by adding them to the same record set. The system resolves queries by returning all addresses in the set, allowing clients to fail over if one address is unreachable.

Security Features for DNS Zones

Protecting name resolution requires implementing platform-level security controls to prevent unauthorized access or accidental changes. Administrators use Azure Role-Based Access Control (RBAC) to grant specific read or write permissions to users managing DNS zones and record sets. To protect critical infrastructure from administrative mistakes, resource locks can be applied to prevent the accidental deletion or modification of vital zones. Additionally, enabling DNSSEC secures name resolution by cryptographically signing DNS responses, which protects clients against spoofing and cache-poisoning attacks.

Hybrid Name Resolution and Connectivity

Managing hybrid environments requires coordinating name resolution between on-premises datacenters and Azure networks. Administrators deploy private DNS zones to resolve hostnames within private virtual networks without exposing those records to the public internet. To allow name resolution across these boundaries, you configure virtual network links that connect private zones to specific virtual networks. For resolution between Azure and on-premises systems, you use conditional forwarding to route queries for specific domains to designated local DNS servers.

Best Practices for DNS Administration

Maintaining a healthy hybrid DNS infrastructure requires continuous oversight and optimization of name resolution pathways. You should regularly monitor and update records to prevent stale entries from causing resolution failures. Setting appropriate TTL values balances client caching efficiency against the need to quickly propagate updates during a failover event. For large organizations, configuring zone delegation helps distribute administrative ownership by assigning responsibility for subdomains to different departments or teams.