Azure DNS and Load Balancing

What it is

Azure DNS turns names into addresses, and load balancers spread traffic across machines that can handle it. The exam asks you to configure zones and records, build a load balancer from its parts, and fix one that is not working.

How it works

Azure DNS zones

A DNS zone hosts the records for one domain.

• A public zone answers queries from the internet. To use it, you set the Azure name servers shown on the zone at your domain registrar. This is called delegation.
• A private zone answers queries only inside virtual networks that are linked to it. A link can also have auto registration, which creates records for VMs in the network automatically.

Azure supplies a built in resolver at 168.63.129.16. You can also give a VNet your own DNS servers.

Records

A CNAME cannot be used at the root of a domain. An alias record can. An alias record points to an Azure resource, such as a public IP address, a Traffic Manager profile or a Front Door profile, and updates by itself when the address changes.

Azure Load Balancer

Azure Load Balancer works at layer 4, with TCP and UDP. Use the Standard SKU. The Basic SKU has been retired. It can be public, with a public frontend, or internal, with a private frontend inside a VNet.

Its parts are:

• Frontend IP configuration: the address clients use.
• Backend pool: the machines that receive the traffic.
• Health probe: checks each backend over TCP, HTTP or HTTPS. A backend that fails the probe stops receiving traffic.
• Load balancing rule: maps a frontend address and port to the backend pool and port.
• Inbound NAT rule: sends a specific port on the frontend to one machine, for example RDP.
• Session persistence: by default requests are spread by a hash of the connection details. You can instead keep a client on one backend, using client IP, or client IP and protocol.

A Standard load balancer is secure by default, so an NSG must allow the traffic to the backends.

Application Gateway

Application Gateway works at layer 7, with HTTP and HTTPS. It can route by URL path or host name, end TLS connections and add a web application firewall. Use it when routing depends on the content of the request, and use Load Balancer for plain TCP or UDP traffic.

Troubleshooting load balancing

The load balancer metrics, such as health probe status and data path availability, show which part is failing.

Creating a public DNS zone

Putting a domain in Azure DNS has four steps.

1. Create a DNS zone with the domain name.
2. Add the records, such as an A record for www.
3. Copy the four name servers shown on the zone.
4. At the domain registrar, change the domain's name servers to those four. This is called delegation.

Until delegation, the records exist in Azure but the internet does not use them.

Private zones

A private zone is linked to one or more virtual networks. A link with auto registration creates and removes DNS records for VMs in the network automatically. A link without it only resolves names. Each virtual network can have one auto registration link, but can be linked to other zones for resolution.

Load balancer or application gateway

Health probes

A probe can use TCP, HTTP or HTTPS. A TCP probe only checks that the port answers. An HTTP or HTTPS probe requests a path and expects a successful response, so it also proves that the application works. If a probe fails, the backend is removed from rotation until it passes again.

How the exam asks about this

• "Route by URL path." Application Gateway.
• "Balance TCP traffic across VMs." Azure Load Balancer.
• "Point the root of a domain to an Azure IP." An alias record.
• "Create DNS records for VMs automatically." Auto registration on a private zone link.
• "Backends all show unhealthy." Check the probe port, the app, and the AzureLoadBalancer rule in the NSG.