Seeking clarification on Custom domain, DNS zone and DNS private zone

Question

Hello,

I am new to DNS concepts. Could you please confirm if my understanding about Azure DNS concepts is correct and answer related questions?

Custom domain in Azure allows you to use your domain for Azure resources provided you already own the domain and have successfully verified the same in Azure.
Question 1: Does this involve creation of DNS records either in Azure or in domain registrar ?

DNS Zone in Azure allows you to move all your DNS records from external domain provider to name servers provided by Azure. Once it's done, name resolution takes place in Azure and external domain provided have no role to play.
Question 2: Do you need to verify the domain in case you want to use same custom domain in Azure ?

Private DNS Zone in allows you to do name resolution for your Azure resources without the need of owning or verifying the domain provided you have linked the VNet(s) with private Zone. I know Azure VMs can be registered.
Questions 3 & 4:
Can we use it for name resolution of storage accounts, load balancer, Application gateway, etc. ?
Does the domain that you register with Private DNS Zone has to be unique in Azure or just your subscription?

Appreciate your insightful response, thank you !!

Answer 1

@anil kumar , We appreciate your interest towards Azure. We will be happy, answering your questions.

****Question 1:** Does this involve creation of DNS records either in Azure or in domain registrar ?**
Answer: No, Mapping custom domain in Azure requires CNAME mapping in the domain register site. But if you would like to host your domain in Azure DNS then you need to transfer your Azure Name Server list to the respective Domain Register.
For Example, If you want to add a custom domain name to Azure Front Door then you must first create a canonical name (CNAME) record with your domain provider to point to your Front Door's default frontend host (say contoso.azurefd.net).

Note: When you map an existing domain that is in production, there are special considerations. While you're registering your custom domain in the Azure portal, a brief period of downtime for the domain can occur. To avoid interruption of web traffic, first map your custom domain to your Front Door default frontend host with the Azure afdverify subdomain to create a temporary CNAME mapping. With this method, users can access your domain without interruption while the DNS mapping occurs.

Ref: https://learn.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain#map-the-permanent-custom-domain

****Question 2:** Do you need to verify the domain in case you want to use same custom domain in Azure?**
Answer: As said earlier in the first question, if you want to host your domain in Azure DNS then you need to replace your domain register NS server with these Azure NS’s In order to host that domain to Azure DNS Zone. But if you just want to assign a custom domain to resources like webapp etc. then there will be a CNAME validation step.

Brief Explanation:

Let's take Web Apps as an example here. Say, you have a root domain named staticsite.com and subdomain named www.staticsite.com purchased from third party vendors like GoDaddy. To add these custom domain names to Azure WebApp,

1.Root Domain: You need to add a TXT record along with the generated code in your register site for validation.

2.SubDomain: You need to create CNAME record with your domain register.

****Questions 3:** Can we use it for name resolution of storage accounts, load balancer, Application gateway, etc. ?**
**Answer:**Any Azure resource supporting the private IP association should work with private dns zone. As of now the supporting resources are,

1. Virtual machine network interfaces
2. Internal load balancers (ILBs)
3. Application gateways

Azure private dns zone will be automatically created when you assign a private link to Azure storage account.

****Question:4** Does the domain that you register with Private DNS Zone has to be unique in Azure or just your subscription?**
Answer: using same domain name is restricted to that private dns zone itself. You can use that domain in any other PDZ under your subscription.

---

Please do not forget to "Accept the answer" wherever the information provided helps you to help others in the community.