DNS timeouts - filtering?

Question

DNS timeouts - filtering?

Alang 0

I'm debugging an issue where customers hosting their email in O365 are unable to send to our domain. When we dig into it they are unable to resolve the MX records for our domain.

I've created a VM in Azure I can re-create the issue. Cannot resolve any records for our domain using either azure resolvers or directly using dig +trace - connections to our authoritative servers timeout. However I can resolve if I go via a public service (e.g. google, quad9).

We have a webserver running in the same network segment as one of our NS and I can successfully connect to that from the test VM. So it's not a routing issue.

So I'm left with the conclusion that MS are inspecting/filtering outbound DNS requests. Anyone know if this is case and it can be modified? I'm not aware that our domain is on any bad lists that would affect its reputation.

Antony Maxwin 10 Reputation points

2025-11-05T06:11:29.1366667+00:00

HI@Alan .

Are you able to resolves the DNS inside your Azure VM ?

Are you able to Resolve The same DNS from Public ? By defult it will work .
Have you given any Custom DNS ?

try to resolve your DNS name along with Azure DNS and update the result here ?
Alang 0 Reputation points

2025-11-05T11:04:18.03+00:00

I've done some port scanning from the Azure VM towards our network range. I can see various ports being blocked such that they don't reach our network.

TCP: 19,22,23,25,53

UDP: 19,25,53

This explains why DNS resolution always fails as our NS never receive the requests on port 53 (udp or tcp).

I understand why port 25 is blocked, to prevent spamming, but I see no reasonable explanation for the other ports being blocked. Surely there is some inspection system in Azure that is blocking based on reputation or some heuristics?
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator

2025-11-07T01:58:25.0833333+00:00
Hello @Alang,

Thank you for sharing these details. Your notes on blocked ports helped confirm the root cause. Azure enforces certain outbound port rules for security:

Port 25 (SMTP) is blocked globally to prevent spam.

Port 53 (DNS) isn’t blocked, but if your VM used the deprecated “default outbound access” (retired September 2025), DNS queries can fail since outbound connectivity is no longer ensured.

Ports like 19, 22, and 23 aren’t blocked by Azure but may be restricted by your NSG or firewall configuration.

Reason for DNS failures: Your VM cannot reach external DNS servers due to the loss of default outbound access, causing timeouts.

How to fix it:

Use a NAT Gateway or Azure Firewall for predictable outbound connectivity (Firewall can also act as a DNS proxy).

Set up a Custom DNS Resolver, like Azure DNS Private Resolver, or point DNS to public resolvers such as 8.8.8.8 (Google) or 9.9.9.9 (Quad9).

Check your NSG rules to make sure port 53 outbound is allowed if you use custom DNS servers.

Don’t rely on the now-deprecated default outbound access.

Kindly let us know if the above helps or you need further assistance on this issue.
Antony Maxwin 10 Reputation points

2025-11-07T02:47:34.82+00:00

Thank you @alang
for sharing the root cause . Also thank you @Jeevan Shanigarapu for Sharing much possibilities .
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator

2025-11-12T20:09:50.7966667+00:00

Hello @Alang,

If you ever have more questions or need further assistance, feel free to reach out. And if any part of the previous response was helpful, you’re welcome to click "Accept Answer" to help others in the community.

Regards,
Jeevan

1 answer

Your answer

Antony Maxwin 10 Reputation points

2025-11-05T06:11:29.1366667+00:00

HI@Alan .

Are you able to resolves the DNS inside your Azure VM ?

Are you able to Resolve The same DNS from Public ? By defult it will work .
Have you given any Custom DNS ?

try to resolve your DNS name along with Azure DNS and update the result here ?
Alang 0 Reputation points

2025-11-05T11:04:18.03+00:00

I've done some port scanning from the Azure VM towards our network range. I can see various ports being blocked such that they don't reach our network.

TCP: 19,22,23,25,53

UDP: 19,25,53

This explains why DNS resolution always fails as our NS never receive the requests on port 53 (udp or tcp).

