Azure DNS

About Azure DNS

Azure DNS is Microsoft Azure's managed DNS service for hosting public DNS zones, resolving private names inside virtual networks, and connecting Azure private DNS with on-premises or other networks through DNS Private Resolver. It fits organizations that want DNS managed alongside other Azure resources with Azure RBAC, APIs, automation, and usage-based billing. Azure DNS does not sell domain names itself, so public domains still need to be registered separately before they can be delegated to Azure DNS name servers.

What is Azure DNS used for?

Azure DNS is used to host and resolve names for public internet domains and for private Azure networks. Public DNS zones let organizations manage records such as A, AAAA, CNAME, MX, TXT, and other supported record types on Microsoft's global DNS infrastructure. Private DNS zones provide internal name resolution for virtual networks without exposing those records on the public internet.

Microsoft also positions Azure DNS as a broader name-resolution family. Azure DNS Private Resolver can forward DNS queries between Azure virtual networks and on-premises networks without deploying and maintaining DNS server virtual machines. This makes Azure DNS relevant both to straightforward domain hosting and to hybrid network architectures where applications must resolve private service names across several environments.

How do Azure Public DNS and Private DNS differ?

Azure Public DNS hosts internet-facing authoritative zones. Microsoft uses a global anycast network so queries can be answered by an available Azure DNS name server close to the requester. Public DNS integrates with Azure RBAC, activity logs, resource locks, CLI, PowerShell, REST APIs, and SDKs. It also supports DNSSEC signing and alias records for selected Azure resources.

Azure Private DNS is designed for names that should resolve only inside linked virtual networks. A private zone can be linked to multiple virtual networks, including networks in different regions, and can optionally autoregister virtual machine records. Private and public zones can share the same zone name for split-horizon designs. A public zone should not be used to publish private addresses when the intended resolution scope is internal.

What does DNSSEC protect, and what does Azure DNS not validate?

Azure Public DNS supports DNSSEC signing for authoritative public zones. Signing creates DNSSEC records and a delegation signer record that must be added to the parent zone to establish the chain of trust. This helps validating recursive resolvers detect forged or modified DNS responses for the signed zone.

The limitation is important: Microsoft's default Azure-provided recursive resolver does not perform DNSSEC validation. Microsoft also states that DNSSEC validation is not supported for Azure Private DNS zones. Organizations that require recursive DNSSEC validation must use a custom recursive resolver that performs validation and is designed into the network path. Buyers should therefore distinguish public-zone signing from recursive validation rather than treating DNSSEC as one end-to-end switch.

What does Azure DNS security policy do?

Microsoft's current Azure networking guidance describes DNS security policy as a DNS-layer control that uses Microsoft Threat Intelligence to block resolution of known malicious domains at the virtual-network level. It operates before an application connects to the destination and is separate from Azure Firewall FQDN filtering.

This is useful for reducing exposure to malicious domains, DNS-based exfiltration destinations, and other known threats without changing every workload. It is still not a replacement for network firewalls, endpoint protection, identity controls, or application security. Buyers should also include the additional DNS security policy query and domain-list meters in cost planning when rules are configured.

When should organizations use Azure DNS Private Resolver?

DNS Private Resolver is useful when Azure resources must resolve on-premises names, or on-premises systems must resolve Azure private DNS zones. It provides inbound and outbound endpoints plus forwarding rulesets, removing the need to run custom DNS forwarder virtual machines for many hybrid scenarios.

Microsoft currently documents limits of 15 private resolvers per subscription, five inbound endpoints and five outbound endpoints per resolver, up to 1,000 forwarding rules per ruleset, 500 virtual network links per ruleset, six target DNS servers per forwarding rule, and 10,000 queries per second per endpoint. Microsoft also documents that Azure DNS Private Resolver is not supported in virtual networks with Azure Virtual Network encryption enabled. Teams should validate these restrictions before making it the standard resolver pattern for a hub-and-spoke platform.

How does Azure DNS pricing work?

