NICs with custom DNS settings

March 21, 2025 ยท View on GitHub

SYNOPSIS

Network interfaces (NICs) should inherit DNS from virtual networks.

DESCRIPTION

By default Virtual machine (VM) NICs automatically use a DNS configuration inherited from the virtual network they connect to. Optionally, DNS servers can be overridden on a per NIC basis with a custom configuration.

Using network interfaces with individual DNS server settings may increase management overhead and complexity.

RECOMMENDATION

Consider updating NIC DNS server settings to inherit from virtual network.

EXAMPLES

Configure with Bicep

To deploy NICs that pass this rule:

  • Clear the properties.dnsSettings.dnsServers property. OR
  • Remove the properties.dnsSettings property.

For example:

resource nic 'Microsoft.Network/networkInterfaces@2024-05-01' = {
  name: name
  location: location
  properties: {
    dnsSettings: {
      dnsServers: []
    }
    ipConfigurations: [
      {
        name: 'ipconfig1'
        properties: {
          privateIPAllocationMethod: 'Dynamic'
          subnet: {
            id: subnetId
          }
        }
      }
    ]
  }
}

Configure with Azure template

To deploy NICs that pass this rule:

  • Clear the properties.dnsSettings.dnsServers property. OR
  • Remove the properties.dnsSettings property.

For example:

{
  "type": "Microsoft.Network/networkInterfaces",
  "apiVersion": "2024-05-01",
  "name": "[parameters('name')]",
  "location": "[parameters('location')]",
  "properties": {
    "dnsSettings": {
      "dnsServers": []
    },
    "ipConfigurations": [
      {
        "name": "ipconfig1",
        "properties": {
          "privateIPAllocationMethod": "Dynamic",
          "subnet": {
            "id": "[parameters('subnetId')]"
          }
        }
      }
    ]
  }
}

Configure with Azure CLI

To configure NICs that pass this rule, clear the DNS servers configuration:

az network nic update -n '<name>' -g '<resource_group>' --dns-servers null

Configure with Azure PowerShell

To configure NICs that pass this rule, clear the DNS servers configuration:

# Place the network interface configuration into a variable.
$nic = Get-AzNetworkInterface -Name '<name>' -ResourceGroupName '<resource_group>'

# Remove the DNS servers configuration.
$nic.DnsSettings.DnsServers.Remove("192.168.1.100")
$nic.DnsSettings.DnsServers.Remove("192.168.1.101")

# Apply the new configuration to the network interface.
$nic | Set-AzNetworkInterface