AZ-104
Deep Dive
DNS is fundamental in Azure for resolving resource names, PaaS services, and hybrid connectivity. The AZ-104 evaluates public Azure DNS, private zones, resolution in VNets, and integration with Private Endpoints.
Contents
Azure DNS is a DNS zone hosting service that uses Azure's infrastructure for high availability and global performance. It lets you manage your domains' DNS records from Azure.
Important: Azure DNS is NOT a domain registrar — you must register the domain with an external registrar (GoDaddy, Namecheap, etc.) and then delegate the DNS zone to Azure by changing the nameservers.
How delegation works
Advantages of Azure DNS
| Type | Function | Example | AZ-104 notes |
|---|---|---|---|
| A | Name → IPv4 | www → 1.2.3.4 | The most common. Use an Alias for Azure IPs. |
| AAAA | Name → IPv6 | www → 2001:db8::1 | For resources with IPv6. |
| CNAME | Name alias → another name | mail → contoso.mail.com | Cannot be used at the domain apex (root). Use an Alias record instead. |
| MX | Domain's mail server | 10 mail.contoso.com | Lower priority = higher preference. |
| TXT | Arbitrary text | "v=spf1 include:..." | SPF, DKIM, domain verification (Azure AD, etc.). |
| NS | Nameservers for the zone | ns1-04.azure-dns.com | Auto-generated by Azure DNS when the zone is created. |
| SOA | Start of Authority — zone info | Serial, refresh, retry... | Auto-generated and managed by Azure DNS. |
| SRV | Service location (host + port) | _sip._tcp → sipserver:5060 | For services like SIP, LDAP, Kerberos. |
| PTR | IP → name (reverse DNS) | 4.3.2.1.in-addr.arpa → www | Reverse resolution. In Azure: 168.63.in-addr.arpa zones. |
| Alias | Direct reference to an Azure resource | www → Public IP / Traffic Manager | Azure extension — updates automatically if the resource's IP changes. |
Private DNS Zones let you use custom DNS names within a VNet without needing your own DNS servers. Records in the zone are only resolvable from linked VNets — not from the internet.
VM auto-registration
When you link a VNet to a Private DNS Zone with autoregistration enabled, VMs in that VNet automatically register their A and PTR records in the zone as they are created or deleted.
• Record: vm-name.private.contoso.com → 10.0.0.4
• Removed automatically when the VM is deleted
• Only one zone with auto-registration per VNet
• Does not work with private IPs of Private Endpoints (manual registration)
Virtual Network Links
For a VNet to resolve records from a Private DNS Zone, you must create a Virtual Network Link between the zone and the VNet.
• A zone can have links to multiple VNets (including peered VNets)
• Without a link: the VNet cannot resolve the private zone even if peering exists
• With peering: a spoke VNet can resolve the hub's zone if there is a link between the zone and the hub VNet (no direct link needed if the hub's DNS proxy forwards the queries)
Azure-provided DNS (default)
Custom DNS
Azure DNS Private Resolver (recommended for hybrid)
A PaaS service that lets you resolve DNS names between Azure and on-premises without managing DNS VMs. It has two endpoints: Inbound (receives queries from on-premises) and Outbound (forwards queries from Azure to on-premises DNS according to a ruleset). Highly available and with no infrastructure to manage.
Critical concept for the exam
When you create a Private Endpoint for a PaaS service (e.g. a Storage Account), the service's public DNS name (mystorageaccount.blob.core.windows.net) must resolve to the endpoint's private IP — not to the original public IP.
Azure does this via CNAME: the public name is redirected to a *.privatelink.blob.core.windows.net subdomain, which is resolved in the privatelink.blob.core.windows.net Private DNS Zone to the endpoint's private IP.
| PaaS service | Required Private DNS Zone |
|---|---|
| Azure Blob Storage | privatelink.blob.core.windows.net |
| Azure SQL Database | privatelink.database.windows.net |
| Azure Key Vault | privatelink.vaultcore.azure.net |
| Azure Container Registry | privatelink.azurecr.io |
| Azure Kubernetes Service | privatelink.<region>.azmk8s.io |
| Azure Monitor / Log Analytics | privatelink.monitor.azure.com |
Did you get this topic?
Test what you just learned
A company has a Storage Account with a Private Endpoint configured on its VNet. Developers report that from inside the VNet, the storage's DNS name resolves to the public IP instead of the endpoint's private IP. What is the most likely cause?
Put what you learned to the test with original AZ-104 exam questions.
Start AZ-104 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.