Azure DNS

Manage public and private DNS zones and their A records, link a private zone to a virtual network, and create a DNS resolver with an inbound endpoint.

Plan: Pro89 of 89 operations implemented across 3 APIs

Zones, records and resolvers are stored and returned; answering queries, resolution, forwarding and auto-registration weren't established.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Start Vera as in Get started, with your license key activated and the emulator started by the Vera launcher (Activate Pro). Then open Bash in a terminal of its own (on macOS, whose terminal starts zsh, type bash first), go to an empty scratch directory and run this; it needs curl and Python 3. It fetches the emulator's own certificate, so every request checks TLS, and defines arm, which this page's commands use. The bearer token vera-local is a dummy local credential, not your license key.

export VERA_CA_CERT="$PWD/vera-ca.pem"
curl --fail --silent --show-error --noproxy '*' --insecure \
  https://localhost:8543/_vera/ca.pem --output "$VERA_CA_CERT"
curl --fail --silent --show-error --noproxy '*' \
  --cacert "$VERA_CA_CERT" https://localhost:8543/_vera/health; echo

export AZ_BASE='https://localhost:8543'
export SUB='00000000-0000-0000-0000-000000000001'
export TENANT='00000000-0000-0000-0000-0000000000a1'
export TOKEN='vera-local'

62 more lines: show the full setup
# arm METHOD /path API_VERSION [body.json]
# Prints the response body once any operation it started has finished, or,
# if that response had no body, the finished operation's response, such as
# a RunCommand result. A finished operation can hold a failed result: read it.
arm() (
  set -eu
  method=$1; path=$2; version=$3
  work=$(mktemp -d)
  trap 'rm -rf "$work"' EXIT
  case "$path" in /*) ;; *) printf 'Expected a relative /path\n' >&2; exit 1;; esac
  case "$AZ_BASE" in https://localhost:8543|https://127.0.0.1:8543) ;; *) printf 'This recipe requires the local emulator\n' >&2; exit 1;; esac
  args=(--fail-with-body --silent --show-error --noproxy '*' --max-time 20
        --cacert "$VERA_CA_CERT" -H "Authorization: Bearer $TOKEN"
        -H 'Content-Type: application/json')
  body=()
  if [ "$#" -ge 4 ]; then body=(--data-binary "@$4"); fi
  code=$(curl "${args[@]}" -X "$method" ${body[@]+"${body[@]}"} -D "$work/headers" \
    -o "$work/body" -w '%{http_code}' "$AZ_BASE$path?api-version=$version") || {
      cat "$work/body" >&2; exit 1;
    }
  poll_url=$(python3 - "$work/headers" "$AZ_BASE" <<'PY'
import sys,urllib.parse
headers={}
for line in open(sys.argv[1]):
    if ':' in line:
        key,value=line.split(':',1); headers[key.lower()]=value.strip()
url=headers.get('azure-asyncoperation') or headers.get('operation-location') or headers.get('location') or ''
if url:
    url=urllib.parse.urljoin(sys.argv[2],url); p=urllib.parse.urlsplit(url)
    if p.scheme!='https' or p.hostname not in ('localhost','127.0.0.1') or p.port!=8543:
        raise SystemExit('Refusing a non-local operation URL')
print(url)
PY
  ) || exit 1
  if [ -n "$poll_url" ] && [ "$method" != GET ] && [ "$method" != HEAD ]; then
    done_ok=false
    for attempt in $(seq 1 30); do
      code=$(curl "${args[@]}" -D "$work/poll-headers" -o "$work/poll-body" -w '%{http_code}' "$poll_url") || {
        cat "$work/poll-body" >&2; exit 1;
      }
      state=$(python3 - "$work/poll-body" "$code" <<'PY'
import sys,json
raw=open(sys.argv[1]).read(); code=int(sys.argv[2]); value=json.loads(raw) if raw.strip() else {}
status=str(value.get('status') or value.get('properties',{}).get('provisioningState') or '').lower()
if status in ('failed','canceled','cancelled') or value.get('error'):
    print(raw,file=sys.stderr);raise SystemExit('Operation failed')
if status in ('succeeded','completed') or (not status and code in (200,204)):
    print('done')
else: print('pending')
PY
      ) || exit 1
      if [ "$state" = done ]; then done_ok=true; break; fi
      sleep 1
    done
    if [ "$done_ok" != true ]; then printf 'Operation polling timed out\n' >&2; exit 1; fi
    if [ -s "$work/poll-body" ] && ! grep -q '[^[:space:]]' "$work/body" 2>/dev/null; then
      cp "$work/poll-body" "$work/body"
    fi
  fi
  cat "$work/body"
  printf '\n'
)

The health check answers {"cloud": "azure", "generation_status": "generated", "status": "ok"}. Requests go only to the emulator at https://localhost:8543: the helper refuses any other address, including the Azure-looking URLs some responses hold. When you've finished, close the terminal and delete the scratch directory; that removes only these local files, not what you created in the emulator.

