Cost-Optimizing Azure DNS: The Private Resolver Trap
Azure DNS itself is cheap. Azure DNS Private Resolver is not. Knowing the difference saves $130/month per accidentally-provisioned endpoint.
I noticed an $80 DNS line on my personal subscription bill. Public and private DNS zones are 50¢ each per month — there's no way 160 zones existed. The culprit was a different product: Azure DNS Private Resolver.
The pricing wedge
| Product | Cost |
|---|---|
| Public DNS zone | $0.50/mo |
| Private DNS zone | $0.50/mo + free VNet links (first 25) |
| DNS queries | $0.40 per million |
| DNS Private Resolver inbound endpoint | ~$130/mo |
| DNS Private Resolver outbound endpoint | ~$130/mo |
One inbound + one outbound endpoint = ~$260/month. They're billed by the hour and don't auto-stop.
When you actually need it
DNS Private Resolver is for hybrid resolution — on-prem DNS
servers needing to resolve privatelink records, or Azure resources
needing to forward to on-prem. If you don't have on-prem DNS, you don't
need it.
For pure-cloud private endpoint resolution, the default Azure-provided
DNS (168.63.129.16) plus privatelink private DNS zones
linked to your VNets is enough. That's the pattern Microsoft documents for
hub-spoke private link.
How to find it
az extension add --name dns-resolver
az dns-resolver list -o tableIf that returns rows, you're paying. Either delete it or justify it. There's no middle ground.