Azure DNS zone security

[nadsurf93]

Hi there,

I have been considering using Azure DNS.

I created a test tenant to try it out and configured an unused domain on it (say example.com).

It worked fine and I decided to start using it for my production/live domains.

I created a new 'production' tenant, a DNS zone on that tenant and added domain example.com

I realised that I was not asked to prove ownership of the domain (like you are asked when configuring a domain on O365).

So I have 2 tenants with DNS zones with the same domain!

However, the name servers on the 2nd tenant were different.

So, when I changed it at my domain registrar, I was able to get the records managed on the new tenant.

But that got me worried.

Anyone can create a tenant on Azure and create a DNS zone for domain example.com

Can anyone advise if there is a way to prevent this?

Update:
When I created the resource group on my production tenant, 1 selected a different region and I was thinking that this may be why the name servers are different.

So I deleted everything on my production tenant.

I created a new resource group and selected the same region as on the test tenant.

When I created a zone for example.com, the name servers were different from those on the test tenant.

So it does seem that there is some verification/control being done.

I would be grateful if someone can confirm this.

[#2 · Accepted solution]

@nadsurf93, when you provision a DNS Zone in Azure, you are simply using a PaaS service that will allow you to delegate DNS resolution for a domain you own. An Azure DNS Zone by itself is useless until you configure your domain registrar to use Azure DNS name servers for your domain. That's why you don't have to prove ownership to Azure - you can only configure your registrar settings to use Azure name servers if you own the domain, of course.

For each DNS Zone, Azure will provide you with 4 name server addresses. If you have multiple Azure DNS Zones with the same name, then their name servers must be different, because this will be the glue between Azure DNS and your registrar configuration.

More details on Azure DNS delegation here.

[#3]

Dear hspinto,
I suspected that it was the case (since when I created the zone on the new tenant it gave me a different set of name records).
And I was able to change the name servers on my registrar account so that it would point to the "new" name servers.
I just wanted to lay this worry to rest (DNS is critical after all).
In any case, many thanks for having provided this information.