AzureAzure DNSNetworking

`azurerm_private_dns_resolver` cost estimation

A managed DNS resolver for hybrid name resolution between Azure and on-prem, billed per inbound/outbound endpoint-hour. Two endpoints are ~$365/month.

An azurerm_private_dns_resolver enables DNS resolution between Azure VNets and on-premises networks without running your own DNS VMs — inbound endpoints let on-prem resolve Azure private names, outbound endpoints forward Azure queries to on-prem resolvers. Cost is per endpoint-hour: ~$0.25/endpoint-hour (~$182.50/month each), so a typical hybrid setup with one inbound and one outbound endpoint is ~$365/month, plus a small per-query charge for forwarded queries.

The endpoint fee is the standing cost and it's the part that scales: you pay per endpoint regardless of query volume. Most hybrid deployments need both an inbound and an outbound endpoint (two endpoints, ~$365/month); simpler setups needing resolution in only one direction need just one.

The levers: provision only the endpoint directions you actually need (don't create both if you only resolve one way), and share one resolver across VNets via DNS forwarding rulesets rather than standing up resolvers per VNet. The Private DNS Resolver replaces the old pattern of running DNS-forwarder VMs, and is usually cheaper and lower-maintenance than that.

c3x prices the resolver from its endpoint_count, so the standing cost is visible before deployment.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "azurerm_private_dns_resolver" "main" {
  name                = "hybrid-resolver"
  resource_group_name = azurerm_resource_group.main.name
  location            = azurerm_resource_group.main.location
  virtual_network_id  = azurerm_virtual_network.main.id
}

resource "azurerm_private_dns_resolver_inbound_endpoint" "in" {
  name                    = "inbound"
  private_dns_resolver_id = azurerm_private_dns_resolver.main.id
  location                = azurerm_resource_group.main.location
  # ip_configurations ...
}

Pricing dimensions

What you actually pay for when you provision azurerm_private_dns_resolver.

Dimension	Unit	What's being charged
Resolver endpoints	per endpoint-hour	Per inbound/outbound endpoint, billed continuously regardless of query volume. $0.25/endpoint-hour (~$182.50/month) → 2 endpoints ≈ $365/month
Forwarded queries	per million	A small per-query charge for queries the resolver forwards. Usage-based.

Sample C3X output

One inbound + one outbound endpoint, 24/7:

azurerm_private_dns_resolver.main
└─ Resolver endpoints (2)   1460 endpoint-hours   $365.00
                            Monthly                $365.00

Optimization tips

Common ways to reduce azurerm_private_dns_resolver cost without changing the workload.

Provision only the directions you need

~$182.50/month per unneeded endpoint

Inbound (on-prem resolves Azure names) and outbound (Azure forwards to on-prem) are separate ~$182.50/month endpoints. Many setups need only one direction — don't create both reflexively.

Share one resolver across VNets

Per duplicate resolver avoided

A single Private DNS Resolver with forwarding rulesets can serve multiple VNets via virtual-network links, rather than standing up a resolver per VNet for the same hybrid connectivity.

Replace DNS-forwarder VMs

VM cost + operational overhead

If you run DNS-forwarder VMs for hybrid resolution, the managed resolver is usually cheaper and lower-maintenance than two always-on VMs — and removes the patching/availability burden.

FAQ

How is the Azure Private DNS Resolver billed?

Per endpoint-hour — ~$0.25/endpoint-hour (~$182.50/month) for each inbound/outbound endpoint — plus a small per-query charge for forwarded queries. A typical hybrid setup with one inbound and one outbound endpoint is ~$365/month.

Do I need both inbound and outbound endpoints?

Only if you resolve names in both directions. Inbound lets on-prem resolve Azure private names; outbound forwards Azure queries to on-prem. Each is ~$182.50/month — provision only the direction(s) your hybrid setup requires.