Merge pull request #303945 from asudbring/us474487-dns-security-baseline

Azure DNS Security Baseline refresh

Author: JillGrant615

articles/dns/TOC.yml

@@ -144,6 +144,8 @@
           href: private-resolver-hybrid-dns.md
 - name: Security
   items:
+    - name: Secure DNS
+      href: secure-dns.md
     - name: Security baseline
       href: /security/benchmark/azure/baselines/azure-dns-security-baseline?toc=/azure/dns/TOC.json
     - name: DNS security policy

articles/dns/secure-dns.md

@@ -0,0 +1,94 @@
+---
+title: Secure your Azure DNS deployment
+description: Learn how to secure your Azure DNS deployment with access management, threat detection, monitoring best practices, and protection against accidental changes.
+author: asudbring
+ms.author: allensu
+ms.service: azure-dns
+ms.topic: conceptual
+ms.custom: security
+ms.date: 08/06/2025
+ai-usage: ai-assisted
+---
+
+# Secure your Azure DNS deployment
+
+Azure DNS provides a reliable and secure way to host your DNS domains and manage DNS records in Azure. As a critical networking service that translates domain names to IP addresses and routes traffic across the internet, securing your DNS deployment is essential to prevent DNS attacks, unauthorized changes, and service disruptions that could affect your entire infrastructure.
+
+This article provides guidance on how to best secure your Azure DNS deployment.
+
+## Network security
+
+Network security for Azure DNS focuses on protecting DNS infrastructure from external threats and ensuring that DNS resolution services remain available and secure. Proper network controls help prevent DNS attacks and maintain service integrity.
+
+* **Use private DNS zones for internal resources**: Deploy Azure Private DNS zones for internal name resolution within virtual networks to prevent exposure of internal DNS records to public DNS servers. This keeps your internal infrastructure hidden from external reconnaissance.
+
+* **Configure DNS security policies**: Use DNS security policies to control and monitor DNS queries, block access to malicious domains, and implement traffic actions such as allow, block, or alert for specific domain lists. For more information, see [DNS security policy](dns-security-policy.md).
+
+* **Implement alias records for automatic updates**: Use DNS alias records to automatically update IP address references when underlying resources change, preventing security risks from stale DNS entries that might redirect users to compromised or incorrect resources. For more information, see [Azure DNS alias records overview](dns-alias.md).
+
+## Privileged access
+
+Privileged access management for Azure DNS ensures that only authorized users can modify DNS zones and records while following the principle of least privilege. Proper access controls prevent unauthorized DNS changes that could redirect traffic or compromise your services.
+
+* **Implement role-based access control**: Use Azure role-based access control (RBAC) to manage access to DNS resources through built-in role assignments. Assign roles to users, groups, service principals, and managed identities based on their specific responsibilities. For more information, see [How to protect DNS zones and records](dns-protect-zones-recordsets.md#azure-role-based-access-control).
+
+* **Use granular DNS permissions**: Assign specific DNS roles like DNS Zone Contributor or Private DNS Zone Contributor rather than broad administrative roles. Create custom roles for fine-grained control, such as allowing users to manage only specific record types like CNAME records. For more information, see [How to protect DNS zones and records](dns-protect-zones-recordsets.md#custom-roles).
+
+* **Apply zone-level and record-level access controls**: Configure RBAC permissions at different levels - subscription, resource group, individual DNS zone, or individual record set - to ensure users can only access the DNS resources they need for their responsibilities.
+
+* **Implement resource locks for critical zones**: Apply Azure Resource Manager locks to DNS zones and record sets to prevent accidental deletion or modification. Use CanNotDelete locks to prevent zone deletion and ReadOnly locks to prevent all changes. For more information, see [How to protect DNS zones and records](dns-protect-zones-recordsets.md#resource-locks).
+
+* **Apply least privilege principles**: Grant users only the minimum permissions necessary to perform their DNS management tasks. Use specific DNS roles rather than broad administrative roles to limit potential security exposure.
+
+* **Secure administrative access**: Implement multi-factor authentication and privileged access workstations for all users who have permissions to modify DNS zones and records.
+
