{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "slug": "dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain", "url": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/" }, "title": "Do not treat Azure Firewall's DNS server list as an ordered fallback chain", "summary": "Review random upstream selection and the absence of an extra fallback when every configured DNS server is unavailable.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:45+00:00", "modified_at": "2026-09-10T01:23:48+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 236, "potentially_affected": "Azure Firewall DNS proxy deployments using multiple custom upstream DNS servers.", "dse_recommendation": "Validate consistent answers and reachable failure paths across the configured DNS pool, without assuming list-order preference or an unconfigured fallback.", "primary_source": { "name": "Azure Firewall policy DNS settings | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall-manager/dns-settings", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

When Azure Firewall has multiple custom DNS servers, Microsoft says it selects a server randomly. DNS proxy stops using a detected unhealthy server and uses another available one. If every configured server is unavailable, there is no additional DNS fallback.

\n

While upstream servers remain unhealthy, the proxy performs health checks at five-second intervals using a recursive root-name-server query. Checks stop when an upstream is considered healthy and resume after a later error. Microsoft Learn.

\n

Applicability

\n

Inventory the firewall’s configured upstream addresses and the names each must resolve. For a Firewall Manager-managed instance, review the associated policy’s DNS settings as part of the configuration record.

\n

DSE recommendation

\n

DSE recommends treating the listed servers as a pool that must provide the intended answers, not as a preferred server followed by a special emergency resolver. Compare their forwarding and private-zone reachability with the application requirements. Define an operational response for loss of the entire pool instead of assuming the firewall will silently use an unlisted service.

\n

Verification

\n

In an approved test, query representative public and private names through the firewall and compare answers with each upstream. Exercise loss of one upstream and then the planned all-unavailable scenario within a safe test scope. Record observed resolution and recovery behavior. Confirm monitoring distinguishes upstream availability from whether the returned answer is correct for the requested application name.

\n

Official references

\n

Microsoft Learn: Azure Firewall policy DNS settings. Source retrieved September 9, 2026.

", "content_text": "Source facts\nWhen Azure Firewall has multiple custom DNS servers, Microsoft says it selects a server randomly. DNS proxy stops using a detected unhealthy server and uses another available one. If every configured server is unavailable, there is no additional DNS fallback.\nWhile upstream servers remain unhealthy, the proxy performs health checks at five-second intervals using a recursive root-name-server query. Checks stop when an upstream is considered healthy and resume after a later error. Microsoft Learn.\nApplicability\nInventory the firewall’s configured upstream addresses and the names each must resolve. For a Firewall Manager-managed instance, review the associated policy’s DNS settings as part of the configuration record.\nDSE recommendation\nDSE recommends treating the listed servers as a pool that must provide the intended answers, not as a preferred server followed by a special emergency resolver. Compare their forwarding and private-zone reachability with the application requirements. Define an operational response for loss of the entire pool instead of assuming the firewall will silently use an unlisted service.\nVerification\nIn an approved test, query representative public and private names through the firewall and compare answers with each upstream. Exercise loss of one upstream and then the planned all-unavailable scenario within a safe test scope. Record observed resolution and recovery behavior. Confirm monitoring distinguishes upstream availability from whether the returned answer is correct for the requested application name.\nOfficial references\nMicrosoft Learn: Azure Firewall policy DNS settings. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nWhen Azure Firewall has multiple custom DNS servers, Microsoft says it selects a server randomly. DNS proxy stops using a detected unhealthy server and uses another available one. If every configured server is unavailable, there is no additional DNS fallback.\n\nWhile upstream servers remain unhealthy, the proxy performs health checks at five-second intervals using a recursive root-name-server query. Checks stop when an upstream is considered healthy and resume after a later error. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/firewall-manager/dns-settings).\n\n## Applicability\n\nInventory the firewall’s configured upstream addresses and the names each must resolve. For a Firewall Manager-managed instance, review the associated policy’s DNS settings as part of the configuration record.\n\n## DSE recommendation\n\nDSE recommends treating the listed servers as a pool that must provide the intended answers, not as a preferred server followed by a special emergency resolver. Compare their forwarding and private-zone reachability with the application requirements. Define an operational response for loss of the entire pool instead of assuming the firewall will silently use an unlisted service.\n\n## Verification\n\nIn an approved test, query representative public and private names through the firewall and compare answers with each upstream. Exercise loss of one upstream and then the planned all-unavailable scenario within a safe test scope. Record observed resolution and recovery behavior. Confirm monitoring distinguishes upstream availability from whether the returned answer is correct for the requested application name.\n\n## Official references\n\n[Microsoft Learn: Azure Firewall policy DNS settings](https://learn.microsoft.com/en-us/azure/firewall-manager/dns-settings). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "url": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Do not treat Azure Firewall's DNS server list as an ordered fallback chain", "item": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "url": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/", "headline": "Do not treat Azure Firewall's DNS server list as an ordered fallback chain", "description": "Review random upstream selection and the absence of an extra fallback when every configured DNS server is unavailable.", "abstract": "Review random upstream selection and the absence of an extra fallback when every configured DNS server is unavailable.", "articleBody": "Source facts\nWhen Azure Firewall has multiple custom DNS servers, Microsoft says it selects a server randomly. DNS proxy stops using a detected unhealthy server and uses another available one. If every configured server is unavailable, there is no additional DNS fallback.\nWhile upstream servers remain unhealthy, the proxy performs health checks at five-second intervals using a recursive root-name-server query. Checks stop when an upstream is considered healthy and resume after a later error. Microsoft Learn.\nApplicability\nInventory the firewall’s configured upstream addresses and the names each must resolve. For a Firewall Manager-managed instance, review the associated policy’s DNS settings as part of the configuration record.\nDSE recommendation\nDSE recommends treating the listed servers as a pool that must provide the intended answers, not as a preferred server followed by a special emergency resolver. Compare their forwarding and private-zone reachability with the application requirements. Define an operational response for loss of the entire pool instead of assuming the firewall will silently use an unlisted service.\nVerification\nIn an approved test, query representative public and private names through the firewall and compare answers with each upstream. Exercise loss of one upstream and then the planned all-unavailable scenario within a safe test scope. Record observed resolution and recovery behavior. Confirm monitoring distinguishes upstream availability from whether the returned answer is correct for the requested application name.\nOfficial references\nMicrosoft Learn: Azure Firewall policy DNS settings. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:45+00:00", "dateModified": "2026-09-10T01:23:48+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-251-do-not-treat-azure-firewall-s-dns-server-list-as-an-ordered-fallback-chain/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Do not treat Azure Firewall's DNS server list as an ordered fallback chain" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 236, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Azure Firewall policy DNS settings | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/firewall-manager/dns-settings" } } ] } }