DNS Tool FAQ

Access & permissions

Does DNS Tool change anything in Azure?

No. DNS Tool uses Azure's built-in Reader role and holds no write permissions. It reads your DNS zones and records, Private Endpoints, virtual network links and public IP addresses, and reports on them. Every fix stays in your hands.

What exactly do I grant?

Two things: admin consent for the multi-tenant DNS Tool for Azure Subscription Scanner app in your Entra tenant, and the Reader role for that app on the subscriptions or management group you want monitored. No passwords, keys or secrets of yours are shared or stored. See Getting started.

Who in my organization needs to be involved?

Someone who can grant tenant-wide admin consent (for example a Global Administrator or Cloud Application Administrator), and someone who can assign roles on the subscriptions (Owner or User Access Administrator). In the setup wizard, Copy Consent Link lets you send the consent step to an administrator.

Can I limit DNS Tool to some subscriptions?

Yes. Assign the Reader role only where you want DNS Tool to look, and switch individual subscriptions off under Settings → Connections.

Can I connect more than one tenant?

Yes. One organization can hold several connections — Azure tenants, and CloudFlare accounts if you also host DNS there. Your plan sets how many subscriptions you can connect in total.

DNS Tool can no longer read the affected subscriptions, so their zones stop being updated. Assign the role again, then choose Validate on Settings → Connections to check that DNS Tool can read them.

Scanning

How often does DNS Tool scan?

It depends on your plan: daily (Free), every 6 hours (Starter), hourly (Pro) or every 15 minutes (Enterprise). The first scan after you connect runs immediately on every plan. On Pro and Enterprise, Rescan now scans a zone on demand.

I fixed a record. Why is the finding still open?

A finding resolves at the next scan that no longer sees the problem. Wait for the next scheduled scan, or on Pro and Enterprise use Rescan now on the zone. If it's still open afterwards, the change may not have reached that zone — check its Records tab.

Does DNS Tool monitor private DNS zones?

Yes. Private zones are discovered and inventoried on every plan. On Pro and Enterprise, DNS Tool also checks how they're wired into Azure: VNet links, Private Endpoint records, orphan and duplicate zones, and private zones that share a name with a public one. See Private DNS zones.

Does DNS Tool query my domains from the internet?

Some checks need to: dangling CNAMEs, MX targets, NS delegation and SPF lookups are checked against public DNS, certificates by connecting to your hostnames on port 443, and domain registrations over RDAP. DNS Tool only ever reads.

Can I exclude a zone?

Yes. Hide zone on a zone's page takes it out of health scores, the dashboard, the public status page and notifications while it is still scanned. See Hide a zone. To stop a check everywhere, switch the rule off under Settings → Validation Rules.

Findings & alerts

How is the health score calculated?

Each zone starts at 100 and loses 30 points per open Critical finding, 15 per Error, 5 per Warning and 1 per Info. Acknowledged findings don't count. See How the health score works.

A finding doesn't apply to us. What should I do?

Acknowledge it with a note explaining why. It stays visible, marked Acknowledged, and stops counting against the health score. If the whole check doesn't apply to your organization, an Admin can switch the rule off.

Why didn't I receive an alert?

Check that a notification channel is configured and enabled, that an alert rule covers the zone and the condition, and that no maintenance window was active. Settings → Alert History shows every notification and whether it was sent, failed or skipped. See Alerts & notifications.

Data & AI

What does AI risk scoring send, and where?

For each change it scores, DNS Tool sends the zone and record name, the record type, the previous and new values, and — for IP addresses — the network owner and location to Mistral AI's EU endpoint. Nothing else is sent, and TTL-only changes aren't scored. See AI risk scoring.

How long is history kept?

Change history is kept for 7 days (Free), 30 days (Starter), 90 days (Pro) or 1 year (Enterprise). Resolved findings are kept twice as long.

What is "Contoso (sample data)"?

A fictional company that some demo and evaluation organizations start with, so every page has something to show before your own scan. It's never scanned, and an Admin can remove it under Settings → Connections → Remove sample data. See Sample data.

Plans & billing

How am I billed?

Through your Azure subscription, via the Azure Marketplace — no separate contract or invoice. Change plan in the Azure portal (Settings → Subscription → Manage in Azure Portal). See Plans & Pricing.

What happens if I go over my zone limit?

Nothing stops. You get a 30-day grace period with an in-app notice, after which your scans fall back to the daily interval until you upgrade or remove zones. No zone is dropped. See Zone overage handling.

Can I try a higher plan?

Yes. An Admin or Owner can start a free trial of a higher plan under Settings → Subscription, once per plan. See Trials.

Support

For questions or support, contact support@just-software.com.