DNS security policy is now in public preview. This new
feature brings the visibility of DNS traffic at the VNET level with the
flexibility to send logs to storage account, log analytics workspace, or event
hubs. The private preview also includes DNS filtering based on lists of domains
for allow/block actions. GA will include threat intel feed based on known
malicious domains sourced by MSRC and other security researchers.
API, CLI and PowerShell are available today, with portal
being available over the next 2 weeks.
What DNS security policy?
DNS security policy offers the ability to filter DNS queries
at the virtual network (VNET) level. You can allow, alert, or block name
resolution of known or malicious domains and gain insight into your DNS
traffic. Detailed DNS logs can be sent to a storage account, log analytics
workspace, or event hubs.
A DNS security policy has the following associated elements
and properties:
- Location:
A security policy can only apply to VNets in the same region.
- DNS
traffic rules: Rules that allow, block, or alert based on priority and
domain lists. Rules can be enabled or disabled.
- Virtual
network links: You can link one security policy per VNet. A security
policy can be associated to multiple VNets.
- DNS
domain lists: Location-based lists of DNS domains.
For detailed instructions,
please refer to our Azure DNS
security policy documentation.