Azure DNS is three APIs, each with its own version. The examples use the versions tested with this build: 2018-05-01 for public zones (Microsoft.Network/dnsZones), 2024-06-01 for private zones (Microsoft.Network/privateDnsZones) and 2025-05-01 for DNS Private Resolver (Microsoft.Network/dnsResolvers). They also use 2026-03-01 for a virtual network and 2025-04-01 for the resource group. Keep those versions: others weren’t tested.

Example

Create a resource group for the example, then a public zone, example.test, with an A record, www, that points at 192.0.2.10. Zones use the location global.

RG="docs-azure-dns"
RGID="/subscriptions/$SUB/resourceGroups/$RG"
ZONE="$RGID/providers/Microsoft.Network/dnsZones/example.test"
cat > resource-group.json <<'JSON'
{"location": "eastus"}
JSON
arm PUT "$RGID" 2025-04-01 resource-group.json

cat > zone.json <<'JSON'
{"location": "global"}
JSON
arm PUT "$ZONE" 2018-05-01 zone.json

cat > record.json <<'JSON'
{"properties": {"TTL": 300, "ARecords": [{"ipv4Address": "192.0.2.10"}]}}
JSON
arm PUT "$ZONE/A/www" 2018-05-01 record.json

The zone and the record each answer HTTP 201. Read them back:

arm GET "$ZONE/A/www" 2018-05-01
arm GET "$ZONE" 2018-05-01

Both reads answer HTTP 200, and arm prints the record and the zone. The name servers a zone lists are metadata: nothing answers DNS queries on them, so don’t delegate a real domain to them or point your machine’s DNS at them.

To clean up, delete the record, then the zone. The zone’s delete answers HTTP 202, and arm waits for its operation to finish.

arm DELETE "$ZONE/A/www" 2018-05-01
arm DELETE "$ZONE" 2018-05-01

The resource group stays, because deleting resource groups fails in Vera 1.2.2. A fresh emulator starts without it.

Private zone, network link and resolver

This continues in the same shell, in the example’s resource group. Create a virtual network with a subnet, resolver, then a private zone, private.example.test, with an A record, app. Link the zone to the network with auto-registration off. Private record sets spell their fields ttl and aRecords, where public ones use TTL and ARecords. The link’s body refers to the network by ID, so it’s written with an unquoted heredoc that fills in $VNET.

VNET="$RGID/providers/Microsoft.Network/virtualNetworks/docs-vnet"
PRIVATE="$RGID/providers/Microsoft.Network/privateDnsZones/private.example.test"
cat > vnet.json <<'JSON'
{
  "location": "eastus",
  "properties": {
    "addressSpace": { "addressPrefixes": ["10.20.0.0/16"] },
    "subnets": [
      { "name": "resolver", "properties": { "addressPrefix": "10.20.1.0/24" } }
    ]
  }
}
JSON
arm PUT "$VNET" 2026-03-01 vnet.json

cat > private-zone.json <<'JSON'
{"location": "global"}
JSON
arm PUT "$PRIVATE" 2024-06-01 private-zone.json

cat > private-record.json <<'JSON'
{"properties": {"ttl": 300, "aRecords": [{"ipv4Address": "10.20.1.20"}]}}
JSON
arm PUT "$PRIVATE/A/app" 2024-06-01 private-record.json
arm GET "$PRIVATE/A/app" 2024-06-01

cat > link.json <<JSON
{
  "location": "global",
  "properties": {
    "virtualNetwork": { "id": "$VNET" },
    "registrationEnabled": false
  }
}
JSON
arm PUT "$PRIVATE/virtualNetworkLinks/docs-link" 2024-06-01 link.json

The private zone and the link each answer HTTP 202, and arm polls their operations until they succeed. The record answers HTTP 201, and its read HTTP 200.

Then create a DNS resolver on the network, and an inbound endpoint on its resolver subnet with a dynamically assigned address. Each answers HTTP 201 with an operation to poll, which arm follows.

RESOLVER="$RGID/providers/Microsoft.Network/dnsResolvers/docs-resolver"
cat > resolver.json <<JSON
{
  "location": "eastus",
  "properties": { "virtualNetwork": { "id": "$VNET" } }
}
JSON
arm PUT "$RESOLVER" 2025-05-01 resolver.json
arm GET "$RESOLVER" 2025-05-01

cat > inbound.json <<JSON
{
  "location": "eastus",
  "properties": {
    "ipConfigurations": [
      {
        "privateIpAllocationMethod": "Dynamic",
        "subnet": { "id": "$VNET/subnets/resolver" }
      }
    ]
  }
}
JSON
arm PUT "$RESOLVER/inboundEndpoints/docs-inbound" 2025-05-01 inbound.json
arm GET "$RESOLVER/inboundEndpoints/docs-inbound" 2025-05-01

Both reads answer HTTP 200. The address the endpoint is given is metadata too: no DNS server listens on it.