+* **Regular access reviews**: Conduct periodic reviews of user permissions and access rights to DNS resources to ensure that access remains appropriate and follows the principle of least privilege.
+
+## Data protection
+
+Data protection for Azure DNS focuses on protecting DNS data integrity and preventing unauthorized access to DNS configuration information and query data.
+
+* **Use defense-in-depth for zone protection**: Implement both custom roles and resource locks simultaneously as a comprehensive defense-in-depth approach to protect critical DNS zones from accidental or malicious changes.
+
+* **Implement two-step deletion process**: For critical zones, use custom roles that don't include zone delete permissions, requiring administrators to first grant delete permissions and then perform the deletion as a two-step process to prevent accidental zone deletion.
+
+* **Protect DNS query integrity**: Monitor DNS query patterns to detect potential DNS tunneling attempts, queries to known malicious domains, or other indicators of compromise that could indicate data exfiltration through DNS channels.
+
+## Logging and threat detection
+
+Comprehensive logging and monitoring for Azure DNS enables threat detection, security investigation, and compliance requirements while providing visibility into DNS query patterns and potential security events.
+
+* **Enable Microsoft Defender for DNS**: Use Azure Defender for DNS to monitor DNS queries and detect suspicious activities without requiring agents on your resources. This provides real-time threat detection for DNS-based attacks. For more information, see [Overview of Microsoft Defender for DNS](/azure/defender-for-cloud/defender-for-dns-introduction).
+
+* **Configure Azure resource logs**: Enable resource logs for Azure DNS service to capture detailed DNS query information and send them to Log Analytics workspaces, storage accounts, or event hubs for analysis and long-term retention. For more information, see [Azure DNS Metrics and Alerts](dns-alerts-metrics.md).
+
+* **Set up monitoring and alerting**: Configure Azure Monitor alerts to notify administrators when unusual DNS query patterns, configuration changes, or potential security threats are detected.
+
+* **Monitor DNS query analytics**: Analyze DNS query logs to identify unusual traffic patterns, potential DNS tunneling attempts, or queries to known malicious domains.
+
+* **Enable audit logging**: Track all administrative changes to DNS zones and records to maintain a comprehensive audit trail for compliance and security investigation purposes.
+
+* **Monitor for accidental changes**: Set up alerts for unexpected modifications or deletions of DNS zones and records to quickly detect and respond to potential security incidents or operational errors.
+
+## Asset management
+
+Asset management for Azure DNS involves implementing governance controls, monitoring configurations, and ensuring compliance with organizational security policies. Proper asset management helps maintain security posture and operational visibility.
+
+* **Implement Azure Policy governance**: Use Azure Policy to monitor and enforce configurations of your Azure DNS resources. Configure policies to audit and enforce secure configuration across DNS zones and records. For more information, see [Azure Policy built-in definitions for Azure networking services](/azure/networking/policy-reference).
+
+* **Use Microsoft Defender for Cloud**: Configure Azure Policy through Microsoft Defender for Cloud to audit and enforce configurations of your DNS resources. Create alerts when configuration deviations are detected.
+
+* **Apply configuration enforcement**: Use Azure Policy deny and deploy-if-not-exists effects to enforce secure configurations across Azure DNS resources and prevent non-compliant deployments.
+
+* **Maintain resource inventory**: Keep detailed records of your DNS zones, record sets, and their configurations to support security assessments and compliance reporting.
+
+* **Implement resource tagging**: Apply consistent resource tags to DNS resources for organization, cost tracking, and security compliance purposes.
+
+* **Monitor configuration compliance**: Regularly review DNS configurations against your organization's security standards and use Azure Policy to automatically detect and remediate configuration drift.
+
+* **Document zone dependencies**: Maintain documentation of DNS zone relationships and dependencies to understand the impact of changes and ensure proper change management processes.
+
+## Next steps
+
+- [Azure Well-Architected Framework - Security](/azure/well-architected/security/)
+- [Cloud Adoption Framework - Security overview](/azure/cloud-adoption-framework/secure/overview)