In this article, I will walk you through exactly how to create and configure a Private DNS Zone in Azure, ensuring your internal network is robust, secure, and ready for enterprise scale.
How to Create a Private DNS Zone in Azure
What is an Azure Private DNS Zone?
Before we click any buttons, let’s clarify what we are building.
An Azure Private DNS Zone is a managed service that provides name resolution for your Virtual Networks (VNets). Unlike a public DNS zone (which tells the whole world that google.com is at a specific IP), a Private DNS zone is completely contained within your Azure environment.
If I create a zone named logistics.internal, and a hacker on the public internet tries to ping it, they get nothing. It doesn’t exist to them. But for your VMs inside Azure, it resolves instantly.
Why specific US industries love this:
- Healthcare (HIPAA): Your internal patient database names are never exposed to public DNS logs.
- Finance (SEC/FINRA): You maintain strict traffic isolation within the Microsoft backbone.
Prerequisites
To follow this tutorial, you will need:
- An Azure Subscription: You need “Contributor” access or higher.
- A Resource Group: I recommend creating a dedicated one for networking (e.g.,
RG-Networking-Core). - A Virtual Network (VNet): You need at least one VNet to link to the zone.
Step 1: Creating the Private DNS Zone
Let’s get our hands dirty. I’ll be using the Azure Portal for this, as it gives the best visual feedback, but everything here can be done via PowerShell or CLI.
1. Log in to https://portal.azure.com/
2. In the top search bar, type “Private DNS zones” and select the service.
3. In the DNS zones window, click on the “Create DNS zone” button as per the screenshot below.
4. Fill out the details below
- Subscription: Select the subscription details.
- Resource group: Choose your resource group.
- Name: Fill in the name under Instance details.
5. Then click the Review + Create button, then click the Create button on the next screen.
Pro Tip regarding Naming: Do NOT use
.local. While it works, it conflicts with Multicast DNS (mDNS) used by Macs and Linux machines.Instead, use a valid-looking domain that you own, but with an internal prefix, or a reserved internal domain.
- Good: internal.mycompany.com, corp.local (acceptable but risky), azure.mycompany.net.
- Best Practice: privatelink.postgres.database.azure.com (if using Private Endpoints) or internal.azurelessons.com.
It usually takes less than 30 seconds for Azure to provision the zone.
Step 2: The Magic of Virtual Network Links
This is the step most beginners miss. Just creating the zone does nothing. It’s like buying a phonebook but leaving it in a drawer. You have to tell Azure which networks are allowed to read this phonebook.
- Go to your newly created Private DNS Zone.
- On the left-hand menu, under DNS Management, click Virtual network links.
- Click + Add.
You will see two k