Plans & Pricing
DNS Tool for Azure is available through the Azure Marketplace with five tiers. Plans scale primarily on public DNS zone count and feature access.
Plan overview
| Free | Starter | Pro | Enterprise | MSP | |
|---|---|---|---|---|---|
| Monthly price | $0 | $49 | $149 | $399 | $699 |
| Annual price | — | $490/yr | $1,490/yr | $3,990/yr | $6,990/yr |
| Annual savings | — | Save $98 | Save $298 | Save $798 | Save $1,398 |
| Public DNS zones | 5 | 25 | 100 | Unlimited | Unlimited* |
| Azure subscriptions | 1 | 3 | 10 | Unlimited | Unlimited |
| Users | 2 | 5 | 15 | Unlimited | Unlimited |
| Scan interval | Daily | 6 hours | 1 hour | 15 min | 15 min |
| Manual rescan | — | — | ✓ | ✓ | ✓ |
| Change history | 7 days | 30 days | 90 days | 1 year+ | 1 year+ |
| Managed tenants (MSP) | — | — | — | — | 25 (then +$20/tenant) |
*MSP base plan includes 25 managed tenants. Additional tenants are $20/tenant/month.
Annual pricing offers approximately 17% off the monthly rate and aligns with enterprise budget cycles.
Feature comparison
Discovery & inventory
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Zone & record discovery | ✓ | ✓ | ✓ | ✓ | ✓ |
| Zone metadata dashboard | ✓ | ✓ | ✓ | ✓ | ✓ |
| Record search & filtering | ✓ | ✓ | ✓ | ✓ | ✓ |
| Exportable inventory (CSV/JSON/BIND) | ✓ | ✓ | ✓ | ✓ | ✓ |
| Tag-based grouping | — | ✓ | ✓ | ✓ | ✓ |
Health checks
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| CNAME integrity checks | ✓ | ✓ | ✓ | ✓ | ✓ |
| SPF validation | ✓ | ✓ | ✓ | ✓ | ✓ |
| DMARC validation | ✓ | ✓ | ✓ | ✓ | ✓ |
| Overall DNS health score | ✓ | ✓ | ✓ | ✓ | ✓ |
| Dangling DNS detection | Top 3 zones | All zones | All zones | All zones | All zones |
| DKIM validation | — | ✓ | ✓ | ✓ | ✓ |
| MX record validation | — | ✓ | ✓ | ✓ | ✓ |
| TTL anomaly detection | — | ✓ | ✓ | ✓ | ✓ |
| NS consistency check | — | ✓ | ✓ | ✓ | ✓ |
| CAA record audit | — | — | ✓ | ✓ | ✓ |
| Stale record detection | — | — | ✓ | ✓ | ✓ |
Azure Private DNS
Private DNS zone support is a Pro+ feature, not a metered limit. Free and Starter users can see private zones in the inventory; the deeper analysis features below require Pro or higher.
