Networking · Lesson 19 of 24

Azure DNS, public and private

Hosting your company domain, and giving servers names inside the private network.

About 10 min · Interactive · 3 practice questions

Exam objective
Configure Azure DNSImplement and manage virtual networking · 15–20% of the exam · typical question: Public vs private zones, auto-registration, alias vs CNAME at the apex, custom DNS server effects
In one sentence. DNS turns names into addresses. Azure can host the public records for contoso.com (so the world finds your website), and it can run private name books that only your VNets can see (so a server can reach sql1.contoso.internal without anyone memorising 10.10.2.4). You still buy the domain name from a registrar; Azure DNS only answers queries for it.

Public DNS zone

You, the admin: move contoso.com's DNS to Azure

  1. DNS zones › + Create, name contoso.com.
  2. Open the zone; the Overview shows four name servers (ns1-0x.azure-dns.com…). At your registrar, replace the existing name servers with these four (delegation).
  3. Add records: + Record set. www type CNAME → contoso-web.azurewebsites.net. For the bare domain use type A with Alias record set = Yes pointing at the App Service or public IP resource, so it follows the IP if it changes (a plain CNAME is not allowed at the apex).

Record types: A, AAAA, CNAME, MX, TXT, NS, SRV, PTR, CAA. Alias records can point at a public IP, Traffic Manager or Front Door resource and never go stale.

Private DNS zone

Private zonecontoso.internalVNet1 linkauto-registration ONVNet2 linkresolve onlyweb1 registers itselfweb1.contoso.internal → 10.10.1.4app1 can look it upbut does not register
A zone is linked to VNets. Only one link per zone may auto-register records.
  1. Private DNS zones › + Create, name contoso.internal.
  2. Zone › Virtual network links › + Add: pick VNet1, tick Enable auto registration so every VM in VNet1 gets an A record automatically. Link VNet2 too, without auto-registration (only one VNet per zone may auto-register). Links work across subscriptions.
  3. Add manual records for things that are not VMs (an internal load balancer front end).

What servers use to resolve

VNet › DNS servers: Default (Azure-provided) resolves other VMs in the VNet, linked private zones and the internet. Custom points VMs at your own servers (a domain controller at 10.10.2.10). VMs pick up a change only after a restart or DHCP renew. If you use custom servers they must forward unknown names to Azure's resolver at 168.63.129.16 or private zones stop working. Azure DNS Private Resolver is the managed way to forward between the office DNS and Azure private zones without running a DNS VM.

Trap wording. "VMs should register their own names" = auto-registration on the link. "Apex record that follows the public IP" = alias A record. "Changed DNS servers, VMs still use old" = restart them. "Custom DNS broke private endpoints" = forward to 168.63.129.16.

Key points

  • Public zone: Azure hosts your records; you delegate at the registrar by changing name servers. Alias records follow Azure resources.
  • Private zone: link it to VNets; only one link per zone may auto-register VM names.
  • Custom DNS servers need a VM restart to take effect and must forward to 168.63.129.16 to keep private zones working.

Formal terms: Delegation, zone apex, alias record, private DNS zone, virtual network link, auto-registration, conditional forwarding, Azure DNS Private Resolver.

Check your understanding

3 exam-style questions in the formats AZ-104 uses. Each is marked when you check it, with the reasoning.

0 of 3 checked

All scenarios and questions are original. None are taken from the exam, Microsoft's practice assessment or any question bank. PrepToExcel is not affiliated with Microsoft.