Direct answer: at the Azure Retail Prices API on 9 November 2026 (eastus, USD, excluding tax/discounts), Azure DNS Private/Public Zones are $0.50/zone-month for the first 25 and $0.10 from the 26th; queries are $0.40/million for the first 1 billion and $0.20/million beyond (aggregated per subscription). Azure DNS Private Resolver adds $180/month per inbound/outbound endpoint and $2.50/month per forwarding ruleset; DNS security policy is $0.60/million queries + $0.50/domain-month. Examples: 10 zones + 100M queries = $45.00/month; 10 zones + 1B = $405.00; 50 zones + 1B = $415.00; 100 zones + 5B = $1,220.00; 1 inbound + 1 outbound + 10 zones + 100M queries = $407.50. VNet links/autoregistration have no separate line; private record sets are $0.0015/record-month beyond 25,000.
This guide is for enterprise architects, network/SRE, finance and procurement teams designing hybrid DNS, Private Link private names, hub-spoke multi-VNet resolution or replacing self-built DNS. It explains Private/Public Zones, query tiers, Private Resolver endpoints/rulesets, hybrid DNS architectures, DNS security policy, record sets and a 90-day checklist. Prices come from the Azure DNS pricing page, Azure Retail Prices API and Microsoft Learn (eastus, 9 November 2026). Official price facts, editorial calculations and exclusions are kept separate. This is not procurement advice.
(1) Zones are cheap ($0.50/month for the first 25); query volume is the main line: 1B = $400/month, 5B = $1,200/month. (2) Private Resolver endpoints are fixed: 1 in + 1 out = $360/month, 2 in + 2 out = $720/month, plus $2.50/month for the ruleset. (3) VNet links/autoregistration have no separate line; DNS security policy adds per-domain + per-million queries; private record sets bill beyond 25,000.
Private/Public Zones and query tiers
Azure DNS Private and Public Zones are priced the same: $0.50/zone-month for the first 25 hosted zones, $0.10 from the 26th; queries are aggregated per subscription, $0.40/million for the first 1 billion and $0.20/million beyond. A Private Zone needs a VNet link to be resolvable; enabling autoregistration updates records when VMs are created, change IP or are deleted. VNet links/autoregistration have no separate price line; they are covered by zone/query billing.
| Item | Price | Basis/note |
|---|---|---|
| Private Zone (first 25) | $0.50/zone-month | Daily, prorated partial month |
| Private Zone (26th+) | $0.10/zone-month | Only above 25 |
| Private Queries (first 1B) | $0.40/million | Aggregated per subscription |
| Private Queries (over 1B) | $0.20/million | Excess |
| Public Zone/Queries | $0.50 / $0.40 | First 25 / first 1B, same |
| Private Resolver inbound | $180/endpoint-month | Prorated hourly |
| Private Resolver outbound | $180/endpoint-month | Prorated hourly |
| Forwarding ruleset | $2.50/month | Each ruleset |
| DNS security policy | $0.60/million + $0.50/domain-month | Queries + managed domains |
Sources: Azure DNS pricing page and Azure Retail Prices API (eastus, 9 November 2026). Queries aggregate per subscription; zones bill daily; resolver endpoints/rulesets prorate hourly; VNet links/autoregistration have no separate charge.
Zone + query TCO: query volume drives the bill
Using Private Zone/Queries: 10 zones + 10M queries = $9.00/month (zone 5.00 + query 4.00); 10 + 100M = $45.00; 10 + 1B = $405.00; 10 + 5B = $1,205.00 (first 1B 400 + next 4B 800 = 1,200 + zone 5). 50 zones + 1B = $415.00 (zone 15 + query 400); 100 zones + 5B = $1,220.00 (zone 20 + query 1,200). Zone fees are small; query volume is the main line.
| Scenario | Zone fee | Query fee | Total/month |
|---|---|---|---|
| 10 zones + 10M queries | 5.00 | 4.00 | 9.00 |
| 10 zones + 100M queries | 5.00 | 40.00 | 45.00 |
| 10 zones + 1B queries | 5.00 | 400.00 | 405.00 |
| 10 zones + 5B queries | 5.00 | 1,200.00 | 1,205.00 |
| 50 zones + 1B queries | 15.00 | 400.00 | 415.00 |
| 100 zones + 5B queries | 20.00 | 1,200.00 | 1,220.00 |
Editorial calculation: first 25 zones $0.50, then $0.10; first 1B queries $0.40/million, then $0.20/million; queries aggregate per subscription. Excludes Resolver/security policy/record sets/logs/tax/discounts.
