About Azure DNS Private Resolver
Azure DNS Private Resolver is Microsoft's managed hybrid DNS resolution service for forwarding private DNS queries between Azure virtual networks, on-premises networks, other private environments, and external DNS servers without running custom DNS forwarder virtual machines. It works alongside Azure DNS and Azure Private DNS rather than replacing them. Azure DNS hosts authoritative public and private zones, while Private Resolver provides recursive resolution and conditional forwarding through managed inbound and outbound endpoints.
What is included
Architecture
| Resolver role | Recursive resolver and conditional forwarding service; not an authoritative DNS server |
|---|---|
| Inbound endpoints | Up to 5 per DNS private resolver |
| Outbound endpoints | Up to 5 per DNS private resolver |
Rules
| Forwarding rules | Up to 1,000 per DNS forwarding ruleset |
|---|---|
| Virtual network links | Up to 500 per DNS forwarding ruleset |
| Target DNS servers | Up to 6 per forwarding rule |
Capacity
| Queries per second | Up to 10,000 QPS per endpoint |
|---|
Networking
| Inbound IP assignment | Static or dynamic; dynamic normally uses the fifth available subnet IP |
|---|---|
| Endpoint subnet size | From /28 through /24; dedicated to Microsoft.Network/dnsResolvers |
| Resolver virtual network | One virtual network per resolver, in the same region |
DNS
| Reverse DNS | Supported when appropriate reverse lookup zones exist in Azure Private DNS |
|---|
Deployment
| Data residency | Customer data stays in the resolver deployment region |
|---|
Availability
| Service model | Fully managed with built-in high availability and zone redundancy |
|---|
What does Azure DNS Private Resolver do?
An inbound endpoint gives on-premises or other connected private networks an IP address inside an Azure virtual network that they can target for DNS queries. This is useful when clients outside Azure need to resolve records in Azure Private DNS zones, including names used by private endpoints or auto-registered virtual machines. An outbound endpoint sends qualifying Azure DNS queries toward on-premises DNS servers, another cloud, or an external resolver. DNS forwarding rulesets decide which domain suffixes go to which target servers. Microsoft currently allows up to 1,000 forwarding rules per ruleset.
Is Azure DNS Private Resolver an authoritative DNS server?
No. Microsoft's Azure Architecture Center describes DNS Private Resolver as a recursive resolver and conditional forwarding service, not an authoritative name server. That matters for designs that depend on DNS delegation. You reach Azure Private DNS zones from on-premises by configuring conditional forwarding to the resolver inbound endpoint rather than delegating a subdomain to the resolver with NS records. If an application or network design requires authoritative answers for a delegated private namespace, Microsoft recommends hosting an authoritative DNS service instead of treating Private Resolver as one.
When is it useful for hybrid and multicloud DNS?
Private Resolver is most useful when private namespaces are split across Azure and another environment. A common pattern lets on-premises clients resolve Azure Private DNS zones through an inbound endpoint while Azure workloads resolve corporate internal domains through an outbound endpoint and forwarding ruleset. Microsoft documents ExpressRoute or VPN connectivity for DNS resolution between Azure and on-premises networks. The forwarding model can also point to DNS servers in another cloud or private environment, reducing the need for self-managed DNS relay virtual machines.
How do inbound endpoints, outbound endpoints and rulesets differ?
Inbound and outbound endpoints solve opposite traffic directions. Inbound endpoints receive DNS queries entering Azure and expose an IP address from the resolver virtual network. Outbound endpoints send matching DNS queries from Azure toward configured target DNS servers and require a dedicated subnet. Rulesets are associated with outbound endpoints and hold the conditional forwarding rules. Virtual network links extend a ruleset to other Azure virtual networks that should use those forwarding decisions. When more than one forwarding rule matches, Microsoft documents longest-suffix matching.
How do static and dynamic inbound endpoint IP addresses work?
Microsoft currently supports either static or dynamic IP assignment for an inbound endpoint. With dynamic assignment, Azure normally uses the fifth available IP address in the endpoint subnet. For example, a /28 subnet beginning at 10.10.0.0 normally receives 10.10.0.4. The address does not normally change during ordinary operation, but Microsoft warns that it can change if the inbound endpoint is reprovisioned. A static address is therefore useful when on-premises conditional forwarders or firewall rules need a fixed target, but the selected address cannot be one of the subnet's reserved IP addresses.
Does Azure DNS Private Resolver support reverse DNS?
Yes, when the required reverse lookup zone is configured. Microsoft's architecture guidance states that DNS Private Resolver can resolve reverse DNS queries when the appropriate reverse lookup zones exist in Azure Private DNS. That means PTR-based private name resolution can be part of the design, but Private Resolver does not create or populate reverse zones automatically. Teams still need to create and manage the relevant private reverse lookup zones and records.
