Terraform Azure Reverse Private DNS Zone

Reverse DNS as an overlay on existing networks: vnet ids in, derived in-addr.arpa zones out, linked back estate-wide.

---

Overview

Reverse lookup zones are usually an afterthought bolted on long after the networks exist, and deriving 0.70.10.in-addr.arpa from 10.70.0.0/24 by hand is exactly the arithmetic humans get wrong. This module is the attach pattern (the relationship subnet has to network, or nsg-rules to nsg): it adds reverse DNS to infrastructure you already have, touching nothing.

• Vnet ids in, zones out: each existing vnet's address space is read and its zone derived. Octet-aligned CIDRs get their exact classful zone (a /24 like 10.70.0.0/24 gives 0.70.10.in-addr.arpa). Non-octet CIDRs default to the documented classless dash form, exact to the range (192.0.2.128/26 gives 128-26.2.0.192.in-addr.arpa, a /22 gives 0-22.114.10.in-addr.arpa, per the Azure private reverse DNS guidance); use_classless_zones = false falls back to the smallest containing classful zone, which a check points out because it shadows reverse resolution for the whole containing range. Duplicates collapse across vnets, and because the vnets already exist, every derived name is plan-known.
• Estate-wide resolution: every vnet links to every derived zone, so reverse lookups resolve across the estate rather than only for a vnet's own ranges. Auto-registration stays off on principle: Azure only auto-registers forward records, and a vnet's single registration-enabled link belongs to its forward zone.
• PTR content composes in: zones_per_virtual_network maps each vnet to its zones, made for the private-dns-records module's ptr_records. Greenfield stacks that know their CIDRs up front should use private-dns-zone's reverse_dns_zone_cidrs instead; this module is for the estate that already exists.

The examples are runnable: minimal overlays one /24 vnet; complete overlays an octet-aligned /24 alongside a deliberately non-octet /22 and proves the derived zone with a PTR record.

Requirements

Name	Version
terraform	>= 1.9.0, < 2.0.0
azurerm	>= 4.0.0, < 5.0.0

Providers

Name	Version
azurerm	>= 4.0.0, < 5.0.0

Modules

No modules.

Resources

Name	Type
azurerm_private_dns_zone.this	resource
azurerm_private_dns_zone_virtual_network_link.this	resource
azurerm_virtual_network.this	data source

Inputs

Name	Description	Type	Default	Required
resource_group_id	Id of the resource group the derived zones and links land in; the name is parsed from the id.	string	n/a	yes
tags	Tags applied to all resources.	map(string)	{}	no
use_classless_zones	How non-octet CIDRs derive their zone. true (default): the documented classless dash form, exact to the range (192.0.2.128/26 gives 128-26.2.0.192.in-addr.arpa, 10.114.0.0/22 gives 0-22.114.10.in-addr.arpa), per the Azure private reverse DNS guidance. false: the smallest classful zone CONTAINING the range (a /22 lands in its /16), which is simpler but shadows reverse resolution for the whole containing range in linked vnets; the wide_containing_zones_are_visible check points those out. Octet-aligned CIDRs always derive their exact classful zone either way.	bool	true	no
virtual_network_ids	Ids of EXISTING virtual networks to overlay with reverse DNS. This module is the attach pattern (the relationship subnet has to network, or nsg-rules to nsg): it reads each vnet's address space, derives the in-addr.arpa zone for each CIDR (10.70.0.0/24 gives 0.70.10.in-addr.arpa; non-octet CIDRs follow use_classless_zones), deduplicates across vnets, creates the zones, and links every vnet to every derived zone so reverse lookups resolve estate-wide. Links never enable auto-registration: Azure only auto-registers forward records, and a vnet's single registration link must stay with its forward zone. Populate PTR content with the private-dns-records module. Greenfield stacks that know their CIDRs up front should use private-dns-zone's reverse_dns_zone_cidrs instead. ONE OVERLAY PER VNET: Azure refuses to link a vnet to two zones with the same namespace, so a vnet overlaid here must not be overlaid again by another stack or zone set (BadRequest, caught live).	list(string)	n/a	yes

Outputs

Name	Description
reverse_zone_ids	Map of derived reverse zone name to its id (feed these to private-dns-records for PTR content).
reverse_zone_names	The derived in-addr.arpa zone names.
virtual_network_link_ids	Map of zone|vnet link key to its id.
zones_per_virtual_network	Map of vnet id to the reverse zones derived from its address space, for composing PTR records per network.