Private Resolver: endpoint fixed fee + ruleset
Private Resolver provides bidirectional resolution between on-premises/other networks and Azure private DNS: an inbound endpoint lets on-prem DNS conditionally forward to Azure, and an outbound endpoint lets Azure forward to on-prem/external DNS via a forwarding ruleset. Each inbound/outbound endpoint is $180/month, each ruleset $2.50/month, prorated hourly. Example: 1 in + 1 out + 10 zones + 100M queries = $407.50/month (endpoints 360 + ruleset 2.50 + zone 5 + query 40); 2 in + 2 out + 10 zones + 1B = $1,127.50 (endpoints 720 + 2.50 + 5 + 400).
| Configuration | Endpoint fee | Ruleset | Zone/query | Total/month |
|---|---|---|---|---|
| 1 in + 1 out, 10 zones, 100M | 360.00 | 2.50 | 45.00 | 407.50 |
| 1 in only, 10 zones, 100M | 180.00 | 2.50 | 45.00 | 227.50 |
| 2 out only, 10 zones, 1B | 360.00 | 2.50 | 405.00 | 767.50 |
| 2 in + 2 out, 10 zones, 1B | 720.00 | 2.50 | 405.00 | 1,127.50 |
Editorial calculation: $180/month per inbound/outbound endpoint, $2.50/month per ruleset; zone/query per the table; endpoints prorate hourly. Excludes networking/egress, logs, tax and discounts.
Hybrid DNS architecture: centralized vs distributed
Common designs: centralized hub with 1 inbound + 1 outbound in one hub VNet, spokes using VNet/ruleset links; HA hub with 2 in + 2 out across AZs/regions; distributed with endpoints per region, lower latency but multiplied endpoint fees. Decide by endpoint count × $180/month, then query volume; do not default to one Resolver per region unless compliance/latency requires it.
| Architecture | Endpoints | Use | Example cost |
|---|---|---|---|
| Centralized hub | 1 in + 1 out | Single region, many spokes | 407.50 (10 zones/100M) |
| HA hub | 2 in + 2 out | Cross-AZ/high availability | 1,127.50 (10 zones/1B) |
| Distributed multi-region | 1+1 per region | Low latency/data residency | +360 per extra set |
| VNet-only resolution | 0 | Azure private names | zone/query only (45.00) |
Editorial summary; sources: Learn "Azure DNS Private Resolver overview/architecture" (9 November 2026). Endpoint/ruleset prices from the Retail API; networking/egress extra.
DNS security policy and record sets
DNS security policy bills $0.50/domain-month + $0.60/million queries; example 100 domains + 100M queries = 50 + 60 = $110/month. Record sets have free allowances: private record sets: first 25,000 free, then $0.0015/record-month; public record sets: first 10,000 free, then $0.0015. Large Private Link/multi-service names increase zone count, but record sets are rarely the main line.
| Item | Price | Example |
|---|---|---|
| DNS security policy queries | $0.60/million | 100M = 60.00 |
| DNS security policy domains | $0.50/domain-month | 100 = 50.00 |
| Security policy total | — | 110.00 (100 domains/100M) |
| Private record set | First 25,000 free; excess $0.0015/record-month | 30,000 = 7.50 |
| Public record set | First 10,000 free; excess $0.0015 | On excess |
Sources: Azure Retail Prices API (eastus, 9 November 2026). Security policy/record sets are add-ons; DNS logs/diagnostics bill via Log Analytics.
How to choose: Private Zone, Resolver or Public Zone
Choose by resolution scope: Azure-only private names across VNets use Private Zone + VNet links/autoreg; on-prem DNS conditional forwarding to Azure adds an inbound endpoint; Azure to on-prem/external adds an outbound endpoint + ruleset; bidirectional hybrid uses 1 in + 1 out; HA uses 2+2; public names use Public Zone; security policy adds per-domain/query. Estimate endpoint fixed fee + query volume + zone count first, then choose centralized/distributed.
| Scenario | Prefer | Check first |
|---|---|---|
| Azure private names | Private Zone | VNet links/autoreg |
| On-prem → Azure resolution | Inbound endpoint | On-prem conditional forwarding/network |
| Azure → on-prem/external | Outbound + ruleset | Longest suffix/forwarding rules |
| Bidirectional hybrid | 1 in + 1 out | $360/month endpoint fee |
| HA/cross-AZ | 2 in + 2 out | $720/month endpoint fee |
| Public names | Public Zone | Same $0.50/$0.40 |
| Security policy | DNS security policy | $0.50/domain + $0.60/million |
| Multi-region low latency | Distributed Resolver | +$360/month per set |
Editorial selection framework, not a vendor recommendation; features/regions/quota follow official docs.