What are the current limits and network restrictions?
Microsoft's Azure DNS Private Resolver overview, last updated June 22, 2026, documents up to 15 DNS private resolvers per subscription, five inbound endpoints and five outbound endpoints per resolver, 1,000 forwarding rules per ruleset, 500 virtual network links per ruleset, two outbound endpoints per ruleset, two rulesets per outbound endpoint, six target DNS servers per forwarding rule, and 10,000 queries per second per endpoint. Endpoint subnets must be dedicated to Microsoft.Network/dnsResolvers and sized from /28 through /24. A resolver references one virtual network, and that virtual network must be in the same region. Microsoft currently lists encrypted virtual networks, IPv6-enabled resolver subnets, cross-tenant ruleset linking, Azure ExpressRoute FastPath, and Azure Lighthouse as unsupported.
How does Azure DNS Private Resolver pricing work?
Pricing was checked on August 31, 2026 against Microsoft's Azure DNS pricing page. Microsoft prices DNS Private Resolver through separate meters for inbound endpoints, outbound endpoints, and DNS forwarding rulesets. The public pricing page presents these as monthly charges prorated to hours when a resource is discontinued earlier. Public list rates can vary by region, agreement, and currency, so one global dollar figure would be misleading. Buyers should estimate the number of endpoints and rulesets needed and validate the deployment region and commercial agreement in the Azure pricing calculator.
How should teams design availability and regional resilience?
Microsoft documents DNS Private Resolver as a fully managed service with built-in high availability and zone redundancy inside a supported region. That does not make a single regional deployment immune to a region-wide outage. Microsoft's June 15, 2026 reliability guidance states that if the deployment region becomes unavailable, the private resolver is also unavailable. For workloads that need protection from a regional failure, Microsoft recommends deploying private resolvers in multiple regions and designing forwarding and network paths so clients can fail over between them. DNS query response availability is covered by an Azure service-level agreement when clients repeatedly retry failed requests.
What should teams back up or preserve?
Microsoft states that DNS Private Resolver does not store customer data and therefore does not require a traditional backup and restore process. The important recovery asset is the configuration. Teams should keep infrastructure-as-code definitions or equivalent documented configuration for the resolver, endpoint subnets, inbound and outbound endpoints, forwarding rulesets, rules, virtual network links, and related networking so the design can be recreated quickly after an infrastructure or regional event.
How does Azure DNS resolver policy relate to Private Resolver?
Microsoft introduced current DNS resolver policy guidance in August 2026 for controlling and observing DNS traffic from Azure virtual networks. A resolver policy can integrate with services in the virtual network, including Azure Private DNS zones and Azure DNS Private Resolver. Policies are regional: a policy can only apply to virtual networks in the same region, and a virtual network can be linked to only one resolver policy at a time. This is a separate Azure DNS security capability rather than a replacement for Private Resolver. Private Resolver handles recursive resolution and conditional forwarding, while resolver policy adds DNS traffic rules, domain lists, logging, and security-oriented controls at the virtual-network level.
What should teams know about provisioning and subnet planning?
Microsoft notes that Azure portal limits can temporarily lag behind current service limits and points to PowerShell when provisioning up to newer documented limits. Endpoint subnets cannot host other services, and multiple DNS resolver endpoints cannot share one subnet. Each endpoint uses one subnet, and all IP configurations for an inbound endpoint must reference that subnet. A /28 subnet is sufficient for current endpoint limits, while /27 through /24 can provide additional address room if service limits change later.
How is it different from Azure DNS and custom DNS virtual machines?
Azure DNS and Azure DNS Private Resolver are complementary. Azure DNS hosts authoritative public DNS zones and Azure Private DNS zones. Private Resolver handles managed recursive resolution and forwarding between Azure private namespaces and other DNS systems. A self-managed DNS virtual machine can provide conditional forwarding plus vendor-specific policy, custom software, unusual protocol handling, or authoritative DNS roles, but it also introduces patching, scaling, operating-system maintenance, and failover design. Private Resolver is usually the simpler fit when the requirement is standard hybrid DNS forwarding inside Azure.
Who should choose something else?
Choose another option if you only need ordinary public DNS hosting or Azure Private DNS zones within linked virtual networks and do not require hybrid forwarding. Azure DNS alone may be enough. A custom DNS server or network virtual appliance can make more sense when you need authoritative DNS, unsupported protocols, vendor-specific filtering, custom packet processing, or designs that conflict with Private Resolver restrictions. Organizations that require cross-tenant ruleset linking, IPv6-enabled resolver subnets, encrypted virtual networks, ExpressRoute FastPath support, or Azure Lighthouse compatibility should review Microsoft's current limitations before standardizing on the service.
Reviews
No reviews yet
Nobody has reviewed Azure DNS Private Resolver here yet.