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Private zone discovery | — | — | ✓ | ✓ | ✓ |
| Duplicate private zone detection | — | — | ✓ | ✓ | ✓ |
| VNet link audit | — | — | ✓ | ✓ | ✓ |
| Private Endpoint DNS validation | — | — | ✓ | ✓ | ✓ |
| Orphan zone detection | — | — | ✓ | ✓ | ✓ |
Security
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Subdomain takeover risk scoring | — | — | ✓ | ✓ | ✓ |
| AI-powered change risk scoring | — | — | ✓ | ✓ | ✓ |
| Unauthorized CA detection | — | — | — | ✓ | ✓ |
| Zone RBAC permission visibility | — | — | — | ✓ | ✓ |
| DNSSEC status monitoring | — | — | — | ✓ | ✓ |
Certificate monitoring
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Certificate expiration monitoring | — | ✓ | ✓ | ✓ | ✓ |
| Certificate inventory per domain | — | ✓ | ✓ | ✓ | ✓ |
| CT log monitoring | — | — | ✓ | ✓ | ✓ |
| CAA ↔ CT cross-reference | — | — | — | ✓ | ✓ |
Domain monitoring
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Domain/WHOIS monitoring | — | — | ✓ | ✓ | ✓ |
| Nameserver delegation consistency | — | — | ✓ | ✓ | ✓ |
| External DNS propagation check | — | — | ✓ | ✓ | ✓ |
Notifications & alerting
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Weekly email digest | ✓ | ✓ | ✓ | ✓ | ✓ |
| Daily email digest | — | ✓ | ✓ | ✓ | ✓ |
| Change alerting with rules | — | ✓ | ✓ | ✓ | ✓ |
| Email notifications | — | ✓ | ✓ | ✓ | ✓ |
| Per-record-type filtering | — | ✓ | ✓ | ✓ | ✓ |
| Webhook notifications | — | — | ✓ | ✓ | ✓ |
| Microsoft Teams notifications | — | — | ✓ | ✓ | ✓ |
| Slack notifications | — | — | ✓ | ✓ | ✓ |
| Maintenance windows | — | — | ✓ | ✓ | ✓ |
Change tracking & audit
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Record-level change history | 7 days | 30 days | 90 days | 1 year+ | 1 year+ |
| Activity Log correlation | — | — | ✓ | ✓ | ✓ |
| Export audit trail | — | — | ✓ | ✓ | ✓ |
| Change frequency analytics | — | — | ✓ | ✓ | ✓ |
| Zone drift detection | — | — | — | ✓ | ✓ |
| Change review workflow | — | — | — | ✓ | ✓ |
| Point-in-time snapshots | — | — | — | ✓ | ✓ |
Reporting & cost
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Scheduled PDF/HTML reports | — | — | ✓ | ✓ | ✓ |
| Compliance report generation | — | — | — | ✓ | ✓ |
Platform
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Multi-user access with roles | — | ✓ | ✓ | ✓ | ✓ |
| SSO via Entra ID | Basic | Basic | Full | Full | Full |
| REST API for CI/CD | — | — | — | ✓ | ✓ |
| Custom check suppression | — | ✓ | ✓ | ✓ | ✓ |
MSP features
| Feature | Free | Starter | Pro | Enterprise | MSP |
|---|---|---|---|---|---|
| Multi-tenant Lighthouse overview | — | — | — | — | ✓ |
| Cross-tenant health dashboard | — | — | — | — | ✓ |
| Per-customer reporting | — | — | — | — | ✓ |
| Customer-facing read-only portal | — | — | — | — | ✓ |
| Per-customer feature visibility toggles | — | — | — | — | ✓ |
| Tenant onboarding automation | — | — | — | — | ✓ |
Plan details
Free
The Free tier is a demo tool. Connect one Azure subscription, scan up to 5 public DNS zones daily, and get a weekly email digest. It is designed to let you prove value quickly before committing to a paid plan.
- 5 public DNS zones, 1 subscription, 2 users
- Daily scan interval
- 7-day change history
- Weekly email digest
- Basic health checks (CNAME, SPF, DMARC, health score)
- Dangling DNS detection on top 3 zones
Starter — $49/mo
Starter is suited to small-to-mid Azure teams that need same-day change detection, basic certificate monitoring, and email alerting — without requiring formal procurement approval.
- 25 public DNS zones, 3 subscriptions, 5 users
- 6-hour scan interval
- 30-day change history
- Certificate expiration monitoring and inventory — immediate value for any organization running HTTPS
- Full health check suite including DKIM, MX, TTL anomaly, and NS consistency
- Change alerting with email notifications and per-record-type filtering
- Daily digest, tag-based grouping, custom check suppression
Pro — $149/mo
Pro is where DNS Tool becomes a serious security and compliance tool. The key additions are Azure Private DNS coverage, AI risk scoring, and the full notification suite.