Hidden costs and 90-day checklist
Seven extra costs: Resolver endpoint fixed fees ($180 each; 2+2=$720), query volume (still $0.20/million after 1B), DNS security policy (domain+query), record-set excess, logs/diagnostics (Log Analytics), Private Link multi-service zones and cross-region/on-prem networking. 90 days: weeks 1–2 inventory VNets/zones/query volume/on-prem domains; weeks 2–4 estimate zone/query base; weeks 4–6 decide whether inbound/outbound is needed; weeks 6–8 design hub/distributed and HA; weeks 8–10 evaluate security policy/logging; weeks 10–12 load-test resolution latency and clean unused zones/links.
FAQ
How is Azure Private DNS billed?
Private Zones are $0.50/zone-month for the first 25 and $0.10 from the 26th; queries are $0.40/million for the first 1B and $0.20/million beyond (aggregated per subscription). VNet links/autoregistration have no separate line; Private Resolver/security policy/record sets are extra.
How much is 1 billion queries?
Query fee 1,000×0.40=$400/month; plus 10 zones $5.00 = $405.00. With 50 zones, zone fee is $15.00, total $415.00; above 1B the rate drops to $0.20/million.
How is Private Resolver billed?
Each inbound/outbound endpoint is $180/month, each forwarding ruleset $2.50/month; 1 in + 1 out + ruleset = $362.50/month, plus zone/query. 2 in + 2 out = $720/month in endpoint fees. Endpoints prorate hourly.
Are VNet links and autoregistration charged?
The pricing page lists zones and queries only; VNet links/autoregistration have no separate line and are covered by zone/query billing. Cross-VNet/on-prem networking/egress is extra.
How is DNS security policy billed?
$0.60/million queries + $0.50/managed domain-month; example 100 domains + 100M queries = $50 + $60 = $110/month. It stacks on zone/query/Resolver.
What is the cheapest hybrid DNS design?
For Azure-only single-region, Private Zone + VNet links may not need Resolver; for bidirectional hybrid add 1 in + 1 out ($360/month); HA uses 2+2 ($720/month). A distributed multi-region Resolver adds $360/month per set; confirm latency/compliance needs first.
How are record sets billed?
Private record sets: first 25,000 free, then $0.0015/record-month; public record sets: first 10,000 free, then the same. Large Private Link/multi-service names increase zone count, but record sets are rarely the main line.
How does it compare with self-built/public DNS?
Self-built DNS has VM/operations/HA cost but no per-query fee; Azure Private DNS charges zone/query/Resolver endpoints but integrates with VNet/Private Link and removes DNS server operations. For low query volume Azure is simpler; at very high volume compare query fees with self-built VM cost.
Research method and limitations
This article separates "official price facts" from "editorial calculations": Private/Public Zone $0.50/$0.10, Query $0.40/$0.20, Resolver $180/endpoint, ruleset $2.50, security $0.60/$0.50 and record set $0.0015/25,000 come from the Azure Retail Prices API (eastus, 9 November 2026); VNet links/autoreg, Resolver architecture/endpoints/rulesets and query aggregation come from the Azure DNS pricing page and Microsoft Learn (private DNS overview, Private Resolver overview/architecture).
Eight limitations: (1) only eastus/Zone 1 list prices, excluding tax/CSP/enterprise discounts; (2) query/zone counts are editorial assumptions; (3) the main TCO excludes logs/diagnostics, networking/egress, other Private Link services and tax; (4) Resolver endpoints prorate hourly, while examples use a full month; (5) DNS security policy regional availability/features are not checked one by one; (6) record-set free allowance/billing basis follows the bill; (7) no resolution latency/HA benchmark; (8) prices/features change, so recheck official pages and bills before purchase.
Sources and basis
- Microsoft Azure, Azure DNS Pricing: azure.microsoft.com/en-us/pricing/details/dns. Private/Public Zone, Queries, Private Resolver, Security Policy, Record Set. Accessed 9 November 2026.
- Azure Retail Prices API (productName=Azure DNS, Zone 1/eastus): prices.azure.com/api/retail/prices. $0.50/$0.10, $0.40/$0.20, $180/endpoint, $2.50, $0.60/$0.50, $0.0015. Accessed 9 November 2026.
- Microsoft Learn, What is Azure Private DNS: learn.microsoft.com/en-us/azure/dns/private-dns-overview. Private Zone, VNet link, autoregistration, split-horizon. Accessed 9 November 2026.
- Microsoft Learn, What is Azure DNS Private Resolver / architecture: dns-private-resolver-overview, private-resolver-architecture. Inbound/outbound, rulesets, hub-spoke. Accessed 9 November 2026.
Data cut-off 9 November 2026; prices/availability follow Microsoft official pages and bills; this is not procurement, commercial or legal advice.