Azure Private DNS Zone
Does ZopNight manage Azure Private DNS Zone?
Azure private DNS zones bill a small per-zone monthly charge plus resolution queries, minor next to the private endpoints they usually serve. ZopNight discovers each zone via Resource Graph with its VNet-link context, because a private zone with zero VNet links is leftover private-link plumbing worth deleting.
Rules that fire on Azure Private DNS Zone
No active rule family targets Azure Private DNS Zone today. Rules that used to are retired, and retired rules publish no pages and fire no findings. Scheduling and permissions coverage are unaffected.
At a glance
| Field | Value |
|---|---|
| Scheduling notes | discovery only. |
Private DNS zones provide name resolution inside virtual networks, commonly paired with private endpoints. Billing is minor, but orphaned zones indicate leftover private-link plumbing.
Light metering for in-VNet name resolution
A private DNS zone bills a small monthly amount per zone plus charges on the queries resolved inside linked networks. On its own this is one of the cheapest resources Azure sells. Its cost significance is entirely relational: private zones exist almost exclusively to make private endpoints usable, translating a service’s public hostname to the endpoint’s private IP inside the VNet. Where there is a privatelink zone, there is usually an hourly-billed private endpoint nearby. Where there is a privatelink zone with nothing nearby, there was one once.
VNet links tell the real story
Discovered via Azure Resource Graph with VNet-link context for topology and cleanup review. The VNet link is the zone’s entire purpose: a private zone resolves only inside networks explicitly linked to it. So the link count is a direct liveness signal: linked zones with active records are part of a working private-link setup, while a zone whose links were removed, or whose linked VNets were deleted, can resolve names for nobody. Private DNS zones are discovery only; nothing about them schedules, stops, or resizes.
Leftover private-link plumbing
The characteristic waste pattern is the half-deleted private endpoint. Tearing down an endpoint through the portal often leaves its DNS artifacts: the privatelink zone, the A record pointing at a now-released private IP, and the VNet links. Each fragment is nearly free, but collectively they misdirect the next engineer. A record resolving to an IP that another resource has since claimed is a debugging session waiting to happen. Zones for services an organization stopped using (a retired Cosmos DB account, a decommissioned storage account) show the same residue.
Private zone review in the portal
Azure portal → Private DNS zones lists each zone with its record count and linked-network count. A zone showing 0 virtual network links has no consumers by construction, the clearest single indicator that its private-link setup is gone and the zone can follow.