DNS security policy is now
generally available. This release brings visibility of DNS traffic at the VNET
level with the flexibility to send logs to storage account, log analytics
workspace, or event hubs. It also includes DNS filtering based on lists of
domains for allow/block actions.
What DNS security policy?
DNS security policy offers the
ability to filter DNS queries on VNETs. You can allow, alert, or block name
resolution of known or malicious domains and gain insight into your DNS
traffic. Detailed DNS logs can be sent to a storage account, log analytics workspace,
or event hubs.
A DNS security policy has the
following elements:
- Location: A security policy can only apply to
VNets in the same region.
- DNS traffic rules: Rules that allow/block/alert
queries based on priority and domain lists.
- VNET links: A security policy can be associated
to multiple VNets.
- DNS domain lists: Location-based lists of DNS
domains.
Key benefits:
- Visibility of DNS traffic: DNS security policy
brings the ability of logging your DNS traffic at the virtual network
level.
- DNS traffic filtering: Allows to create DNS
traffic rules which can contain multiple domain lists which can be used to
allow/block DNS traffic.
Learn
more.