Microsoft Azure DnsManagementClient
Browse all Azure APIs★ Only Publicly Available OpenAPI DocumentCloud InfrastructureNetworkingoauth214 EndpointsREST
For Agents
Create and manage Azure-hosted DNS zones and individual A, CNAME, MX, TXT, and other record sets, plus look up DNS records pointing at a given Azure resource.
Use for: I need to create a new DNS zone for example.com in Azure, Add an A record pointing www.example.com at 203.0.113.10, Update the TXT record for SPF on my zone, Delete the stale CNAME for legacy.example.com
Not supported: Does not manage private DNS zones, domain registration, or traffic routing policies — use for Azure public DNS zones and record sets only.
Jentic publishes the only available OpenAPI specification for DnsManagementClient, keeping it validated and agent-ready. The Azure DNS Management Client manages public DNS zones and record sets through the Microsoft.Network resource provider. It exposes 14 endpoints covering zone CRUD, record set CRUD across A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, and CAA types, and a reverse-lookup endpoint that returns the DNS records pointing at a given Azure resource. Use it to host authoritative DNS for owned domains entirely within Azure.
Install Jentic One Beta
Connect the DnsManagementClient to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the DnsManagementClient, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with DnsManagementClient API.
Create a public DNS zone for a domain hosted in Azure
Add or update an A, AAAA, CNAME, MX, TXT, NS, or SRV record set in a zone
Delete a record set without affecting other records in the zone
List every record set in a DNS zone, optionally filtered by type
Look up DNS records that point at a specific Azure resource ID
Patch DNS zone tags or metadata without recreating the zone
Bulk-list DNS zones across an entire Azure subscription
Use Cases
Patterns agents use DnsManagementClient API for, with concrete tasks.
★ Automated Domain Onboarding
When a marketing or platform team launches a new product, they often need a fresh DNS zone with an opinionated set of records — A, CNAME, MX, SPF, DKIM, and DMARC — provisioned in minutes rather than days. The Azure DNS Management Client lets an automation agent create the zone with Zones_CreateOrUpdate, then loop through RecordSets_CreateOrUpdate calls to seed every required record. The result is a fully wired domain ready for production traffic.
Create a DNS zone for shop.example.com in resource group dns-rg, then add an A record www at 203.0.113.10 and an MX record at priority 10 pointing at mail.example.com.
DNS Record Hygiene and Audit
Engineering teams accumulate DNS records faster than they prune them, and stale CNAMEs eventually point at decommissioned resources. By listing all record sets in a zone and using the reverse-lookup endpoint to confirm which ones still point at live Azure resources, an agent can flag orphaned records, propose deletions, and apply them after approval. This keeps the zone clean and reduces takeover risk.
Call DnsResourceReference_GetByTargetResources for each Azure App Service endpoint in resource group prod-rg and return the DNS records that reference any service no longer in the subscription.
Email Authentication Setup (SPF/DKIM/DMARC)
Email deliverability requires SPF, DKIM, and DMARC TXT records configured exactly. The DNS Management Client supports TXT record set creation and update directly via RecordSets_CreateOrUpdate with the TXT record type, so an agent can apply a vendor-supplied SPF include, install rotated DKIM selectors, and tighten DMARC policy from p=none to p=reject in stages.
Add a TXT record at the apex of example.com containing v=spf1 include:_spf.mailprovider.net -all and a DKIM TXT record at selector1._domainkey.
AI Agent DNS Operations via Jentic
An infrastructure agent integrated through Jentic can resolve a request like point shop.example.com at the new App Service end-to-end. It searches Jentic for create an azure dns record, loads the RecordSets_CreateOrUpdate schema, applies the right type and TTL, and reports the change back to the user. Credentials never leave the Jentic vault, so the agent operates with a scoped bearer token only.
Through Jentic, search for create an azure dns record, load RecordSets_CreateOrUpdate, and create a CNAME at shop pointing at myapp.azurewebsites.net with TTL 300.
Key Endpoints
14 endpoints — jentic publishes the only available openapi specification for dnsmanagementclient, keeping it validated and agent-ready.
METHOD
PATH
DESCRIPTION
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}
Create or update a DNS zone
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}
Delete a DNS zone
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName}
Create or update a record set
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName}
Delete a record set
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/recordsets
List all record sets in a zone
POST
/subscriptions/{subscriptionId}/providers/Microsoft.Network/getDnsResourceReference
Look up DNS records pointing at a given Azure resource
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}
Create or update a DNS zone
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}
Delete a DNS zone
PUT
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName}
Create or update a record set
DELETE
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName}
Delete a record set
GET
/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/recordsets
List all record sets in a zone
POST
/subscriptions/{subscriptionId}/providers/Microsoft.Network/getDnsResourceReference
Look up DNS records pointing at a given Azure resource
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
The Azure AD client secret or certificate is stored encrypted in the Jentic vault (MAXsystem). The agent receives a short-lived bearer token scoped to management.azure.com only — the underlying credential never enters the agent context.
Intent-based discovery
Agents search by intent (e.g. 'create an azure dns record') and Jentic returns the matching RecordSets_* or Zones_* operation with its full input schema, so the agent picks the right record type and path without browsing ARM docs.
Time to first call
Direct integration: 1-2 days for AAD token acquisition, ARM URL construction, and per-record-type schema handling. Through Jentic: under 30 minutes — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using DnsManagementClient API through Jentic.
Why is there no official OpenAPI spec for DnsManagementClient?
Microsoft Azure does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call DnsManagementClient via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.
What authentication does the DnsManagementClient use?
It uses Azure Active Directory OAuth 2.0 (azure_auth) with a bearer token sent to https://management.azure.com/. The principal needs at least DNS Zone Contributor on the target resource group. Through Jentic, the underlying client secret is held in the Jentic vault and the agent only receives a scoped access token.
Can I create CAA, SRV, and TXT records with this API?
Yes. PUT /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/dnsZones/{zoneName}/{recordType}/{relativeRecordSetName} accepts recordType values including A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT, and CAA. The request body fields vary by type — use the correct typed property (aRecords, txtRecords, etc.) on the record set.
What are the rate limits for the DnsManagementClient?
Azure Resource Manager applies the standard subscription-scoped quota (broadly 12,000 reads per hour and 1,200 writes per hour). DNS-specific quotas also limit the number of zones per subscription and record sets per zone — defaults are 250 zones per subscription and 10,000 record sets per zone. Inspect x-ms-ratelimit-remaining-subscription-* headers.
How do I add an A record to a zone through Jentic?
Run pip install jentic, search for create an azure dns a record, load RecordSets_CreateOrUpdate, supply zoneName, recordType=A, relativeRecordSetName (e.g. www), TTL, and aRecords with the IPv4 address, then execute. The response is the persisted record set with its etag.
Does this API host private DNS zones inside virtual networks?
No. DnsManagementClient handles public DNS only. Azure Private DNS zones use a separate resource provider (Microsoft.Network/privateDnsZones) with its own management client and link-to-VNet operations.
GET STARTED