Enabling Internal DNS Resolution for Secure Workloads (final)
Tags: azure, cloud, dns, microsoft
Published: 2024-07-17 22:00:35

**Introduction:**

In the final part of this [series](https://dev.to/jimiog/configuring-routes-for-azure-firewall-part-4-2p85), we'll configure internal DNS resolution for your Azure virtual network. This allows workloads within the network to resolve domain names privately, enhancing security and overall performance.

### Creating a Private DNS Zone

1. In the Azure portal search bar, type **Private DNS zones** and select it.
2. Click **+ Create**.

    ![Creating Private DNS Zone](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f7vhmm8hy8wctk5h3cju.jpg)

3. Configure the DNS zone settings as follows:
    * Resource group: Select the resource group created for your application resources in the previous guides.
    * Name: Choose a descriptive name for your DNS zone (e.g., **app-vnet-dns**).
    * Location: Select the same region as your application virtual network for optimal performance.
4. Click **Review + create** and then **Create** to deploy the private DNS zone.

    ![Configuring Private DNS Zone](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tuu4mgyzir7k49fv58w7.jpg)

### Linking the Virtual Network

1. Once the DNS zone is created, click on **Go to resource**.
2. Under **DNS management**, navigate to **Virtual Network Links** and click **Add**.

    ![Adding Virtual Network Link](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f3efgjimwx6moxm8zfsf.jpg)

3. Configure the virtual network link as follows:
    * Name: Choose a clear name for the link (e.g., **app-vnet-link**).
    * Virtual Network: Select the application virtual network you created earlier.
    * Enable auto-registration: Leave this enabled to automatically register resources within the virtual network with the DNS zone.
4. Click **Create** to establish the link.

    ![Configuring Virtual Network Link](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4pj39i6bxggbna7ll6eg.jpg)

### Creating a DNS Record Set

1. Within the private DNS zone, navigate to **DNS management** and select **Record sets**.
2. Click **Add** to create a new record set.

    ![Configuring Recordset](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/35ij78295dl4uuqpocib.jpg)

3. Configure the record set details:
    * Name: Enter the hostname you want to resolve internally (e.g., **webserver**).
    * Type: Choose **A** (record for hostnames).
    * TTL: Set the Time To Live (TTL) to a low value (e.g., 1 minute) for quicker updates.
    * Resource: Enter the private IP address of your web server.
4. Review the details and click **Add** to add the record set.

    ![Adding the record set](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3jqqdgcdlhv9yhhd62b6.jpg)

**Verification:**

With these steps, you've successfully configured a private DNS zone and linked it to your virtual network. Workloads within the network can now resolve domain names like "webserver" internally using the private IP address, promoting secure communication within the virtualized environment.

**Additional Notes:**

* Remember to create A records for all services you want to resolve internally within your virtual network.
* You can manage DNS records and settings within the private DNS zone for further customization.

**Conclusion:**

This series has guided you through the comprehensive process of securing your Azure web application. We began by creating virtual networks and subnets, establishing logical boundaries for your resources. We then implemented peering links to connect these virtual networks for controlled communication. Next, we configured Network Security Groups (NSGs) and Azure Firewall to meticulously control inbound and outbound traffic, safeguarding your application from external threats. Finally, we enabled internal DNS resolution, allowing workloads within the virtual network to communicate securely using private IP addresses and hostnames. By following these steps, you've built a robust security foundation for your Azure web application, ensuring its smooth operation and protection.