Azure DNS does not have one flat subscription price. Microsoft bills public and private DNS primarily by the number of hosted DNS zones and the number of DNS queries received. The first 25 hosted zones and additional zones use different zone meters, and DNS query billing is aggregated within the Azure subscription. Zone charges are prorated for partial months.

DNS Private Resolver has separate meters for inbound endpoints, outbound endpoints, and rulesets. DNS security policy adds query charges when rules are configured and a separate domain-list charge based on domains stored in a list. Pricing was rechecked against Microsoft's Azure DNS pricing page in September 2026. Buyers should estimate zone count, query volume, resolver endpoints, rulesets, and security-policy usage rather than assuming DNS cost is driven only by how many domains they host.

What reliability, security, and scale limits should buyers know?

Microsoft states that Azure Public DNS runs on a global network of authoritative name servers using anycast routing. Azure Resource Manager adds controls such as RBAC, activity logs, and resource locks. DNS availability still depends on correct delegation, sensible TTLs, and resilient application architecture, so a managed DNS platform cannot compensate for incorrect records or broken parent-zone delegation.

Current default public DNS limits include 250 public zones per subscription, 10,000 record sets per public zone, 20 records per record set, 400 TXT records per TXT record set, and 50 alias records pointing to one Azure resource. Some public-zone limits can be raised through Azure Support. Private DNS currently supports 1,000 zones per subscription, 25,000 record sets per zone, 20 records per record set, 1,000 virtual-network links per zone, and 100 links with autoregistration enabled.

What operational limitations should teams plan around?

Azure DNS does not currently support AXFR or IXFR zone transfers. Existing zones can be imported with Azure tooling, but teams that depend on standard DNS zone-transfer workflows need a different migration or synchronization approach. Azure DNS also does not provide HTTP URL redirection because redirects are an application-layer function rather than a DNS function.

Private DNS resolution can also become complicated when custom DNS servers are configured. Microsoft notes that custom DNS settings override the normal Azure-provided name-resolution order. If a virtual network uses a custom DNS server, private-zone resolution has to be designed explicitly, for example through DNS Private Resolver or conditional forwarding to Azure DNS at 168.63.129.16 where appropriate. A name resolving successfully still does not prove that firewalls, private endpoints, identity, or the application itself will permit the connection.

How does Azure DNS integrate with other Azure services?

Azure DNS can manage records for Azure resources as well as external infrastructure. Public alias records can reference supported Azure resources so a DNS answer follows the target resource rather than relying on a manually maintained IP address. Private DNS zones are widely used with Azure Private Link so private endpoints can resolve to internal IP addresses from connected networks.

Azure DNS also works alongside Azure Front Door, Application Gateway, Load Balancer, App Service, storage services, and other Azure platforms that expose public or private endpoints. DNS and traffic delivery remain separate responsibilities. Azure DNS resolves names, while Front Door, Traffic Manager, Application Gateway, and Load Balancer make different routing and delivery decisions after or around name resolution.

Who is Azure DNS best suited for?

Azure DNS is a strong fit for organizations that already operate a meaningful Azure estate and want DNS governed with the same subscriptions, RBAC model, automation, logging, and resource-management practices as the rest of the platform. It is particularly useful when public zones, private zones, Private Link, hybrid resolution, and Azure-native security controls need to work together.

It can also suit platform teams that want infrastructure-as-code control over DNS rather than managing records manually in a registrar dashboard. The main benefit is not simply authoritative DNS hosting. It is the ability to treat DNS as part of the Azure platform architecture with repeatable deployment and governance.

Who should choose something else?

Organizations that only need a simple public domain and prefer a registrar that bundles domain purchase, DNS hosting, email, and website management may find a non-Azure DNS provider simpler. Teams that depend on AXFR or IXFR zone transfers, built-in recursive DNSSEC validation, or DNS features tightly coupled to a non-Azure network platform should compare other authoritative or recursive DNS products.

Teams with advanced global traffic-steering requirements should also evaluate Azure Traffic Manager or Azure Front Door rather than expecting standard DNS records alone to provide application-aware routing. Azure DNS is strongest when Azure-integrated authoritative, private, and hybrid name resolution matters more than registrar convenience or specialized third-party DNS features.