Quickstart: Create an Azure private DNS zone using Azure PowerShell

Article
07/08/2024

This article walks you through the steps to create your first private DNS zone and record using Azure PowerShell.

Note

We recommend that you use the Azure Az PowerShell module to interact with Azure. See Install Azure PowerShell to get started. To learn how to migrate to the Az PowerShell module, see Migrate Azure PowerShell from AzureRM to Az.

A DNS zone is used to host the DNS records for a particular domain. To start hosting your domain in Azure DNS, you need to create a DNS zone for that domain name. Each DNS record for your domain is then created inside this DNS zone. To publish a private DNS zone to your virtual network, you specify the list of virtual networks that are allowed to resolve records within the zone. These are called linked virtual networks. When autoregistration is enabled, Azure DNS also updates the zone records whenever a virtual machine is created, changes its' IP address, or is deleted.

Prerequisites

If you don't have an Azure subscription, create a trial account before you begin.

If you prefer, you can complete this quickstart using Azure CLI.

Create the resource group

First, create a resource group to contain the DNS zone:

New-AzResourceGroup -name MyAzureResourceGroup -location "chinaeast2"

Create a private DNS zone

A DNS zone is created by using the New-AzPrivateDnsZone cmdlet.

The following example creates a virtual network named myAzureVNet. Then it creates a DNS zone named private.contoso.com in the MyAzureResourceGroup resource group, links the DNS zone to the MyAzureVnet virtual network, and enables automatic registration.

Install-Module -Name Az.PrivateDns -force

$backendSubnet = New-AzVirtualNetworkSubnetConfig -Name backendSubnet -AddressPrefix "10.2.0.0/24"
$vnet = New-AzVirtualNetwork `
  -ResourceGroupName MyAzureResourceGroup `
  -Location chinaeast2 `
  -Name myAzureVNet `
  -AddressPrefix 10.2.0.0/16 `
  -Subnet $backendSubnet

$zone = New-AzPrivateDnsZone -Name private.contoso.com -ResourceGroupName MyAzureResourceGroup

$link = New-AzPrivateDnsVirtualNetworkLink -ZoneName private.contoso.com `
  -ResourceGroupName MyAzureResourceGroup -Name "mylink" `
  -VirtualNetworkId $vnet.id -EnableRegistration

If you want to create a zone just for name resolution (no automatic hostname registration), you can omit the -EnableRegistration parameter.

List DNS private zones

By omitting the zone name from Get-AzPrivateDnsZone, you can enumerate all zones in a resource group. This operation returns an array of zone objects.

$zones = Get-AzPrivateDnsZone -ResourceGroupName MyAzureResourceGroup
$zones

By omitting both the zone name and the resource group name from Get-AzPrivateDnsZone, you can enumerate all zones in the Azure subscription.

$zones = Get-AzPrivateDnsZone
$zones

Create the test virtual machines

Now, create two virtual machines so you can test your private DNS zone:

New-AzVm `
    -ResourceGroupName "myAzureResourceGroup" `
    -Name "myVM01" `
    -Location "China East 2" `
    -subnetname backendSubnet `
    -VirtualNetworkName "myAzureVnet" `
    -addressprefix 10.2.0.0/24 `
    -OpenPorts 3389

New-AzVm `
    -ResourceGroupName "myAzureResourceGroup" `
    -Name "myVM02" `
    -Location "China East 2" `
    -subnetname backendSubnet `
    -VirtualNetworkName "myAzureVnet" `
    -addressprefix 10.2.0.0/24 `
    -OpenPorts 3389

Creating a virtual machine will take a few minutes to complete.

Create an additional DNS record

You create record sets by using the New-AzPrivateDnsRecordSet cmdlet. The following example creates a record with the relative name db in the DNS Zone private.contoso.com, in resource group MyAzureResourceGroup. The fully qualified name of the record set is db.private.contoso.com. The record type is "A", with IP address "10.2.0.4", and the TTL is 3600 seconds.

New-AzPrivateDnsRecordSet -Name db -RecordType A -ZoneName private.contoso.com `
   -ResourceGroupName MyAzureResourceGroup -Ttl 3600 `
   -PrivateDnsRecords (New-AzPrivateDnsRecordConfig -IPv4Address "10.2.0.4")

View DNS records

To list the DNS records in your zone, run:

Get-AzPrivateDnsRecordSet -ZoneName private.contoso.com -ResourceGroupName MyAzureResourceGroup

Test the private zone

Now you can test the name resolution for your private.contoso.com private zone.

Configure VMs to allow inbound ICMP

You can use the ping command to test name resolution. So, configure the firewall on both virtual machines to allow inbound ICMP packets.

Connect to myVM01 using the username and password you used when creating the VM.
Open a Windows PowerShell window with administrator privileges.

Run the following command:

New-NetFirewallRule –DisplayName "Allow ICMPv4-In" –Protocol ICMPv4

Repeat for myVM02.

Ping the VMs by name

From the myVM02 Windows PowerShell command prompt, ping myVM01 using the automatically registered host name:

ping myVM01.private.contoso.com

You should see an output that looks similar to what is shown below:

PS C:\> ping myvm01.private.contoso.com

Pinging myvm01.private.contoso.com [10.2.0.4] with 32 bytes of data:
Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
Reply from 10.2.0.4: bytes=32 time=1ms TTL=128
Reply from 10.2.0.4: bytes=32 time<1ms TTL=128
Reply from 10.2.0.4: bytes=32 time<1ms TTL=128

Ping statistics for 10.2.0.4:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 1ms, Average = 0ms
PS C:\>

Now ping the db name you created previously:

ping db.private.contoso.com