Public and private endpoints, Azure DNS

Azure DNS

DNS (the Domain Name System) turns names people can remember, such as www.example.com, into the IP addresses computers use.

Azure DNS hosts your DNS domains on Microsoft's global network of name servers:

• Reliable and fast: answers come from the nearest name server.
• Secure: access is controlled with Azure role-based access control (RBAC), changes are logged, and resource locks can stop accidental deletion.
• Easy to manage: manage DNS records with the same tools and billing as your other Azure resources.
• Private DNS zones resolve names inside your virtual networks.
• Alias records point directly at Azure resources, such as a public IP address, and update automatically if the address changes.

Public endpoints

Many Azure PaaS services, such as Azure Storage and Azure SQL Database, are reachable by default through a public endpoint: an address on the internet. Access is protected by authentication and firewall rules, but the address itself is public.

Private endpoints

A private endpoint gives an Azure service a private IP address inside your virtual network. Traffic from your network to the service then:

• travels over the Microsoft backbone network, not the internet,
• can be reached from on-premises networks through VPN Gateway or ExpressRoute,
• lets you disable public access to the service completely.

Private endpoints are built on Azure Private Link.