Good day, Cloud Gurus, and welcome back.
In this lesson,
we're going to take an introductory look at Azure DNS.
Let's take a look at what we're going to cover.
First up, we'll cover off Virtual Network Name Resolution
and then we'll take a high-level look
at the Azure DNS services
and we'll do a demo of Azure Public DNS
and finally, we'll dive a little bit deeper
into Azure Private DNS Zones
and explore some of the gotchas and take a look at a demo.
Let's get started.
When you deploy virtual machines to an Azure Virtual Network
you can configure DNS using one of 3 options.
Firstly, you can use Azure provided DNS
where all the DNS records for your Azure resources
are managed automatically by Azure.
But if you need more control
you can use Azure Private DNS zones,
which allow you to choose a custom DNS domain name
for name resolution within your Azure Virtual Networks.
And we'll take a closer look at private DNS zones
later in this lesson.
Now for both of these methods,
Azure provides a recursive DNS resolver
that can resolve both private DNS
and public DNS for your virtual network
through the 168.63.129.16 virtual IP address.
And this IP address is a special Azure IP address
that's also used for a range of other Azure services.
And the last option is to use your own DNS servers
running on virtual machines.
You can deploy one or more VMs
and configure your VMs to use those servers for DNS.
And these DNS servers can also be domain controllers.
And you can always use forwarders
to send all recursive DNS traffic
from your DNS servers to the Azure DNS resolver.
Now when configuring DNS, you can configure your DNS servers
on the virtual network so that all the VMs
in the virtual network have the same DNS servers configured
or you can configure the DNS servers
on the network interface
so that you can have individual DNS servers
configured per VM.
When you configure DNS servers on the network interface,
that setting overrides the virtual network setting.
And it's recommended to configure at least 2 DNS servers
for high availability
when you're specifying your own custom DNS servers.
Now Azure provides 2 services for hosting your DNS zones.
The first is Azure public DNS,
and it allows you to provide name resolution
for internet-facing domains.
You'll use Azure public DNS
to host your organization's DNS domains.
They also provide private DNS zones.
And private DNS zones provide registration
and name resolution for VMs within a virtual network
and it also works between virtual networks.
VMs can register their records automatically with the zone
and use the zone to locate other VMs.
There are some limitations with Azure DNS, though,
and this applies to both private and public zones.
Conditional forwarding is currently not supported
and Azure DNS does not currently support
Domain Name Security Extensions or DNSSEC,
and zone transfers to separate secondary DNS servers
outside of Azure DNS is not currently supported.
All right, let's take a quick look at a demo
of Azure public DNS and then we'll come back
and take a closer look at Azure private DNS.
All right, so here we are on the Azure portal.
Let's go ahead and create a public DNS zone.
So we'll go ahead and search for DNS
and we'll select DNS Zones.
We'll go ahead and click Create
and we'll select our existing resource group
and then we'll provide a name for our DNS zone.
We're going to use barrierreefaudio.com
and we don't need to provide a location,
so we'll go ahead and select Review and Create.
This will just take a moment,
so I'll come back when this is done.
All right, the deployment is now complete,
so we'll select Go to Resource
and let's go ahead and create an A record.
So we'll go ahead and select Create Record Set
and we're going to use test.barrierreefaudio.com.
We're creating an A record.
We'll leave the default time to live
and we'll just enter in an IP address.
Go ahead and click OK.
All right, now let's test this DNS zone
and to do that, we're going to jump over to our Windows VM
and we'll just query directly
against one of these name servers.
So I'm going to copy the host name for name server one
and we'll jump across to our virtual machine.
All right, and we'll use
the Resolve-DNSName PowerShell cmdlet
to test this DNS zone.
So we'll use Resolve-DNSName,
we'll specify the name test.barrierreefaudio.com,
and then we'll specify the server as the name server
we copied from the portal.
All right, and we're successfully able to resolve that name
by directly querying one of the authoritative DNS servers.
Now the next step after creating a public DNS zone
would normally be to update your name servers
at your domain registrar
using the Azure provider DNS servers.
But because this was just for demo purposes
we're not going to go ahead and do that.
Let's jump back and take a look at Private DNS Zones.
