Azure DNS: Public and Private DNS Zones

You create a private zone with a VM that registers itself, add records, test from the VM with Run Command, then create a public zone and ask Azure’s name servers directly.

$v = Get-Content C:\azure-lab\vnet-saat.json | ConvertFrom-Json
az group create --name rg-saat-l14 --tags course=saatvedha-azure lesson=14 -o none

1Create a private zone and link it with auto-registration

Run this:

az network private-dns zone create --resource-group rg-saat-l14 --name saat.internal --tags course=saatvedha-azure lesson=14 -o none
az network private-dns link vnet create --resource-group rg-saat-l14 --zone-name saat.internal --name link-vnet-saat --virtual-network $v.VnetId --registration-enabled true --tags course=saatvedha-azure lesson=14 -o none
az network private-dns link vnet list --resource-group rg-saat-l14 --zone-name saat.internal --query "[].{name:name, autoRegister:registrationEnabled, state:virtualNetworkLinkState}" -o table

You should see something like this:

Name            AutoRegister    State
--------------  --------------  ---------
link-vnet-saat  True            Completed

2Create a VM and watch it register itself

Run this (about two minutes):

az vm create --resource-group rg-saat-l14 --name vm-saat-l14 --image Canonical:ubuntu-24_04-lts:server:latest --size Standard_B2ats_v2 --subnet $v.'snet-mgmt' --public-ip-address '""' --nsg '""' --admin-username azureuser --generate-ssh-keys --os-disk-size-gb 64 --tags course=saatvedha-azure lesson=14 -o none
az network private-dns record-set a list --resource-group rg-saat-l14 --zone-name saat.internal --query "[].{name:name, ip:aRecords[0].ipv4Address, auto:isAutoRegistered}" -o table

You should see something like this:

Name         Ip          Auto
-----------  ----------  ------
vm-saat-l14  10.30.10.4  True

You didn’t create that record. Azure did it when the VM’s network card came up in a VNet with an auto-registration link.

3Add your own records

Run this:

az network private-dns record-set a add-record --resource-group rg-saat-l14 --zone-name saat.internal --record-set-name app --ipv4-address 10.30.2.10 -o none
az network private-dns record-set a add-record --resource-group rg-saat-l14 --zone-name saat.internal --record-set-name db --ipv4-address 10.30.3.10 -o none
az network private-dns record-set cname set-record --resource-group rg-saat-l14 --zone-name saat.internal --record-set-name api --cname app.saat.internal -o none
az network private-dns record-set list --resource-group rg-saat-l14 --zone-name saat.internal --query "[].{name:name, type:type, ttl:ttl}" -o table

You should see something like this:

Name         Type                                TTL
-----------  ----------------------------------  -----
@            Microsoft.Network/privateDnsZones/SOA  3600
api          Microsoft.Network/privateDnsZones/CNAME  3600
app          Microsoft.Network/privateDnsZones/A  3600
db           Microsoft.Network/privateDnsZones/A  3600
vm-saat-l14  Microsoft.Network/privateDnsZones/A  10

Records you add get a TTL of 3600 seconds (one hour) by default; auto-registered ones get 10 seconds, because VMs come and go. For records you may change during a migration, lower the TTL a day before.

4Look the names up from inside the VNet

Run this:

az vm run-command invoke --resource-group rg-saat-l14 --name vm-saat-l14 --command-id RunShellScript --scripts "getent hosts app.saat.internal api.saat.internal vm-saat-l14.saat.internal; resolvectl dns eth0" --query "value[0].message" -o tsv

You should see something like this:

Enable succeeded:
[stdout]
10.30.2.10      app.saat.internal
10.30.2.10      app.saat.internal api.saat.internal
10.30.10.4      vm-saat-l14.saat.internal
Link 2 (eth0): 168.63.129.16

[stderr]

getent hosts uses the same lookup path as applications do. The CNAME shows up as an alias of app.saat.internal. The last line confirms the VM asks Azure’s resolver, 168.63.129.16.

5Create a public zone and ask Azure’s name servers

Run this on your laptop:

$zone = 'saatlab' + (Get-Random -Maximum 99999) + '.com'
az network dns zone create --resource-group rg-saat-l14 --name $zone --tags course=saatvedha-azure lesson=14 -o none
az network dns record-set a add-record --resource-group rg-saat-l14 --zone-name $zone --record-set-name www --ipv4-address 203.0.113.10 -o none
$ns = az network dns zone show --resource-group rg-saat-l14 --name $zone --query "nameServers[0]" -o tsv
Resolve-DnsName -Name "www.$zone" -Type A -Server $ns.TrimEnd('.') | Select-Object Name, IPAddress

You should see something like this:

Name                  IPAddress
----                  ---------
www.saatlab41827.com  203.0.113.10

203.0.113.10 is a documentation address, safe to use in labs. Azure’s name server answered, because you asked it directly. In “Break It” you’ll see why the rest of the internet doesn’t know this name yet.

✅ Checkpoint: Your private zone answers inside vnet-saat (including the auto-registered VM), and Azure’s public name server answers for www in your public zone.