Delegation of DNS zones with Azure DNS
Azure DNS allows you to host a DNS domain and manage the DNS zone records. To host your domain in Azure, the zone must be created in Azure and delegated to Azure's authoritative DNS servers with a domain registrar. Azure DNS isn't the domain registrar. This article explains how domain delegation works and how to delegate domains to Azure DNS.
Also see: Tutorial: Host your domain in Azure DNS.
The Domain Name System (DNS) is a hierarchy of domains. The hierarchy starts from the root
domain, whose name is simply ".
". Below this are top-level domains, such as com
, net
, org
, uk
or jp
. Below these top-level domains are second-level domains, such as org.uk
or co.jp
. And so on. The domains in the DNS hierarchy exist as separate DNS zones. These zones are globally distributed and hosted by DNS name servers around the world.
DNS zone - A public DNS zone has a unique name (for example: contoso.com) and consists of a collection of resource records. The DNS zone hosts DNS resource records of varying types. For example, the domain contoso.com
can contain DNS records such as mail.contoso.com
(for a mail server) and www.contoso.com
(for a website).
Domain registrar - A domain registrar is an organization that can provide Internet (public) domain names. They verify if the Internet domain you want to use is available and provide the ability to purchase it. When you register a domain name, you're the legal owner for that domain. If you already have an Internet domain, you can use your current domain registrar to delegate this domain to Azure DNS.
For more information about accredited domain registrars, see ICANN-Accredited Registrars.
There are two types of DNS servers:
- An authoritative DNS server hosts DNS zones. It answers DNS queries for records in those zones only.
- A recursive DNS server doesn't host DNS zones. It answers all DNS queries by calling authoritative DNS servers to gather the data it needs.
Azure DNS provides an authoritative DNS service. It doesn't provide a public recursive DNS service. For information about Azure's private DNS recursive service, see What is Azure DNS Private Resolver. By default, cloud services and VMs in Azure are configured to use a recursive DNS service that is provided separately as part of Azure's infrastructure. For information on how to change these DNS settings, see Name Resolution in Azure.
DNS clients in PCs or mobile devices typically call a recursive DNS server to do any DNS queries the client applications need.
When a recursive DNS server receives a query for a DNS record such as www.contoso.com
, it first needs to find the authoritative name server hosting the contoso.com
domain. To find the name server, it starts at the root name servers, and from there finds the name servers hosting the com
domain. It then queries the com
name servers to find the name servers hosting the contoso.com
domain. Finally, it's able to query these name servers for www.contoso.com
.
This procedure is called resolving the DNS name. Strictly speaking, DNS resolution includes more steps such as following CNAMEs, but that's not important to understanding how DNS delegation works.
How does a parent zone point to the name servers for a child zone? It does this using a special type of DNS record called an NS record (NS stands for 'name server'). For example, the root zone contains NS records for com
and shows the name servers for the com
domain. In turn, the com
domain contains NS records for contoso.com
that display name servers for the contoso.com
domain. Setting up the NS records for a child zone in a parent zone is called delegating the domain.
The following image shows an example DNS query. The contoso.net
and partners.contoso.net
zones are public DNS domains that have been delegated to Azure's authoritative DNS servers.
- The client requests
www.partners.contoso.net
from their local DNS server. - The local DNS server doesn't have the record so it makes a request to the root name server.
- The root name server doesn't have the record, but knows the address of the
.net
name server, which it provides to the local DNS server - The local DNS server sends the request to the
.net
name server. - The
.net
name server doesn't have the record but does know the address of thecontoso.net
name server. In this case, it responds with the address of the name server for the DNS domain hosted in Azure DNS. - The local DNS server sends the request to the name server for the
contoso.net
domain hosted in Azure DNS. - The zone
contoso.net
doesn't have the record but knows the name server forpartners.contoso.net
and responds with the address. In this case, it's a DNS domain hosted in Azure DNS. - The local DNS server sends the request to the name server for the
partners.contoso.net
domain. - The
partners.contoso.net
zone has the A record forwww
and responds with the IP address. - The local DNS server provides the IP address to the client.
- The client connects to the website
www.partners.contoso.net
.
Each delegation actually has two copies of the NS records; one in the parent zone pointing to the child, and another in the child zone itself. The contoso.net
zone contains the NS records for contoso.net
(in addition to the NS records in net
). These records are called authoritative NS records and they sit at the apex of the child zone.
Learn how to delegate your domain to Azure DNS