DNS¶
DNS has two jobs on the platform. Public DNS publishes the organisation's domains to the internet. Private DNS lets resources inside Azure resolve private endpoints to private addresses. They are managed separately and have different owners.
Status: public DNS in place, private DNS planned
Public DNS (in place)¶
The public zone grinntec.net is an Azure DNS zone in networking-prod-westeu-00. It is managed in Terraform through the terraform-azurerm-dns-zone module, and holds the website CNAME, mail (MX) records and other service records.
| Rule | Why |
|---|---|
| Records are managed only in Terraform | A record changed in the portal is overwritten on the next apply, and has no review trail |
| CNAME targets are literal hostnames | The DNS deployment can't read other workloads' state. If a target, such as a Static Web App's default hostname, changes, the record must be updated by hand. |
| Delete locks on the zone | Losing the zone takes down every service on the domain |
| Short TTLs (300 seconds) for records that may move | Faster cut-over when a target changes |
Private DNS (planned)¶
When private endpoints arrive, each PaaS service needs a private DNS zone, for example privatelink.blob.core.windows.net or privatelink.vaultcore.azure.net, so its name resolves to the private IP address.
| Decision | Standard |
|---|---|
| Where the zones live | Centrally, in connectivity-prod-westeu-00. Never in workload subscriptions. Duplicate zones break resolution. |
| How VNets use them | Linked to the hub VNet. Spokes use the hub's DNS Private Resolver as their DNS server. |
| How records are created | Azure Policy (DeployIfNotExists) adds each new private endpoint to the right central zone automatically. The built-in policies for private DNS zone integration do this. |
| On-premises resolution | Conditional forwarders from on-premises DNS to the resolver's inbound endpoint, if connectivity exists |
Doing this centrally is the main reason private DNS belongs to the platform rather than to workloads. Each team creating its own privatelink zones is a common and painful mistake to undo.