Azure private DNS zones can be linked
to Azure Virtual Networks to enable the virtual network
to resolve resource records in the private DNS zone,
and VMs must be configured
either through their network interface
or the virtual network to use the Azure provided DNS
to resolve resource records in that zone.
And a virtual network can be linked
to any number of private DNS zones
and a private DNS zone can be linked
to any number of virtual networks.
Autoregistration can be configured on the link
between the private DNS zone and the virtual network,
and autoregistration enables VMs to register
an A record for their host name in the zone.
But autoregistration is limited to one virtual network link
per virtual network.
That means that you can't have your virtual machines
automatically register their DNS records
in multiple private DNS zones.
Now you can link 2 separate virtual networks
to the same private DNS zone.
But without virtual network peering,
the virtual networks would be able to resolve the records,
but wouldn't be able to communicate with the VM
on the other virtual network.
And you can also perform reverse lookups
for resources within the same VNet.
But reverse lookups do not work across VNets,
even where peering exists.
Now let's take a look at a demo of private DNS zones.
In this demo environment we have 2 virtual networks
and each virtual network has a single VM, VM1 and VM2,
and the two virtual networks are connected
using virtual network peering,
enabling the VMs to communicate with each other.
In this demo we'll configure a private DNS zone
and we'll link each of the virtual networks
to the private zone and enable autoregistration.
And then we'll log onto VM1
and test some of these concepts out,
including autoregistration, intervene at name resolution,
and reverse lookups.
Let's take a look.
All right, here we are in the Azure portal
and I've never guided through the resource group
that contains all of the resources that we're going to use.
First I want to show you the virtual networks.
So we'll navigate to the first virtual network we have
and then we'll navigate to Peerings.
And this indicates that our australiaeast virtual network
is connected via our virtual network peering
to our australiasoutheast virtual network.
All right, now let's go ahead and create a private DNS zone.
We'll search for DNS and we'll select Private DNS Zones.
We'll go ahead and click Create.
I'm going to select our existing resource group
and now I'm going to provide a name for this DNS zone.
We're going to use az.barrierreefaudio.com.
We'll go ahead and click Review and Create
and then we can go ahead and click Create.
This will just take a moment to create
so we'll come back when this is done.
All right, our private DNS zone is now created.
So let's go ahead and navigate to the resource.
And then under Settings,
we're going to navigate to virtual network links
and let's link our two existing virtual networks.
So we'll select Add and we'll just provide a name
for this link. We're going to call this australiaeast
and then we're going to select our existing virtual network.
We'll enable autoregistration and then we'll click OK.
We'll go ahead and repeat this process
for the australiasoutheast virtual network.
Select our australiasoutheast virtual network,
Enable Autoregistration, and then click OK.
All right, this will just take a moment to deploy,
so we'll come back when this is done.
All right, the deployment is now complete
and our 2 virtual networks are linked
to this private DNS zone.
Now let's navigate back to the Overview tab
and see if our virtual machines
have registered their DNS records with the zone.
All right, and we can see here VM1 and VM2
have both registered their A records in this DNS zone.
Let's jump over to VM1
and see if we can resolve any of these DNS records.
All right, so here we are on VM1.
Let's see if we can resolve vm1.az.barrierreefaudio.com
and that's successful.
Let's see if we can resolve VM2,
and as expected, that worked.
Now let's do a DNS lookup using the IP address of VM1
and see if we can perform a reverse lookup for VM1,
and we can see we're successfully able to resolve
the host name for VM1
and it's providing us with a PTR record.
Now let's try and do a reverse lookup for VM2,
and as we can see here as expected,
we can't do a reverse lookup for VM2 because it's located
in a separate virtual network, and reverse lookups only work
within the same virtual network.
All right, that concludes this demo,
let's go and wrap up with a bit of a summary
for what we've covered in this lesson.
All right, so what have we covered in this lesson?
Azure Public DNS zones provide name resolution
for internet-facing DNS domains.
And Azure Private DNS zones provide registration
and name resolution for VMs within a virtual network.
And you can enable autoregistration
so virtual machines automatically register
their DNS records with a linked private DNS zone,
and autoregistration can only be enabled
in 1 private DNS zone per VNet.
And reverse lookups can be performed
within the same virtual network.
All right, that concludes this lesson,
thanks for being with me
and I hope you found it useful,
and I look forward to seeing you in the next lesson.