I understand why port 25 is blocked, to prevent spamming, but I see no reasonable explanation for the other ports being blocked. Surely there is some inspection system in Azure that is blocking based on reputation or some heuristics?
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator

2025-11-07T01:58:25.0833333+00:00

Hello @Alang,

Thank you for sharing these details. Your notes on blocked ports helped confirm the root cause. Azure enforces certain outbound port rules for security:

Port 25 (SMTP) is blocked globally to prevent spam.

Port 53 (DNS) isn’t blocked, but if your VM used the deprecated “default outbound access” (retired September 2025), DNS queries can fail since outbound connectivity is no longer ensured.

Ports like 19, 22, and 23 aren’t blocked by Azure but may be restricted by your NSG or firewall configuration.

Reason for DNS failures: Your VM cannot reach external DNS servers due to the loss of default outbound access, causing timeouts.

How to fix it:

Use a NAT Gateway or Azure Firewall for predictable outbound connectivity (Firewall can also act as a DNS proxy).

Set up a Custom DNS Resolver, like Azure DNS Private Resolver, or point DNS to public resolvers such as 8.8.8.8 (Google) or 9.9.9.9 (Quad9).

Check your NSG rules to make sure port 53 outbound is allowed if you use custom DNS servers.

Don’t rely on the now-deprecated default outbound access.

Kindly let us know if the above helps or you need further assistance on this issue.
Antony Maxwin 10 Reputation points

2025-11-07T02:47:34.82+00:00

Thank you @alang
for sharing the root cause . Also thank you @Jeevan Shanigarapu for Sharing much possibilities .
Jeevan Shanigarapu 3,355 Reputation points Microsoft External Staff Moderator

2025-11-12T20:09:50.7966667+00:00

Hello @Alang,

If you ever have more questions or need further assistance, feel free to reach out. And if any part of the previous response was helpful, you’re welcome to click "Accept Answer" to help others in the community.

Regards,
Jeevan

Answer 1

Hello @Alang,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand your question regarding the DNS timeout filtering. By default,

1. Azure does not block outbound DNS queries. However, some networking features may influence DNS resolution. Unless you specify custom DNS servers, Azure virtual machines use the default Azure DNS resolver at 168.63.129.16.

2. If DNS Security Policies are active in your virtual network, they may log or filter DNS traffic and, in some cases, block access to certain domains. Likewise, enabling the Azure Firewall DNS proxy allows DNS queries to be inspected and filtered using domain-based (FQDN) rules. Without these settings, DNS queries typically proceed without restriction.

3. If your Azure VM’s direct queries to the domain’s authoritative servers are timing out, it may be due to how the DNS resolver processes requests or issues with outbound connectivity. The Azure DNS resolver tends to be more strict and can fail quickly when it detects delegation or DNSSEC problems, while public DNS services like Google DNS are generally more flexible in handling these situations. Also, please note that default outbound access for VMs was deprecated in September 2025. If your VM still relies on it, you might experience intermittent connectivity or port exhaustion. Using a NAT Gateway or Azure Firewall helps maintain stable outbound DNS connections.

4. Since you’ve confirmed that your web server is reachable and that public DNS resolvers work fine, the routing itself looks healthy. Microsoft doesn’t block DNS lookups from Azure VMs, but filtering could still happen if a DNS Security Policy or Firewall DNS proxy rule is active in your setup.

Next steps:

Check your domain’s DNS setup using tools like dnsviz.net or the dig +trace command to identify any DNSSEC or delegation problems.
If needed, use Azure DNS Private Resolver for hybrid setups, or switch to a reliable public resolver such as Google (8.8.8.8) or Quad9 (9.9.9.9).
Connect a NAT Gateway to your subnet for stable outbound connectivity.
Examine your DNS Security Policy and Azure Firewall DNS proxy rules to ensure domain lookups aren’t being blocked by mistake.

Azure DNS overview: Azure DNS overview | Azure Docs
Azure NAT Gateway: What is Azure NAT Gateway? | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and “up-vote it” wherever the information provided helps you, this can be beneficial to other community members__.__ It would be greatly appreciated and helpful to others.

Share via

DNS timeouts - filtering?

1 answer

Your answer