To clean up, delete each child before its parent: the inbound endpoint, the resolver, the link, the private record and the private zone, then the virtual network. arm waits for each delete’s operation before the next line runs.

arm DELETE "$RESOLVER/inboundEndpoints/docs-inbound" 2025-05-01
arm DELETE "$RESOLVER" 2025-05-01
arm DELETE "$PRIVATE/virtualNetworkLinks/docs-link" 2024-06-01
arm DELETE "$PRIVATE/A/app" 2024-06-01
arm DELETE "$PRIVATE" 2024-06-01
arm DELETE "$VNET" 2026-03-01

Supported features

Public DNS zones and A record sets (2018-05-01): create, read and delete.
Private DNS zones and A record sets (2024-06-01): zones created and deleted, record sets created, read and deleted.
Virtual network links from a private zone to a virtual network, with auto-registration off: create and delete.
DNS Private Resolver (2025-05-01): a resolver on a virtual network, and an inbound endpoint with a dynamic address on one of its subnets, each created, read and deleted.
Long-running operations. Private zones, links, resolvers and inbound endpoints return an operation to poll when they’re created, and so do their deletes and the public zone’s. arm follows each to completion.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

Management only. DNS query serving wasn’t established in this test environment. Recursive resolution, public delegation, forwarding, DNS for linked virtual networks, auto-registration and DNS policy enforcement weren’t demonstrated. Name servers and endpoint addresses in responses are metadata: don’t delegate a real domain to them or point your machine’s DNS at them.
Only the resources above were tested. Record types other than A, listing and updating zones, reading a private zone or a link, outbound endpoints, forwarding rulesets and DNS resolver policies weren’t run as examples. The API coverage marks them from a review of Vera 1.2.0’s source, with their limits in the notes.

API coverage

Every operation of the APIs on this page, from their pinned public definitions, and whether Vera 1.2.0 implements it. Only the API surfaces in this release are listed, and each operation once. Implementation availability was reviewed against the Vera 1.2.0 source on 6 November 2026. Source inspection identifies a local implementation and its known limits; it doesn't mean every operation or API version was tested with a request. Each note names its evidence: a Local observation without a build or date is from Vera 1.2.0 preview, on 5 November 2026, and one from a later build, such as Vera 1.2.0-rc.3 or Vera 1.2.2, names that build and its date. No response was compared with Azure's. What the statuses mean

DNS zones 2018-05-01Plan: Pro

14 of 14 implemented

Version 2018-05-01, from the Azure REST API specifications at commit 21bbf1b.

DnsResourceReference

1 of 1 implemented

Operation	Status	Notes
DnsResourceReference_GetByTargetResources	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

RecordSets

7 of 7 implemented

Operation	Status	Notes
RecordSets_CreateOrUpdate	Implemented	Local observation: A PUT of an A record set with `TTL` 300 and one address in `ARecords` answered HTTP 201.
RecordSets_Delete	Implemented	Local observation: Deleting the A record set answered HTTP 200.
RecordSets_Get	Implemented	Local observation: Reading the A record set answered HTTP 200.
RecordSets_ListAllByDnsZone	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
RecordSets_ListByDnsZone	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
RecordSets_ListByType	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
RecordSets_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

Zones

6 of 6 implemented

Operation	Status	Notes
Zones_CreateOrUpdate	Implemented	Local observation: A PUT of a public zone with location global answered HTTP 201.
Zones_Delete	Implemented	Local observation: Deleting the zone after its A record set answered HTTP 202, and the operation completed.
Zones_Get	Implemented	Local observation: Answered HTTP 200. The name servers it lists are metadata; no DNS server answers on them.
Zones_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
Zones_ListByResourceGroup	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
Zones_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

DNS Private Resolver 2025-05-01Plan: Pro

58 of 58 implemented

Version 2025-05-01, from the Azure REST API specifications at commit 21bbf1b.

