Plans & Pricing
DNS Tool for Azure is available through the Azure Marketplace in four plans. Plans scale on public DNS zones, subscriptions, users, how often your zones are scanned, how long history is kept, and feature access.
Plan overview
| Free | Starter | Pro | Enterprise | |
|---|---|---|---|---|
| Monthly price | $0 | $49 | $149 | $399 |
| Annual price | — | $490/yr | $1,490/yr | $3,990/yr |
| Annual savings | — | Save $98 | Save $298 | Save $798 |
| Public DNS zones | 5 | 25 | 100 | Unlimited |
| Azure subscriptions | 1 | 3 | 10 | Unlimited |
| Users | 2 | 5 | 15 | Unlimited |
| Scan interval | Daily | 6 hours | 1 hour | 15 min |
| Manual rescan | — | — | ✓ | ✓ |
| Change history | 7 days | 30 days | 90 days | 1 year |
Annual pricing is about 17% below the monthly rate. Private DNS zones don't count toward the zone limit. The first scan after you connect is always immediate, whatever your plan.
Feature comparison
Discovery & inventory
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Zone & record discovery (public and private zones) | ✓ | ✓ | ✓ | ✓ |
| Dashboard with health score and change activity | ✓ | ✓ | ✓ | ✓ |
| Global search across zones, records, certificates, domains and findings | ✓ | ✓ | ✓ | ✓ |
| Zone comparison | ✓ | ✓ | ✓ | ✓ |
| Hide zones from health and notifications | ✓ | ✓ | ✓ | ✓ |
| Export (CSV / JSON) | ✓ | ✓ | ✓ | ✓ |
Health checks
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Overall and per-zone health score | ✓ | ✓ | ✓ | ✓ |
| CNAME integrity checks | ✓ | ✓ | ✓ | ✓ |
| Dangling DNS (subdomain takeover) detection | ✓ | ✓ | ✓ | ✓ |
| MX record validation | — | ✓ | ✓ | ✓ |
| TTL anomaly detection | — | ✓ | ✓ | ✓ |
| NS delegation consistency | — | ✓ | ✓ | ✓ |
| CAA record audit | — | — | ✓ | ✓ |
| Certificate-without-DNS (dangling certificate) detection | — | — | ✓ | ✓ |
| Turn individual checks off, acknowledge findings with a note | ✓ | ✓ | ✓ | ✓ |
See the validation rules reference for every check.
Email security
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| SPF validation (incl. lookup limit, loops, void lookups) | ✓ | ✓ | ✓ | ✓ |
| DMARC validation | ✓ | ✓ | ✓ | ✓ |
| DKIM validation | — | ✓ | ✓ | ✓ |
| MTA-STS and TLS-RPT checks | ✓ | ✓ | ✓ | ✓ |
Unused-domain hardening (null MX, SPF -all, DMARC reject) |
✓ | ✓ | ✓ | ✓ |
| Email security scorecard | ✓ | ✓ | ✓ | ✓ |
Azure Private DNS
Private zones appear in your inventory on every plan. The analysis that understands how they're wired into Azure is part of Pro and above.
