canonical: https://jentic.com/apis/azure.com/azure-dns-management

# Microsoft Azure DnsManagementClient

Jentic publishes the only available OpenAPI specification for DnsManagementClient, keeping it validated and agent-ready. The Azure DNS Management Client manages public DNS zones and record sets through the Microsoft.Network resource provider. It exposes 14 endpoints covering zone CRUD, record set CRUD across A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, and CAA types, and a reverse-lookup endpoint that returns the DNS records pointing at a given Azure resource. Use it to host authoritative DNS for owned domains entirely within Azure.

## For AI agents

Create and manage Azure-hosted DNS zones and individual A, CNAME, MX, TXT, and other record sets, plus look up DNS records pointing at a given Azure resource.

## Scope

Does not manage private DNS zones, domain registration, or traffic routing policies - use for Azure public DNS zones and record sets only.

## Capabilities

- Create a public DNS zone for a domain hosted in Azure
- Add or update an A, AAAA, CNAME, MX, TXT, NS, or SRV record set in a zone
- Delete a record set without affecting other records in the zone
- List every record set in a DNS zone, optionally filtered by type
- Look up DNS records that point at a specific Azure resource ID
- Patch DNS zone tags or metadata without recreating the zone
- Bulk-list DNS zones across an entire Azure subscription

## Use cases

### Automated Domain Onboarding

When a marketing or platform team launches a new product, they often need a fresh DNS zone with an opinionated set of records - A, CNAME, MX, SPF, DKIM, and DMARC - provisioned in minutes rather than days. The Azure DNS Management Client lets an automation agent create the zone with Zones_CreateOrUpdate, then loop through RecordSets_CreateOrUpdate calls to seed every required record. The result is a fully wired domain ready for production traffic.

Example prompt: Create a DNS zone for shop.example.com in resource group dns-rg, then add an A record www at 203.0.113.10 and an MX record at priority 10 pointing at mail.example.com.

### DNS Record Hygiene and Audit

Engineering teams accumulate DNS records faster than they prune them, and stale CNAMEs eventually point at decommissioned resources. By listing all record sets in a zone and using the reverse-lookup endpoint to confirm which ones still point at live Azure resources, an agent can flag orphaned records, propose deletions, and apply them after approval. This keeps the zone clean and reduces takeover risk.

Example prompt: Call DnsResourceReference_GetByTargetResources for each Azure App Service endpoint in resource group prod-rg and return the DNS records that reference any service no longer in the subscription.

### Email Authentication Setup (SPF/DKIM/DMARC)

Email deliverability requires SPF, DKIM, and DMARC TXT records configured exactly. The DNS Management Client supports TXT record set creation and update directly via RecordSets_CreateOrUpdate with the TXT record type, so an agent can apply a vendor-supplied SPF include, install rotated DKIM selectors, and tighten DMARC policy from p=none to p=reject in stages.

Example prompt: Add a TXT record at the apex of example.com containing v=spf1 include:_spf.mailprovider.net -all and a DKIM TXT record at selector1._domainkey.

### AI Agent DNS Operations via Jentic

An infrastructure agent integrated through Jentic can resolve a request like point shop.example.com at the new App Service end-to-end. It searches Jentic for create an azure dns record, loads the RecordSets_CreateOrUpdate schema, applies the right type and TTL, and reports the change back to the user. Credentials never leave your Jentic One instance, so the agent operates with a scoped bearer token only.

Example prompt: Through Jentic, search for create an azure dns record, load RecordSets_CreateOrUpdate, and create a CNAME at shop pointing at myapp.azurewebsites.net with TTL 300.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName} | Create or update a DNS zone |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName} | Delete a DNS zone |
| PUT | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName} | Create or update a record set |
| DELETE | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName} | Delete a record set |
| GET | /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/recordsets | List all record sets in a zone |
| POST | /subscriptions/{subscriptionId}/providers/Microsoft.Network/getDnsResourceReference | Look up DNS records pointing at a given Azure resource |

## Key resources

- **DNS Zones** — Create, read, update, list, and delete authoritative DNS zones
- **Record Sets** — Manage A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, and CAA records within a zone
- **DNS Resource References** — Look up which DNS records point at a given Azure resource ID

## Why Jentic

- **Setup:** Wiring the Microsoft.Network DNS API by hand means acquiring Azure AD OAuth 2.0 bearer tokens, building the ARM URLs under management.azure.com, and handling the per-record-type payload shape for A, CNAME, MX, TXT, and the rest yourself. Through Jentic you install once, import DnsManagementClient from the API Directory, store the Azure AD credential once, and your agent calls it.
- **Permission scoping:** The zone and record-set ids sit in the URL path (/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName}), so a rule can pin your agent to one subscription, resource group, and zone. You choose the operations it may call, so destructive ones like deleting a zone or a record set are not included unless you add them.
- **Credential handling:** Your Azure AD credential is stored once, encrypted, by your own Jentic One instance and injected as a short-lived bearer token at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'create an azure dns record' or 'find dns records pointing at a resource', and Jentic returns the matching RecordSets or Zones operation with its zone-name, record-type, and TTL input schema so the agent picks the right record type without browsing ARM docs.

## Related APIs

- **Domains API Client** — Register and manage the domain names that DnsManagementClient then hosts
- **Domain Services Resource Provider** — Manages Azure Active Directory Domain Services - useful alongside public DNS for hybrid identity
- **Disk Resource Provider Client** — Manages Azure managed disks rather than DNS

## FAQ

### Why is there no official OpenAPI spec for DnsManagementClient?

Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DnsManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

### What authentication does the DnsManagementClient use?

It uses Azure Active Directory OAuth 2.0 (azure_auth) with a bearer token sent to https://management.azure.com/. The principal needs at least DNS Zone Contributor on the target resource group. Through Jentic, the underlying client secret is held in your Jentic One instance and the agent only receives a scoped access token.

### Can I create CAA, SRV, and TXT records with this API?

Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName} accepts recordType values including A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, and CAA. The request body fields vary by type - use the correct typed property (aRecords, txtRecords, etc.) on the record set.

### What are the rate limits for the DnsManagementClient?

Azure Resource Manager applies the standard subscription-scoped quota (broadly 12,000 reads per hour and 1,200 writes per hour). DNS-specific quotas also limit the number of zones per subscription and record sets per zone - defaults are 250 zones per subscription and 10,000 record sets per zone. Inspect x-ms-ratelimit-remaining-subscription-* headers.

### How do I add an A record to a zone through Jentic?

Run pip install jentic, search for create an azure dns a record, load RecordSets_CreateOrUpdate, supply zoneName, recordType=A, relativeRecordSetName (e.g. www), TTL, and aRecords with the IPv4 address, then execute. The response is the persisted record set with its etag.

### Does this API host private DNS zones inside virtual networks?

No. DnsManagementClient handles public DNS only. Azure Private DNS zones use a separate resource provider (Microsoft.Network/privateDnsZones) with its own management client and link-to-VNet operations.

### Can I limit what my agent is allowed to do with the Azure DNS Management Client API?

Yes. Because Jentic One is self-hosted by you, your own rules decide which operations and credentials the agent may use. Since the subscription, resource group, and zone all sit in the request URL path, a rule can pin the agent to a single subscription, resource group, and DNS zone, and you choose exactly which operations it may call. You can allow safe actions like creating or listing record sets while withholding destructive ones such as deleting a zone or a record set unless you explicitly add them.