Azure Private DNS, explained — and the security wins it unlocks
Cloud security · 7-min read · Check your DNS/server version → · updated August 2026
Azure Private DNS sounds complex until it clicks. Think of an office phone system: you dial an extension like 101, not a full number — the switchboard knows the real line behind it and connects you. Azure Private DNS is that switchboard for your cloud: resources call each other by name, and it resolves the name to the right private IP — all inside your network, never on the public internet.
The pieces (and why each matters)
| Component | What it does |
|---|---|
| Private DNS Zone | The container that holds your records (e.g. contoso.internal). Resolvable only from linked networks. |
| Virtual network link | Connects a VNet to a zone so its resources can resolve those names. |
| Auto-registration | Azure creates/updates/deletes VM A records automatically — no stale entries, no manual upkeep. |
| Azure DNS Private Resolver | Managed service for Azure↔on-premises resolution (inbound/outbound endpoints, forwarding rulesets). Replaces DNS-forwarder VMs. |
| Reverse (PTR) lookup | Supported for private IPs within the linked-VNet scope. |
Set it up securely
The zone (e.g. contoso.internal) is the container that holds your records. It resolves only from networks you explicitly link — never from the public internet — so it is private by default.
Link each VNet to the zone. Enable auto-registration on one link per VNet and Azure creates, updates and deletes A records for your VMs automatically — no manual record-keeping, no stale entries.
This is the security payoff most posts miss: Private DNS resolves PaaS services (Storage, SQL, Key Vault) to their PRIVATE IPs via zones like privatelink.blob.core.windows.net. Traffic stays on your network instead of egressing to a public endpoint — a real data-exfiltration control.
For Azure↔on-premises resolution, the managed DNS Private Resolver gives you inbound/outbound endpoints and forwarding rulesets. It replaces the DNS-forwarder VMs teams used to run — fewer servers to operate, harden and patch.
Nothing in this design is reachable from the internet. But any DNS software you still run (on-prem DNS servers, BIND, Windows Server) is software like any other — track its versions and end-of-life so the one box that can resolve names is not the one with an open CVE.
mystorage.blob.core.windows.net resolves to a public IP; with it, it resolves to a private one inside your VNet — so sensitive traffic never leaves your network. That is a genuine data-exfiltration control, not just convenience.Limitations to plan around
| Limitation | Implication |
|---|---|
| One auto-registration zone per VNet | A virtual network can auto-register into only one private zone at a time — plan your zone-per-VNet mapping. |
| Reverse lookups are scoped | PTR records resolve only for private IPs within linked virtual networks. |
| Hybrid needs more wiring | Azure↔on-premises resolution requires the DNS Private Resolver (or forwarders) with conditional forwarding. |
Turn this into action. Private name resolution inside your virtual networks with no DNS server to run. What the pieces are (zones, VNet links, Private Resolver), how it keeps DNS off the public internet, and where it quietly cuts your attack surface — plus the limits to plan around.
Check your DNS/server version — free →Frequently asked questions
What is Azure Private DNS?
A managed DNS service that resolves domain names to IP addresses inside your Azure virtual networks, without you running a DNS server. Records live in a Private DNS Zone and resolve only from networks you link — not from the public internet.
Is a Private DNS Zone reachable from the internet?
No. A private zone answers only for the virtual networks linked to it. That isolation is the core security property: your internal names and IPs are never exposed to public DNS or recursion.
What is the difference between a Private DNS Zone and the DNS Private Resolver?
The zone holds and serves your private records inside Azure. The Azure DNS Private Resolver is a separate managed service for resolution BETWEEN Azure and on-premises (inbound/outbound endpoints + forwarding rules) — it replaces self-managed DNS forwarder VMs.
How does Private DNS help security?
Three ways: (1) internal name resolution stays private to your network; (2) it powers Private Endpoints, resolving PaaS services to private IPs so traffic does not traverse public endpoints — a data-exfiltration control; (3) the managed Private Resolver removes DNS VMs you would otherwise have to harden and patch.
What are the main limitations?
A virtual network can have only one Private DNS zone with auto-registration enabled at a time; reverse (PTR) lookups work only for private IPs within linked VNets; and hybrid Azure↔on-premises resolution needs the DNS Private Resolver or forwarders with conditional forwarding.
Does it remove my patching responsibility?
For the managed pieces (zones, Private Resolver), Microsoft operates them. But any DNS or forwarder software you still run is yours to maintain — keep its versions current and watch its end-of-life, the same as any other internet-adjacent service.
This guide is vendor-neutral and informational, grounded in publicly-available guidance from bodies such as OWASP, NIST and CISA. IsItPatched is independent and not affiliated with them, and this is not legal or compliance advice. See our disclaimer.