5.1.2.4. Design for Azure DNS and Azure Traffic Manager
5.1.2.4. Design for Azure DNS and Azure Traffic Manager
💡 First Principle: An intelligent, global traffic routing system is essential for building high-performing, resilient, and globally available applications by directing user requests to the optimal endpoint based on health, latency, or geography.
Scenario: You are designing a global web application with active deployments in East US and West Europe Azure Regions. You need to route users to the geographically closest region for optimal performance. In case of a regional outage in one region, traffic should automatically failover to the other region.
Azure DNS is a managed service for hosting DNS domains, and Azure Traffic Manager is a DNS-based traffic load balancer.
Key Design Considerations:
- Azure DNS:
- Purpose: Hosts your DNS domains and provides name resolution using Microsoft's global DNS infrastructure.
- Use Cases: Public DNS for web applications, private DNS for VNet resources (Azure DNS Private Zones).
- Azure Traffic Manager:
- Purpose: A DNS-based traffic load balancer that distributes traffic globally across your application endpoints.
- Routing Methods: Choose from Priority (failover), Weighted, Performance (latency-based), Geographic, MultiValue, or Subnet routing.
- Endpoint Monitoring: Continuously monitors endpoint health and automatically routes traffic away from unhealthy endpoints.
- Use Cases: Global load balancing, disaster recovery (failover to secondary Region), and optimizing user experience.
- Integration: Traffic Manager uses Azure DNS to resolve the appropriate endpoint based on the chosen routing method.
Design decisions in practice:
| Requirement | Service |
|---|---|
| Global HTTP entry with WAF and TLS terminated at the edge | Front Door |
| Global distribution for NON-HTTP protocols | Traffic Manager — it answers at the DNS layer, so it is protocol-agnostic |
| Layer-4 distribution inside one region | Azure Load Balancer |
| Layer-7 routing and WAF inside one region | Application Gateway |
| Name resolution for private endpoints inside a VNet | Private DNS zone linked to the VNet |
| On-premises resolving Azure private names, or the reverse | DNS Private Resolver |
Traffic Manager's routing methods are the examined detail: Priority for active-passive failover, Weighted for gradual rollout or A/B, Performance for lowest latency, Geographic for data-residency or content rules, MultiValue for returning several healthy endpoints, and Subnet for routing by the caller's source IP range.
Private Resolver's two endpoint directions are the other, and they are easy to invert. An inbound endpoint gives on-premises DNS a target inside Azure to forward to, so on-premises can resolve Azure private zone names. An outbound endpoint plus a forwarding ruleset sends queries from Azure out to on-premises DNS, so Azure can resolve on-premises names. Hybrid designs usually need both.
⚠️ Exam Trap: Traffic Manager works in DNS, so failover is bounded by record TTL and by client caching — it never sees the traffic itself. When a question needs failover in seconds rather than minutes, or needs a WAF, it is describing Front Door.
⚠️ Common Pitfall: Confusing Azure Traffic Manager with Azure Load Balancer. Traffic Manager is a DNS-based, global service that directs clients to an endpoint. Load Balancer is a regional service that distributes traffic within a region to specific VMs or services.
Key Trade-Offs:
- DNS-based (Traffic Manager) vs. Anycast-based (Azure Front Door): Traffic Manager provides DNS-level routing. For more advanced features like SSL offloading, WAF, and Anycast-based routing over the Microsoft backbone, Azure Front Door is the more powerful (and more expensive) option.
Reflection Question: How does designing for Azure DNS (for hosting the domain) and Azure Traffic Manager (with a Performance routing method for latency and endpoint monitoring) fundamentally enhance the global availability and performance of your applications by intelligently routing user requests to the optimal available endpoint?
