Connect Azure DNS
RedundantDNS talks to Azure DNS as an app registration (service principal) with a client secret. The secret is encrypted with your organization's key as soon as it reaches us, is never shown again, and is only used to read and write the DNS zones you attach.
Pick the access level that matches how much you want to delegate:
| Access level | What RedundantDNS can do |
|---|---|
| Create and manage zones | Create public DNS zones in one resource group, write their records and apex NS, and delete a zone when you detach it (only after you type the zone name). |
| Manage an existing zone | Read and edit the records of one zone that you created. It never creates or deletes zones. |
1. Create an app registration and a secret
- Microsoft Entra ID → App registrations → New registration, name it
redundantdns, leave the redirect URI empty and click Register. - On its Overview copy the Application (client) ID and the Directory (tenant) ID.
- Certificates & secrets → Client secrets → New client secret; copy the secret Value right away (it is shown once).
- The subscription ID is under Subscriptions (the subscription that holds your DNS zones).
With the Azure CLI instead (prints appId, password and tenant):
az ad sp create-for-rbac --name redundantdns --skip-assignment
2a. Create and manage zones
Grant the built-in DNS Zone Contributor role on the resource group where the zones live (Resource groups → your group → Access control (IAM) → Add role assignment → DNS Zone Contributor → Members: redundantdns), or:
az role assignment create --assignee <client-id> \
--role "DNS Zone Contributor" \
--scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>
In RedundantDNS, Providers → Add connection: provider Azure DNS, access level Create and manage zones, fill in tenant ID, client ID, client secret, subscription ID and the resource group, then click Test and save. We check the credentials by listing the zones of the resource group.
2b. Manage an existing zone
Azure supports role assignments on a single zone. Assign DNS Zone Contributor scoped to the zone resource only (DNS zones → your zone → Access control (IAM) → Add role assignment), or:
az role assignment create --assignee <client-id> \
--role "DNS Zone Contributor" \
--scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Network/dnszones/<zone-name>
Scoped to the zone, the role edits that zone's record sets but cannot
create other zones. Add the connection with access level Manage an
existing zone (the resource group can stay empty). The credentials are
checked when you attach the connection to a zone: open the zone,
Providers → Attach, pick the connection and paste the zone's
resource ID (DNS zones → your zone → Properties → Resource ID,
starting with /subscriptions/). We verify that the zone holds the same
domain and that the credentials can read its record sets.
What RedundantDNS writes
- Every record set you manage in the dashboard (one update per record set, idempotent).
- The apex NS record set: RedundantDNS adds the nameservers of every attached provider to it, so each copy of the zone delegates to all of them. Azure's own nameservers always stay in the set (Azure does not allow removing them). It is shown read-only in the dashboard.
- It never touches the SOA record. Alias record sets (pointing at Azure resources) are left alone.
Limits that apply to every zone attached to Azure: at most 20 records per record set and 4,096 characters of TXT per record set.
Revoking access
Delete the client secret (or the app registration, or the role assignment) at any time. Then remove the connection in Providers; zones keep being served by Azure DNS exactly as they are.