- 100 public DNS zones, 10 subscriptions, 15 users
- 1-hour scan interval + manual rescan on demand
- 90-day change history
- Azure Private DNS — VNet link audit, PE validation, duplicate and orphan zone detection
- AI-powered change risk scoring — prioritize which changes need review
- Subdomain takeover risk scoring — proactive detection across all records
- CT log monitoring and Domain/WHOIS monitoring
- Activity Log correlation — see who made each DNS change, not just what changed
- Webhook, Teams, and Slack notifications with maintenance windows
- Scheduled PDF/HTML reports
Enterprise — $399/mo
Enterprise is the governance and compliance tier for large organizations with audit, regulatory, or infrastructure-as-code requirements.
- Unlimited public DNS zones and subscriptions
- 15-minute scan interval + manual rescan
- 1-year+ change history
- Compliance report generation — SOC 2, ISO 27001, PCI DSS, NIS2
- Zone drift detection and change review workflow — governance for regulated industries
- Point-in-time snapshots — full audit trail depth
- REST API — CI/CD integration for infrastructure-as-code teams
- Unauthorized CA detection, RBAC permission visibility, DNSSEC status monitoring
- CAA ↔ CT log cross-reference
MSP — $699/mo
The MSP tier provides a single pane of glass across multiple customer tenants via Azure Lighthouse, plus all Enterprise features. The base plan includes 25 managed tenants; additional tenants are $20/tenant/month.
- Everything in Enterprise
- 25 managed tenants included (then $20/tenant/mo)
- Multi-tenant Lighthouse overview and cross-tenant health dashboard
- Per-customer reporting with branded reports per tenant
- Customer-facing read-only portal — each customer tenant gets a full-featured read-only view of their own DNS health, change history, alerts, certificates, and reports, authenticated via their own Entra ID
- Per-customer feature visibility toggles — MSPs can control which features are visible per customer to support tiered service offerings
- Tenant onboarding automation
MSP pricing example
| Managed tenants | Monthly price |
|---|---|
| Up to 25 | $699 |
| 50 | $699 + (25 × $20) = $1,199 |
| 75 | $699 + (50 × $20) = $1,699 |
For large MSPs (100+ tenants), contact us for a private offer with volume pricing.
MSP vs. Enterprise — which to choose
| Scenario | Recommended |
|---|---|
| Large organization with multiple internal Azure subscriptions | Enterprise |
| Organization with a few subsidiaries sharing one IT team | Enterprise |
| MSP managing 5 or more customer Azure tenants | MSP |
| MSP who wants customers to own and pay for their own subscription | Per-customer Pro or Enterprise |
Trials
All paid plans include a 14-day free trial at signup. No credit card required during trial.
Paying customers can also trial the next tier up to experience additional features with their own data already in place:
| Current plan | Can trial | Duration | How to start |
|---|---|---|---|
| Free | Starter | 30 days | Automatic at signup, or manual opt-in |
| Starter | Pro | 30 days | Manual opt-in, or prompted when hitting a feature gate |
| Pro | Enterprise | 30 days | Manual opt-in, or prompted when hitting a feature gate |
Upgrade trials are available once per tier per account. At trial end, the account returns to the current paid plan; data collected during the trial remains visible as a read-only preview to preserve the upgrade incentive.
Zone overage handling
When you exceed your plan's public DNS zone limit, DNS Tool uses a soft-notify approach — it never silently stops scanning your zones:
- 30-day grace period — all zones continue scanning normally
- In-app banner — persistent notification showing current usage vs. plan limit with an upgrade prompt
- Weekly email — account admins receive a weekly notice about the overage
- After 30 days — excess zones are deprioritized (scanned at Free-tier interval) but never dropped entirely
Custom plans and volume pricing
For large organizations needing custom terms, volume discounts, multi-year commitments, or bundled pricing across Just Software products, contact us about a Marketplace private offer. Private offers provide full Azure Marketplace procurement benefits (MACC drawdown, unified billing, enterprise agreement alignment) with flexible pricing.
Contact us at sales@just-software.com or via just-software.com.