An Azure service that provides an event-driven serverless compute platform.
https://github.com/Azure/azure-functions-nodejs-worker/issues/830
This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Environment
@azure/functions v4MONGODB-OIDC with DefaultAzureCredentialExpected behavior:
The Function App should successfully connect using the official SRV connection string:
mongodb+srv://<clusterName>.global.mongocluster.cosmos.azure.com/
This should work regardless of whether authentication is performed using:
without requiring any custom DNS configuration.
Actual behavior:
On both Node.js 22 and Node.js 24, the MongoDB Node.js driver fails during SRV lookup before authentication begins.
Error:
{
"error": {
"code": "ECONNREFUSED",
"syscall": "querySrv",
"hostname": "_mongodb._tcp.<clusterName>.global.mongocluster.cosmos.azure.com"
}
}
The Function App starts successfully and the HTTP trigger is reachable. The failure occurs only during DNS SRV resolution.
The exact same behavior is observed when using:
MONGODB-OIDC)Since both authentication mechanisms fail with the same DNS error, the issue appears to occur before authentication is attempted.
Workaround
Adding the following at the beginning of the function resolves the issue immediately:
import dns from "node:dns";
dns.setServers(['8.8.8.8', '8.8.4.4']);
After overriding the DNS servers:
mongodb+srv:// connection string works.Why this appears to be a platform/runtime issue ?
querySrv, before any TCP connection or authentication attempt.*.global.mongocluster.cosmos.azure.com.Additional Observation:
mongodb+srv:// connection string work successfully when the function is run locally using Azure Functions Core Tools.MONGODB-OIDC)dns.setServers()) is required when running locally.mongodb+srv connections?querySrv requests to return ECONNREFUSED?dns.setServers() considered a supported workaround, or is there a recommended platform-level configuration or runtime update?mongodb+srv?Any clarification or recommended long-term solution would be greatly appreciated.
An Azure service that provides an event-driven serverless compute platform.
Thank you for taking the time to review the issue and for your detailed explanation.
Your suggestion to isolate the problem using the native Node.js DNS APIs (resolveSrv, resolveTxt, etc.) instead of relying on the MongoDB driver was extremely helpful. It helped me narrow the issue down much more precisely.
I ran the additional diagnostics you suggested, and below are the findings.
| Environment | DNS Resolver | resolveSrv() |
Result |
| Local Function App | Default system DNS | ✅ Success | SRV record resolved successfully |
| Azure Function App | Default resolver (127.0.0.1) |
❌ querySrv ECONNREFUSED |
Failed |
| Azure Function App | dns.setServers(['8.8.8.8', '8.8.4.4']) |
✅ Success | SRV record resolved successfully |
MONGODB-OIDC)These findings appear to indicate that the issue is related to the DNS resolution path in the hosted Azure Functions/App Service environment rather than the application code or authentication mechanism.
Attached file: AzureFunctions_DNS_Diagnostics.txt
hi Sandeep Sureshkumar & thx for sharing urs issue here at Q&A portal,
DNS is failing before Mongo auth even starts. both OIDC and username/password fail at querySrv, this isn’t an Entra ID or Mongo credential issue. The driver can’t resolve _mongodb._tcp.<clusterName>.global.mongocluster.cosmos.azure.com
The fact that dns.setServers(['8.8.8.8', '8.8.4.4']) fixes it is a pretty strong signal that the default resolver path in the Function/App Service environment is the problem. I wouldn’t use Google DNS as a long-term prod fix tho. It may work, but it bypasses Azure DNS behavior and can break private endpoint/private DNS scenarios later. Fine as a repro workaround, not great as architecture.
Better tests (JS for use :)
import dns from 'node:dns/promises';
console.log(await dns.resolveSrv('_mongodb._tcp.<clusterName>.global.mongocluster.cosmos.azure.com'));
console.log(await dns.resolveTxt('<clusterName>.global.mongocluster.cosmos.azure.com'));
Run that in the deployed Function and compare w/ local. If SRV fails only in Azure hosted Functions, u have a clean platform repro.
If u need a shortterm u can use the non-SRV connection string if Cosmos Mongo vCore provides host/port nodes directly, or keep a controlled DNS override only while MS investigates. If the app may ever use VNet/private endpoints, don’t hardcode public DNS resolvers.
https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/vcore/quickstart-nodejs
https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference-node
https://learn.microsoft.com/en-us/azure/app-service/overview-name-resolution
I’d open a Functions/App Service support case w/ Function App name, region, plan type, Node version, runtime version, Cosmos Mongo vCore cluster name, UTC repro time, and the querySrv ECONNREFUSED error. Ask them to check SRV DNS resolution from the worker/stamp for *.global.mongocluster.cosmos.azure.com.
So not a MongoDB auth issue. It’s either an Azure Functions/App Service DNS resolver issue or a platform regression around SRV lookups in that runtime/stamp.
rgds,
Alex
&
If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal
and at my blog https://ctrlaltdel.blog/