Azure DNS: Hosting Your Domains
Azure DNS is a hosting service for DNS domains that lets you manage your organization's DNS records using the same credentials, APIs, and tools (Azure Portal, CLI, PowerShell, ARM/Bicep templates) as the rest of your Azure resources, rather than relying on a separate third-party registrar's DNS panel. When you create a DNS zone in Azure (e.g., contoso.com), Azure assigns it a set of four name servers spread across different top-level domains for resilience, and you then update your domain registrar's NS records to point to those Azure-assigned name servers, delegating authority for that zone to Azure DNS. Azure DNS supports the standard record types -- A, AAAA, CNAME, MX, TXT, SRV, NS, SOA, PTR, and CAA -- and importantly, it does not sell domain names itself; you still need a separate registrar (like GoDaddy, Namecheap, or Azure App Service Domains) to actually purchase the domain name.
Cricket analogy: It's like a franchise moving its official ticketing and communications system onto the same league-wide platform used for player contracts and scheduling, rather than running a separate, disconnected ticketing vendor -- everything is managed through one consistent system, though the franchise still had to be registered with the league itself first.
Record Types and Common Configurations
An A record maps a name to an IPv4 address (the most common record for pointing a hostname like www.contoso.com at a web server's public IP), while a CNAME record maps a name to another name rather than an IP, commonly used to point a custom subdomain at a platform endpoint like an Azure App Service's *.azurewebsites.net address, so that if the underlying IP changes, you don't have to update your DNS record. An MX record specifies which mail servers accept email for the domain and in what priority order, a TXT record holds arbitrary text often used for domain verification (proving you own a domain to a third-party service) or SPF/DKIM email authentication policies, and a CAA record restricts which Certificate Authorities are allowed to issue TLS certificates for your domain, adding a layer of protection against certificate mis-issuance.
Cricket analogy: It's like the difference between a stadium's fixed physical address on a match ticket (A record, a direct location) versus a ticket that just says 'follow the team bus route' (CNAME, an indirect reference that updates automatically if the venue changes) -- fans still get there either way.
Alias Records and Azure-Specific Behavior
Azure DNS also supports Alias records, an Azure-specific extension available for A, AAAA, and CNAME record types that point directly at an Azure resource (a Public IP, Traffic Manager profile, or Azure CDN/Front Door endpoint) rather than at a static value; the key benefit is that an Alias record automatically updates itself if the underlying resource's IP address changes, which a plain A record cannot do since it stores a fixed value that must be manually updated. Alias records are also the only way to point a zone's apex/root domain (contoso.com with no subdomain) at a resource that doesn't have a static IP, since the DNS standard prohibits CNAME records at a zone apex -- a limitation that trips up many DNS admins moving from other providers.
Cricket analogy: It's like a scoreboard operator using a live data feed automatically synced to the match officials' system (Alias record, self-updating) rather than manually typing in a fixed score that has to be corrected by hand every time it changes (plain A record, static value).
# Create an Azure DNS zone and an A record, then check delegated name servers
az network dns zone create \
--resource-group rg-network-demo \
--name contoso.com
az network dns record-set a add-record \
--resource-group rg-network-demo \
--zone-name contoso.com \
--record-set-name www \
--ipv4-address 203.0.113.10
# Create an Alias record pointing the zone apex at a Public IP resource
az network dns record-set a create \
--resource-group rg-network-demo \
--zone-name contoso.com \
--name '@' \
--target-resource /subscriptions/<sub-id>/resourceGroups/rg-network-demo/providers/Microsoft.Network/publicIPAddresses/pip-lb-web
az network dns zone show \
--resource-group rg-network-demo \
--name contoso.com \
--query nameServersCreating a DNS zone in Azure DNS does not automatically make it live for the world -- you must also update the NS records at your domain registrar to point to the four name servers Azure assigns to that zone. Skipping this delegation step is a very common mistake: the zone exists and looks configured correctly in Azure, but nobody on the internet can resolve it because the registrar is still pointing elsewhere.
You cannot point a CNAME record at your domain's apex/root (e.g., contoso.com with no subdomain) because the DNS standard forbids a CNAME from coexisting with other required records like SOA and NS at the zone apex. Azure DNS's Alias record type is specifically designed to solve this for Azure resources like Public IPs, Traffic Manager, and Front Door.
- Azure DNS hosts DNS zones using the same tooling and credentials as other Azure resources, but does not sell domain names -- you need a separate registrar.
- Creating a zone assigns four Azure name servers; you must update your registrar's NS records to delegate the domain to Azure DNS for it to go live.
- Common record types: A (name to IPv4), AAAA (name to IPv6), CNAME (name to name), MX (mail routing), TXT (verification/SPF/DKIM), CAA (restricts allowed certificate authorities).
- CNAME records cannot be used at a zone's apex/root domain due to DNS standard restrictions on coexisting with SOA/NS records.
- Alias records are an Azure-specific extension that point A/AAAA/CNAME records directly at Azure resources and auto-update if the resource's IP changes.
- Alias records are the standard workaround for pointing an apex domain at a resource without a static IP, like a Public IP, Traffic Manager profile, or Front Door endpoint.
Practice what you learned
1. What must you do after creating a DNS zone in Azure DNS for it to actually resolve on the internet?
2. Why can't you place a CNAME record at a domain's zone apex (e.g., contoso.com)?
3. What is the main advantage of an Alias record over a plain A record?
4. Which record type restricts which Certificate Authorities can issue TLS certificates for your domain?
5. Does Azure DNS sell domain names?
Was this page helpful?
You May Also Like
Azure Virtual Networks
Learn how Azure Virtual Networks (VNets) provide isolated, private IP address spaces for your cloud resources, and how peering and hybrid connectivity link them together.
Azure Front Door and CDN
Understand how Azure Front Door provides global Layer 7 routing, failover, and WAF protection at the edge, and how it differs from and complements Azure CDN caching.
Azure Load Balancer Basics
Learn how Azure Load Balancer distributes Layer 4 traffic across backend pools using health probes, load balancing rules, and the Standard SKU's secure-by-default model.