Azure DNS

About Azure DNS

Azure DNS is Microsoft Azure's managed DNS service for hosting public DNS zones, resolving private names inside virtual networks, and connecting Azure private DNS with on-premises or other networks through DNS Private Resolver. It fits organizations that want DNS managed alongside other Azure resources with Azure RBAC, APIs, automation, and usage-based billing. Azure DNS does not sell domain names itself, so public domains still need to be registered separately before they can be delegated to Azure DNS name servers.

What is Azure DNS used for?

Azure DNS is used to host and resolve names for public internet domains and for private Azure networks. Public DNS zones let organizations manage records such as A, AAAA, CNAME, MX, TXT, and other supported record types on Microsoft's global DNS infrastructure. Private DNS zones provide internal name resolution for virtual networks without exposing those records on the public internet.

Microsoft also positions Azure DNS as a broader name-resolution family. Azure DNS Private Resolver can forward DNS queries between Azure virtual networks and on-premises networks without deploying and maintaining DNS server virtual machines. This makes Azure DNS relevant both to straightforward domain hosting and to hybrid network architectures where applications must resolve private service names across several environments.

How do Azure Public DNS and Private DNS differ?

Azure Public DNS hosts internet-facing DNS zones. Microsoft uses a global anycast network so queries are answered by the closest available Azure DNS name server. Public DNS can use Azure RBAC, activity logs, resource locks, automation through CLI, PowerShell, REST APIs, and SDKs, and DNSSEC for signed public zones. Azure Public DNS also supports alias records that can point selected record types directly at Azure resources such as public IP addresses.

Azure Private DNS is designed for names that should resolve only within linked virtual networks. A private zone can be linked to multiple virtual networks, including networks in different regions, and can optionally autoregister virtual machine records. Private and public zones can also share the same zone name for split-horizon DNS designs. Teams should not use a public zone to expose private addresses when the intended resolution scope is internal.

When should organizations use Azure DNS Private Resolver?

DNS Private Resolver is useful when Azure resources must resolve on-premises names, or on-premises systems must resolve Azure private DNS zones. It provides inbound and outbound endpoints plus forwarding rulesets, removing the need to run custom DNS forwarder virtual machines for many hybrid scenarios.

The design still requires planning. Microsoft currently documents default limits such as 15 DNS private resolvers per subscription, five inbound endpoints and five outbound endpoints per resolver, up to 1,000 forwarding rules per ruleset, and 10,000 queries per second per endpoint. Resolver virtual-network restrictions also apply, so buyers should check regional placement, linked networks, forwarding behavior, and security requirements before standardizing a hub-and-spoke DNS architecture.

How does Azure DNS pricing work?

Azure DNS does not have one flat subscription price. Microsoft bills public and private DNS primarily by the number of hosted DNS zones and the number of DNS queries received. Per-zone charges are prorated, and query billing is aggregated within the Azure subscription. DNS Private Resolver uses separate meters for inbound endpoints, outbound endpoints, and rulesets. DNS security policy features can add query and domain-list charges when configured.

Pricing was checked against Microsoft's current Azure DNS pricing page on August 26, 2026. Exact regional and agreement pricing can vary, so buyers should estimate expected query volume, number of public and private zones, resolver endpoints, forwarding rulesets, and any DNS security policy usage rather than assuming that a low zone count means the whole design will remain inexpensive.

What reliability, security, and scale limits should buyers know?

Microsoft states that Azure Public DNS runs on its global network of name servers using anycast routing. Azure DNS also uses Azure Resource Manager controls such as RBAC, activity logs, and resource locks. DNSSEC is supported for Azure Public DNS, while private DNS designs rely on network scope and access controls rather than publishing internal records to the internet.

Current default service limits matter in larger environments. Microsoft documents 250 public DNS zones per subscription, 10,000 record sets per public zone, and 20 records per record set, with higher quotas available for some limits through support. Private DNS currently supports 1,000 zones per subscription, 25,000 record sets per private zone, 1,000 virtual-network links per private zone, and 100 links with autoregistration enabled. Organizations planning large multi-subscription environments should include DNS quota management in platform governance.

How does Azure DNS integrate with other Azure services?

Azure DNS can manage records for Azure resources as well as external infrastructure. Public alias records can reference supported Azure resources so DNS answers follow the target resource instead of relying on a manually maintained IP address. Private DNS zones are widely used with Azure Private Link so private endpoints resolve to internal IP addresses inside connected networks.

Azure DNS also works alongside services such as Azure Front Door, Application Gateway, Load Balancer, App Service, storage services, and other Azure platforms that expose public or private endpoints. DNS and application delivery are different responsibilities, however. Azure DNS answers names, while products such as Front Door and Load Balancer direct application traffic after resolution. Buyers should keep those roles separate when designing availability and failover.

What are the main limitations and operational tradeoffs?

Azure DNS manages DNS infrastructure, but it does not remove DNS architecture mistakes. Incorrect delegation, record TTLs, private-zone links, conditional forwarding, or split-horizon design can still create application outages. Public DNS also does not sell domain names, so domain registration remains a separate process. Private DNS can become complicated when organizations combine custom DNS servers, private endpoints, multiple virtual networks, hybrid networks, and overlapping namespace rules.

Teams should also remember that DNS resolution does not grant application access. A name can resolve correctly while a firewall, private endpoint policy, identity rule, or application setting still blocks the connection. Troubleshooting therefore needs to separate DNS resolution from network reachability and application authorization instead of treating every failed connection as a DNS problem.

Who should choose something else?

Organizations that only need a simple public domain and prefer a registrar that bundles domain purchase, DNS hosting, email, and website management may find a non-Azure DNS provider simpler. Teams with advanced global traffic-steering requirements should evaluate Azure Traffic Manager or Azure Front Door in addition to DNS rather than expecting standard DNS records alone to provide application-aware routing.

Azure DNS is strongest when DNS needs to be managed as part of an Azure platform, especially where public zones, private zones, Private Link, hybrid name resolution, automation, and Azure governance need to work together. Buyers should choose it for Azure-integrated DNS management, not simply because other workloads happen to run in Azure.