# Azure DNS

> zop.dev provisions an Azure DNS zone with CAA records applied by default and NS delegation written into the organization's master zone on GCP Cloud DNS. Delegation follows the same cross-cloud pattern as AWS Route 53 and OCI. A zone bills roughly 0.50 USD per month plus per-query charges.

Source: https://zop.dev/integrations/provision/azure/azure-dns
Updated: 2026-08-19

---

Azure DNS hosts per-environment zones on Azure. zop.dev provisions the zone with CAA records and delegates it into the organization's GCP master zone.

## Zone, CAA records, and NS delegation

DNS zone, CAA records, and NS delegation into the GCP-hosted master zone.

## Zone name with CAA and delegation preset

```text
Zone name; CAA and delegation records applied by default.
```

## The same delegation pattern as Route 53 and OCI

Same cross-cloud delegation pattern as AWS Route 53 and OCI DNS.

## Resolution depends on two clouds

The zone lives in Azure; its delegation lives in a GCP-hosted master zone. Every lookup for an
Azure environment's names starts at Google nameservers and follows NS records down to Azure
DNS. That chain is invisible while it works and baffling when it does not: an environment
"on Azure" can lose name resolution because of an edit in a GCP project, and no amount of
Azure-side inspection will show why. When DNS breaks for a zone provisioned here, the
delegation records in the master zone are the second thing to check.

The pattern is deliberate: one master zone per organization, with per-environment zones on
whichever cloud the environment runs. The trade is a single cross-cloud dependency in exchange
for every environment's DNS being visible from one root.

## CAA decides who may issue certificates

CAA records go in by default, allowlisting the certificate authorities that may issue for
names in the zone. The security value is real. A CA not on the list cannot issue for your
domain, mis-issuance included. The operational cost is that the failure lives far from its
cause: a team adopting a new certificate provider sees issuance fail with an opaque error in
their ACME tooling, and the fix is a DNS record. Check CAA before debugging the client.

## Small line item, long tail

Azure DNS bills about 0.50 USD per zone per month plus query charges, negligible per zone
but noticeable as per-environment zones accumulate. The sharper reason to tear down stale zones is
hygiene: a zone that outlives its environment keeps resolving, and records pointing at
released IPs or deleted services are the raw material of subdomain takeovers. Environment
teardown should delete the zone and its delegation records in the master zone together.