DnsForwardingRulesets

7 of 7 implemented

Operation	Status	Notes
DnsForwardingRulesets_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsForwardingRulesets_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsForwardingRulesets_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsForwardingRulesets_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsForwardingRulesets_ListByResourceGroup	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsForwardingRulesets_ListByVirtualNetwork	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsForwardingRulesets_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

DnsResolverDomainLists

7 of 7 implemented

Operation	Status	Notes
DnsResolverDomainLists_Bulk	Implemented	Source inspection: Runs as a local action; an external engine running it isn't established. Local DNS management records; serving DNS queries isn't established.
DnsResolverDomainLists_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverDomainLists_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverDomainLists_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverDomainLists_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverDomainLists_ListByResourceGroup	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverDomainLists_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

DnsResolverPolicies

7 of 7 implemented

Operation	Status	Notes
DnsResolverPolicies_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicies_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicies_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicies_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicies_ListByResourceGroup	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicies_ListByVirtualNetwork	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicies_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

DnsResolverPolicyVirtualNetworkLinks

5 of 5 implemented

Operation	Status	Notes
DnsResolverPolicyVirtualNetworkLinks_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicyVirtualNetworkLinks_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicyVirtualNetworkLinks_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicyVirtualNetworkLinks_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolverPolicyVirtualNetworkLinks_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

DnsResolvers

7 of 7 implemented

Operation	Status	Notes
DnsResolvers_CreateOrUpdate	Implemented	Local observation: A PUT of a resolver on a virtual network answered HTTP 201 with an operation to poll, and the operation succeeded.
DnsResolvers_Delete	Implemented	Local observation: Deleting the resolver after its inbound endpoint answered HTTP 202, and the operation completed.
DnsResolvers_Get	Implemented	Local observation: Answered HTTP 200.
DnsResolvers_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolvers_ListByResourceGroup	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolvers_ListByVirtualNetwork	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsResolvers_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

DnsSecurityRules

5 of 5 implemented

Operation	Status	Notes
DnsSecurityRules_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsSecurityRules_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsSecurityRules_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsSecurityRules_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
DnsSecurityRules_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

ForwardingRules

5 of 5 implemented

Operation	Status	Notes
ForwardingRules_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
ForwardingRules_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
ForwardingRules_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
ForwardingRules_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
ForwardingRules_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

InboundEndpoints

5 of 5 implemented

Operation	Status	Notes
InboundEndpoints_CreateOrUpdate	Implemented	Local observation: A PUT with one dynamic IP configuration on a subnet of the resolver's virtual network answered HTTP 201 with an operation to poll, and the operation succeeded.
InboundEndpoints_Delete	Implemented	Local observation: Answered HTTP 202, and the operation completed.
InboundEndpoints_Get	Implemented	Local observation: Answered HTTP 200. Its assigned address is metadata; no DNS server listens on it.
InboundEndpoints_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
InboundEndpoints_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

OutboundEndpoints

5 of 5 implemented

Operation	Status	Notes
OutboundEndpoints_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
OutboundEndpoints_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
OutboundEndpoints_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
OutboundEndpoints_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
OutboundEndpoints_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

VirtualNetworkLinks

5 of 5 implemented

Operation	Status	Notes
VirtualNetworkLinks_CreateOrUpdate	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
VirtualNetworkLinks_Delete	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
VirtualNetworkLinks_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
VirtualNetworkLinks_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
VirtualNetworkLinks_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

Private DNS zones 2024-06-01Plan: Pro

17 of 17 implemented

Version 2024-06-01, from the Azure REST API specifications at commit 21bbf1b.

PrivateZones

6 of 6 implemented

Operation	Status	Notes
PrivateZones_CreateOrUpdate	Implemented	Local observation: A PUT of a private zone with location global answered HTTP 202, and the operation succeeded.
PrivateZones_Delete	Implemented	Local observation: Deleting the zone after its A record set and virtual network link answered HTTP 202, and the operation completed.
PrivateZones_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
PrivateZones_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
PrivateZones_ListByResourceGroup	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
PrivateZones_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

RecordSets

6 of 6 implemented

Operation	Status	Notes
RecordSets_CreateOrUpdate	Implemented	Local observation: A PUT of an A record set using the lowercase `ttl` and `aRecords` fields answered HTTP 201.
RecordSets_Delete	Implemented	Local observation: Deleting the A record set answered HTTP 200.
RecordSets_Get	Implemented	Local observation: Reading the A record set answered HTTP 200.
RecordSets_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
RecordSets_ListByType	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
RecordSets_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.

VirtualNetworkLinks

5 of 5 implemented

Operation	Status	Notes
VirtualNetworkLinks_CreateOrUpdate	Implemented	Local observation: A PUT linking the zone to a virtual network with `registrationEnabled` false answered HTTP 202, and the operation succeeded. No DNS for the linked network was demonstrated.
VirtualNetworkLinks_Delete	Implemented	Local observation: Answered HTTP 202, and the operation completed.
VirtualNetworkLinks_Get	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
VirtualNetworkLinks_List	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.
VirtualNetworkLinks_Update	Implemented	Source inspection: Local DNS management records; serving DNS queries isn't established.