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Private zone inventory | ✓ | ✓ | ✓ | ✓ |
| VNet link audit (zones linked to no network) | — | — | ✓ | ✓ |
| Private Endpoint DNS validation | — | — | ✓ | ✓ |
| Orphan and duplicate private zone detection | — | — | ✓ | ✓ |
| Split-brain (private/public name clash) detection | — | — | ✓ | ✓ |
Certificates & domains
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Certificate inventory and expiry monitoring (live TLS scan) | — | ✓ | ✓ | ✓ |
| Certificate Transparency (CT) log monitoring | — | — | ✓ | ✓ |
| Domain registration monitoring (RDAP: expiry, transfer lock, nameservers) | — | — | ✓ | ✓ |
| Unauthorized CA detection (CAA ↔ issued certificates) | — | — | — | ✓ |
Changes
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Record-level change history | 7 days | 30 days | 90 days | 1 year |
| AI-powered change risk scoring | — | — | ✓ | ✓ |
| Change history export (CSV / JSON) | — | — | ✓ | ✓ |
Notifications & alerting
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Weekly or monthly email digest | ✓ | ✓ | ✓ | ✓ |
| Daily email digest | — | ✓ | ✓ | ✓ |
| Alert rules (new findings, severity, changes, health drops) | — | ✓ | ✓ | ✓ |
| Email notifications | — | ✓ | ✓ | ✓ |
| Microsoft Teams and Slack notifications | — | — | ✓ | ✓ |
| Webhook notifications | — | — | ✓ | ✓ |
| Maintenance windows | — | — | ✓ | ✓ |
| Alert delivery history | ✓ | ✓ | ✓ | ✓ |
Reporting & sharing
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Public status page and health badge | ✓ | ✓ | ✓ | ✓ |
| Monthly PDF posture report, emailed as a download link | — | — | ✓ | ✓ |
Platform
| Feature | Free | Starter | Pro | Enterprise |
|---|---|---|---|---|
| Sign-in with Microsoft Entra ID | ✓ | ✓ | ✓ | ✓ |
| Roles (Owner, Admin, Member) | ✓ | ✓ | ✓ | ✓ |
| Audit log of sign-ins and configuration changes | ✓ | ✓ | ✓ | ✓ |
| Billing through Azure Marketplace | ✓ | ✓ | ✓ | ✓ |
Plan details
Free
The Free plan lets you prove the value on your own DNS before committing. Connect one Azure subscription, monitor up to 5 public zones with a daily scan, and receive a weekly digest.
- 5 public DNS zones, 1 subscription, 2 users
- Daily scan interval, 7-day change history
- Health score, CNAME, dangling DNS, SPF and DMARC checks
- Email security scorecard, public status page, weekly or monthly digest
Starter — $49/mo
For small-to-mid Azure teams that need same-day change detection, certificate monitoring and email alerting.
- 25 public DNS zones, 3 subscriptions, 5 users
- 6-hour scan interval, 30-day change history
- Certificate inventory and expiry monitoring
- DKIM, MX, TTL and NS delegation checks
- Alert rules with email notifications, daily digest
Pro — $149/mo
Where DNS Tool becomes a security and operations tool: Azure Private DNS analysis, AI risk scoring, the full notification suite, and reporting.
- 100 public DNS zones, 10 subscriptions, 15 users
- 1-hour scan interval + manual rescan, 90-day change history
- Azure Private DNS analysis — VNet links, Private Endpoint records, orphan, duplicate and split-brain zones
- AI-powered change risk scoring — see which changes need review first
- CT log monitoring and domain registration monitoring
- Microsoft Teams, Slack and webhook notifications, maintenance windows
- Monthly PDF posture report and change history export
Enterprise — $399/mo
For large Azure estates: no limits, the shortest scan interval, a year of history, and certificate-authority governance.
- Unlimited public DNS zones, subscriptions and users
- 15-minute scan interval + manual rescan
- 1-year change history
- Unauthorized CA detection — certificates issued by a CA your CAA records don't allow
Managing DNS for several organizations?
A user can belong to several DNS Tool organizations and switch between them, each with its own subscription and plan. For managed-service setups, contact us at sales@just-software.com.
Trials
An Admin or Owner can try a higher plan from Settings → Subscription, with your own data already in place. No credit card is required.
| Current plan | Can trial | Duration |
|---|---|---|
| Free | Starter or Pro | 30 days |
| Free | Enterprise | 14 days |
| Starter | Pro | 30 days |
| Starter | Enterprise | 14 days |
| Pro | Enterprise | 30 days |
Each higher plan can be trialled once per organization, one trial at a time. When the trial ends, your organization returns to its own plan, and history older than that plan's retention is removed.
Zone overage handling
When you exceed your plan's public DNS zone limit, DNS Tool uses a soft-notify approach and never stops scanning your zones:
- 30-day grace period — all zones continue to be scanned normally.
- In-app notice — a banner on the dashboard and Settings → Subscription show your usage against the limit, with an upgrade link.
- After 30 days — your organization's scans fall back to the Free plan's daily interval until you upgrade or reduce the number of zones. No zone is dropped.
Custom plans and volume pricing
For custom terms, volume discounts, multi-year commitments, or bundles across Just Software products, ask us about a Marketplace private offer. Private offers keep the full Azure Marketplace procurement benefits — MACC drawdown, unified billing, enterprise agreement alignment — with flexible pricing.
Contact us at sales@just-software.com or via just-software.com.