Azure DNS
What does zop.dev create for Azure DNS?
zop.dev provisions an Azure DNS zone with CAA records applied by default and NS delegation written into the organization's master zone on GCP Cloud DNS. Delegation follows the same cross-cloud pattern as AWS Route 53 and OCI. A zone bills roughly 0.50 USD per month plus per-query charges.
| Field | Value |
|---|---|
| Cloud | azure |
Azure DNS hosts per-environment zones on Azure. zop.dev provisions the zone with CAA records and delegates it into the organization’s GCP master zone.
Zone, CAA records, and NS delegation
DNS zone, CAA records, and NS delegation into the GCP-hosted master zone.
Zone name with CAA and delegation preset
Zone name; CAA and delegation records applied by default.The same delegation pattern as Route 53 and OCI
Same cross-cloud delegation pattern as AWS Route 53 and OCI DNS.
Resolution depends on two clouds
The zone lives in Azure; its delegation lives in a GCP-hosted master zone. Every lookup for an Azure environment’s names starts at Google nameservers and follows NS records down to Azure DNS. That chain is invisible while it works and baffling when it does not: an environment “on Azure” can lose name resolution because of an edit in a GCP project, and no amount of Azure-side inspection will show why. When DNS breaks for a zone provisioned here, the delegation records in the master zone are the second thing to check.
The pattern is deliberate: one master zone per organization, with per-environment zones on whichever cloud the environment runs. The trade is a single cross-cloud dependency in exchange for every environment’s DNS being visible from one root.
CAA decides who may issue certificates
CAA records go in by default, allowlisting the certificate authorities that may issue for names in the zone. The security value is real. A CA not on the list cannot issue for your domain, mis-issuance included. The operational cost is that the failure lives far from its cause: a team adopting a new certificate provider sees issuance fail with an opaque error in their ACME tooling, and the fix is a DNS record. Check CAA before debugging the client.
Small line item, long tail
Azure DNS bills about 0.50 USD per zone per month plus query charges, negligible per zone but noticeable as per-environment zones accumulate. The sharper reason to tear down stale zones is hygiene: a zone that outlives its environment keeps resolving, and records pointing at released IPs or deleted services are the raw material of subdomain takeovers. Environment teardown should delete the zone and its delegation records in the master zone together.