Tutorial: Create an Azure DNS private zone using Azure PowerShell
This tutorial walks you through the steps to create your first private DNS zone and record using Azure PowerShell.
This article has been updated to use the new Azure PowerShell Az module. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020. To learn more about the new Az module and AzureRM compatibility, see Introducing the new Azure PowerShell Az module. For Az module installation instructions, see Install Azure PowerShell.
The Azure DNS Private Zone feature is currently in public preview.
A DNS zone is used to host the DNS records for a particular domain. To start hosting your domain in Azure DNS, you need to create a DNS zone for that domain name. Each DNS record for your domain is then created inside this DNS zone. To publish a private DNS zone to your virtual network, you specify the list of virtual networks that are allowed to resolve records within the zone. These are called resolution virtual networks. You may also specify a virtual network for which Azure DNS maintains hostname records whenever a VM is created, changes IP, or is deleted. This is called a registration virtual network.
In this tutorial, you learn how to:
- Create a DNS private zone
- Create test virtual machines
- Create an additional DNS record
- Test the private zone
If you don’t have an Azure subscription, create a free account before you begin.
If you prefer, you can complete this tutorial using Azure CLI.
Launch Azure Cloud Shell
The Azure Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account. Just click the Copy to copy the code, paste it into the Cloud Shell, and then press enter to run it. There are a few ways to launch the Cloud Shell:
|Click Try It in the upper right corner of a code block.|
|Open Cloud Shell in your browser.|
|Click the Cloud Shell button on the menu in the upper right of the Azure portal.|
Create the resource group
First, create a resource group to contain the DNS zone:
New-AzResourceGroup -name MyAzureResourceGroup -location "eastus"
Create a DNS private zone
A DNS zone is created by using the
New-AzDnsZone cmdlet with a value of Private for the ZoneType parameter. The following example creates a DNS zone called private.contoso.com in the resource group called MyAzureResourceGroup and makes the DNS zone available to the virtual network called MyAzureVnet.
If the ZoneType parameter is omitted, the zone is created as a public zone, so it is required to create a private zone.
$backendSubnet = New-AzVirtualNetworkSubnetConfig -Name backendSubnet -AddressPrefix "10.2.0.0/24" $vnet = New-AzVirtualNetwork ` -ResourceGroupName MyAzureResourceGroup ` -Location eastus ` -Name myAzureVNet ` -AddressPrefix 10.2.0.0/16 ` -Subnet $backendSubnet New-AzDnsZone -Name private.contoso.com -ResourceGroupName MyAzureResourceGroup ` -ZoneType Private ` -RegistrationVirtualNetworkId @($vnet.Id)
If you wanted to create a zone just for name resolution (no automatic hostname creation), you could use the ResolutionVirtualNetworkId parameter instead of the RegistrationVirtualNetworkId parameter.
You won't be able to see the automatically created hostname records. But later, you will test to ensure they exist.
List DNS private zones
By omitting the zone name from
Get-AzDnsZone, you can enumerate all zones in a resource group. This operation returns an array of zone objects.
Get-AzDnsZone -ResourceGroupName MyAzureResourceGroup
By omitting both the zone name and the resource group name from
Get-AzDnsZone, you can enumerate all zones in the Azure subscription.
Create the test virtual machines
Now, create two virtual machines so you can test your private DNS zone:
New-AzVm ` -ResourceGroupName "myAzureResourceGroup" ` -Name "myVM01" ` -Location "East US" ` -subnetname backendSubnet ` -VirtualNetworkName "myAzureVnet" ` -addressprefix 10.2.0.0/24 ` -OpenPorts 3389 New-AzVm ` -ResourceGroupName "myAzureResourceGroup" ` -Name "myVM02" ` -Location "East US" ` -subnetname backendSubnet ` -VirtualNetworkName "myAzureVnet" ` -addressprefix 10.2.0.0/24 ` -OpenPorts 3389
This will take a few minutes to complete.
Create an additional DNS record
You create record sets by using the
New-AzDnsRecordSet cmdlet. The following example creates a record with the relative name db in the DNS Zone private.contoso.com, in resource group MyAzureResourceGroup. The fully-qualified name of the record set is db.private.contoso.com. The record type is "A", with IP address "10.2.0.4", and the TTL is 3600 seconds.
New-AzDnsRecordSet -Name db -RecordType A -ZoneName private.contoso.com ` -ResourceGroupName MyAzureResourceGroup -Ttl 3600 ` -DnsRecords (New-AzDnsRecordConfig -IPv4Address "10.2.0.4")
View DNS records
To list the DNS records in your zone, run:
Get-AzDnsRecordSet -ZoneName private.contoso.com -ResourceGroupName MyAzureResourceGroup
Remember, you won't see the automatically created A records for your two test virtual machines.
Test the private zone
Now you can test the name resolution for your private.contoso.com private zone.
Configure VMs to allow inbound ICMP
You can use the ping command to test name resolution. So, configure the firewall on both virtual machines to allow inbound ICMP packets.
Connect to myVM01, and open a Windows PowerShell window with administrator privileges.
Run the following command:
New-NetFirewallRule –DisplayName “Allow ICMPv4-In” –Protocol ICMPv4
Repeat for myVM02.
Ping the VMs by name
- From the myVM02 Windows PowerShell command prompt, ping myVM01 using the automatically registered host name:
You should see output that looks similar to this:
PS C:\> ping myvm01.private.contoso.com Pinging myvm01.private.contoso.com [10.2.0.4] with 32 bytes of data: Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Reply from 10.2.0.4: bytes=32 time=1ms TTL=128 Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Ping statistics for 10.2.0.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 1ms, Average = 0ms PS C:\>
- Now ping the db name you created previously:
You should see output that looks similar to this:
PS C:\> ping db.private.contoso.com Pinging db.private.contoso.com [10.2.0.4] with 32 bytes of data: Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Reply from 10.2.0.4: bytes=32 time<1ms TTL=128 Ping statistics for 10.2.0.4: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms PS C:\>
Delete all resources
When no longer needed, delete the MyAzureResourceGroup resource group to delete the resources created in this tutorial.
Remove-AzResourceGroup -Name MyAzureResourceGroup
In this tutorial, you deployed a private DNS zone, created a DNS record, and tested the zone. Next, you can learn more about private DNS zones.
Send feedback about: