Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Azure Private DNS

Configuration

This provider is for the Azure Private DNS Service. This provider can only manage Azure Private DNS zones and will not manage public Azure DNS zones. To use this provider, add an entry to creds.json with TYPE set to AZURE_PRIVATE_DNS along with the API credentials.

Example:

creds.json
{
  "azure_private_dns_main": {
    "TYPE": "AZURE_PRIVATE_DNS",
    "SubscriptionID": "AZURE_PRIVATE_SUBSCRIPTION_ID",
    "ResourceGroup": "AZURE_PRIVATE_RESOURCE_GROUP",
    "TenantID": "AZURE_PRIVATE_TENANT_ID",
    "ClientID": "AZURE_PRIVATE_CLIENT_ID",
    "ClientSecret": "AZURE_PRIVATE_CLIENT_SECRET"
  }
}

You can also use environment variables:

export AZURE_SUBSCRIPTION_ID=XXXXXXXXX
export AZURE_RESOURCE_GROUP=YYYYYYYYY
export AZURE_TENANT_ID=ZZZZZZZZ
export AZURE_CLIENT_ID=AAAAAAAAA
export AZURE_CLIENT_SECRET=BBBBBBBBB

Metadata

This provider does not recognize any special metadata fields unique to Azure Private DNS.

Usage

An example configuration:

Test credentials

If you want to create credentials without learning all about Entra ID (formerly AAD). Here's what I did. You will create an named API key (in this case, called dns-api-test) and give it access to the specific zones it should access. This is probably best for testing. For production use, you should understand Entra ID and set up proper access.

  1. Get a shell

  • Start the Azure Portal: https://portal.azure.com

  • Click the >_ Cloud Shell button at the top.

  • Choose Bash.

  1. Create an API key called dns-api-test

NOTE: You can use the same credential data for AZURE_DNS and AZURE_PRIVATE_DNS but creds.json must have a separate entry for each. All the fields except TYPE will be the same.

  1. Show the zone's acess path:

Use your own Resource Group in --resource-group and change the --name to the DNS zone name you created through the portal.

The /subscriptions/02efc9e4.... output is the path to this zone.

  1. Give your API key access to that zone

For AZURE_DNS the commands are slightly different.

Activation

DNSControl depends on a standard Client credentials Authentication with permission to list, create and update private zones.

New domains

If a domain does not exist in your Azure account, DNSControl will not automatically add it with the push command. You can do that manually via the control panel.

Caveats

The ResourceGroup is case sensitive.

Feature Summary

PreviousAzure DNSNextBIND

Last updated