Skip to main content
Azure DNS is Microsoft Azure’s managed DNS hosting service for hosting DNS zones and record sets. It provides reliable, global authoritative name resolution for your domains. After you create a DNS zone in Azure, you add record sets (A, AAAA, CNAME, MX, TXT, etc.) to map names to IP addresses or to other records.

​
Key concepts

  • Zone name uniqueness: A zone name must be unique within a resource group.
  • Cross-resource-group zones: The same zone name can exist in different resource groups; each instance uses its own set of Azure name servers.
  • Authoritative service: Azure DNS serves as the authoritative name servers for zones you deploy to it once you delegate the domain at your registrar.

​
Delegation (registrar -> Azure)

When you purchase a domain from a registrar (for example, Cloudflare or GoDaddy), the registrar typically assigns its own name servers. To have Azure DNS answer queries for your domain, update the domain’s name server (NS) records at the registrar to the Azure-provided name servers for your zone. Once delegated, queries for your domain are answered by Azure’s global authoritative name servers based on the record sets you define in the Azure DNS zone.
If you purchase a domain through Azure (for example with App Service Domains), the domain can be integrated directly with Azure DNS — eliminating the need to manually change name servers at an external registrar.

​
Record sets

  • Azure groups records that share the same name and type into a record set.
  • A single record set can contain up to 20 unique records (for example, multiple A records to implement simple DNS-based load balancing).
Record-set members must be unique. Keep the 20-record-per-record-set limit in mind when designing DNS records (for example, when distributing traffic across many A records).

​
Common DNS record types in Azure DNS

​
How Azure DNS works (flow)

Consider a DNS zone named kodekloud.org hosted in Azure:
  1. Azure assigns authoritative name servers (NS records) to the zone.
  2. Inside the zone you create record sets (for example, an A record for azure.kodekloud.org or a CNAME for google.kodekloud.org).
  3. If the domain is delegated at the registrar to Azure’s name servers, DNS queries from the public internet will reach Azure name servers and be answered using your configured record sets.
  4. For on-premises setups, you can either delegate subdomains from your internal DNS to Azure name servers or configure forwarding so internal clients resolve names from Azure DNS.

​
Example resolution using dig

This example queries an Azure DNS name server directly for the A record of azure.kodekloud.org:
Note: If you have not delegated the domain at your registrar to Azure’s name servers, queries to the registrar’s name servers will not be answered by Azure. You can either update the registrar’s NS records to Azure’s name servers or query the Azure name servers directly (as shown above).

​
Create a DNS zone in the Azure portal

In the Azure portal, search for “DNS zones” and create a new zone. When creating a zone you choose a resource group and a zone name.
A screenshot of the Microsoft Azure portal showing the "DNS zones" page. It lists four DNS zone entries and shows controls like a "Create" button, filters, and export/refresh options.
Example: create a zone named kodekloud.org in the resource group demo-rg. A DNS zone is a global resource for authoritative data (it does not have a region for the DNS data itself), though the resource object metadata is associated with the resource group’s region. After creating the zone, Azure automatically provides:
  • An SOA record (Start of Authority)
  • NS records listing the Azure name servers assigned to your zone
You can then add record sets such as A, AAAA, CNAME, CAA, MX, and TXT. For example, add an A record www.kodekloud.org pointing to 1.1.1.1.
A screenshot of the Microsoft Azure portal showing the DNS zone for "kodekloud.org" with essentials and record sets. Visible records include NS and SOA entries plus a CNAME for "google" and an A record for "www" (1.1.1.1).
You can also create child zones (subzones) under a parent zone. For example, create a subzone for azure.kodekloud.org if you need separate administrative control or different name servers for that subdomain.

​
Testing resolution from a client

Use nslookup in PowerShell or Command Prompt on Windows to query Azure name servers and confirm records. The example below switches the server to an Azure DNS name server (ns1-35.azure-dns.com) and queries the A record for www.kodekloud.org and the CNAME for google.kodekloud.org.
A screenshot of the Microsoft Azure portal showing the DNS zone "kodekloud.org" overview, including essentials and a list of DNS record sets (NS, SOA, CNAME, A) with name server entries and record values. A cursor hand is pointing at the A record for "www" with value 1.1.1.1.

​
Private DNS zones

Use Azure Private DNS Zones for internal name resolution that should not be published to the internet. Private zones let you manage DNS names for virtual machines and other resources within your virtual networks and provide name resolution across linked virtual networks. Linking private zones to virtual networks and configuring resolution is covered separately.

Watch Video