Azure Functions (Node.js 22 & 24) fails SRV DNS resolution for Azure DocumentDB(with MongoDB compatibility) unless dns.setServers() is used

Sandeep Sureshkumar 0 Reputation points
2026-06-26T06:13:15.09+00:00

Environment

  • Service: Azure Functions (JavaScript/TypeScript, Node.js v4 programming model)
  • Package: @azure/functions v4
  • Runtime: Node.js 22 and 24
  • Hosting: Azure Function App (default configuration)
  • Networking:
    • No VNet integration
    • No Private Endpoint
    • No custom DNS configured
  • Database: Azure Cosmos DB for MongoDB vCore
  • Authentication tested:
    • Microsoft Entra ID (RBAC) using MONGODB-OIDC with DefaultAzureCredential
    • Native MongoDB (DocumentDB/Cosmos DB) username and password authentication

Expected behavior:

The Function App should successfully connect using the official SRV connection string:

mongodb+srv://<clusterName>.global.mongocluster.cosmos.azure.com/

This should work regardless of whether authentication is performed using:

  • Microsoft Entra ID (RBAC / OIDC), or
  • Native MongoDB credentials,

without requiring any custom DNS configuration.

Actual behavior:

On both Node.js 22 and Node.js 24, the MongoDB Node.js driver fails during SRV lookup before authentication begins.

Error:

{ 
	"error": { 
		"code": "ECONNREFUSED", 
		"syscall": "querySrv", 
		"hostname": "_mongodb._tcp.<clusterName>.global.mongocluster.cosmos.azure.com" 
	} 
}

The Function App starts successfully and the HTTP trigger is reachable. The failure occurs only during DNS SRV resolution.

The exact same behavior is observed when using:

  • Microsoft Entra ID (RBAC / MONGODB-OIDC)
  • Native MongoDB username/password authentication

Since both authentication mechanisms fail with the same DNS error, the issue appears to occur before authentication is attempted.

Workaround

Adding the following at the beginning of the function resolves the issue immediately:

import dns from "node:dns";
dns.setServers(['8.8.8.8', '8.8.4.4']);

After overriding the DNS servers:

  • SRV lookup succeeds.
  • The same mongodb+srv:// connection string works.
  • Connections succeed using both:
    • Microsoft Entra ID (RBAC / OIDC)
    • Native MongoDB credentials
  • No other code or configuration changes are required.

Why this appears to be a platform/runtime issue ?

  • The Function App uses the default Azure networking configuration.
  • No custom DNS, VNet, or Private Endpoint is configured.
  • The Cosmos DB endpoint and connection string are verified to be correct because they work immediately after changing only the DNS resolver.
  • The failure occurs during querySrv, before any TCP connection or authentication attempt.
  • The issue is reproducible with both Node.js 22 and Node.js 24.
  • The issue is reproducible with both Microsoft Entra ID (RBAC) and native MongoDB authentication.
  • This suggests the default DNS resolver available in the Azure Functions/App Service environment may be refusing or failing SRV queries for *.global.mongocluster.cosmos.azure.com.

Additional Observation:

  1. The same Function App code and the same mongodb+srv:// connection string work successfully when the function is run locally using Azure Functions Core Tools.
  2. The connection succeeds locally with both:
    • Microsoft Entra ID (RBAC / MONGODB-OIDC)
    • Native MongoDB username/password authentication
  3. No DNS override (dns.setServers()) is required when running locally.
  4. The issue is only observed after deploying the Function App to Azure.
  5. Since the application code, connection string, MongoDB driver, and Cosmos DB resource are identical between the local and hosted environments, the behavior appears to be specific to the DNS resolution path within the Azure Functions/App Service hosting environment.

Questions

  1. Is this a known issue with Azure Functions running Node.js 22 or Node.js 24 when resolving SRV records for mongodb+srv connections?
  2. Is there any known limitation or issue in the Azure Functions/App Service DNS infrastructure that could cause querySrv requests to return ECONNREFUSED?
  3. Is using dns.setServers() considered a supported workaround, or is there a recommended platform-level configuration or runtime update?
  4. Has the Cosmos DB for MongoDB vCore team published any guidance regarding DNS resolution or SRV lookups when connecting from Azure Functions using mongodb+srv?
  5. Could Microsoft confirm whether this behavior is expected, a known regression, or a platform issue affecting DNS resolution within the Azure Functions runtime?

Any clarification or recommended long-term solution would be greatly appreciated.

Azure Functions
Azure Functions

An Azure service that provides an event-driven serverless compute platform.

0 comments No comments

3 answers

Sort by: Most helpful
  1. Sandeep Sureshkumar 0 Reputation points
    2026-08-21T11:25:57.7966667+00:00

    Was this answer helpful?

    0 comments No comments

  2. Sandeep Sureshkumar 0 Reputation points
    2026-06-26T11:23:34.07+00:00

    Hi @Alex Burlachenko

    Thank you for taking the time to review the issue and for your detailed explanation.

    Your suggestion to isolate the problem using the native Node.js DNS APIs (resolveSrv, resolveTxt, etc.) instead of relying on the MongoDB driver was extremely helpful. It helped me narrow the issue down much more precisely.

    I ran the additional diagnostics you suggested, and below are the findings.

    Test Summary

    Environment DNS Resolver resolveSrv() Result
    Local Function App Default system DNS ✅ Success SRV record resolved successfully
    Azure Function App Default resolver (127.0.0.1) querySrv ECONNREFUSED Failed
    Azure Function App dns.setServers(['8.8.8.8', '8.8.4.4']) ✅ Success SRV record resolved successfully
    • The issue reproduces on both Node.js 22 and Node.js 24.
    • It reproduces with both:
      • Microsoft Entra ID (RBAC / MONGODB-OIDC)
      • Native MongoDB username/password authentication.
    • The MongoDB driver fails because the SRV lookup fails first.
    • Changing only the DNS resolver allows the SRV lookup to succeed, after which the MongoDB connection also succeeds.

    These findings appear to indicate that the issue is related to the DNS resolution path in the hosted Azure Functions/App Service environment rather than the application code or authentication mechanism.

    Attached file: AzureFunctions_DNS_Diagnostics.txt

    Was this answer helpful?

    0 comments No comments

  3. Alex Burlachenko 25,120 Reputation points MVP Volunteer Moderator
    2026-06-26T08:29:46+00:00

    hi Sandeep Sureshkumar & thx for sharing urs issue here at Q&A portal,

    DNS is failing before Mongo auth even starts. both OIDC and username/password fail at querySrv, this isn’t an Entra ID or Mongo credential issue. The driver can’t resolve _mongodb._tcp.<clusterName>.global.mongocluster.cosmos.azure.com

    The fact that dns.setServers(['8.8.8.8', '8.8.4.4']) fixes it is a pretty strong signal that the default resolver path in the Function/App Service environment is the problem. I wouldn’t use Google DNS as a long-term prod fix tho. It may work, but it bypasses Azure DNS behavior and can break private endpoint/private DNS scenarios later. Fine as a repro workaround, not great as architecture.

    Better tests (JS for use :)

    import dns from 'node:dns/promises';

    console.log(await dns.resolveSrv('_mongodb._tcp.<clusterName>.global.mongocluster.cosmos.azure.com'));

    console.log(await dns.resolveTxt('<clusterName>.global.mongocluster.cosmos.azure.com'));

    Run that in the deployed Function and compare w/ local. If SRV fails only in Azure hosted Functions, u have a clean platform repro.

    If u need a shortterm u can use the non-SRV connection string if Cosmos Mongo vCore provides host/port nodes directly, or keep a controlled DNS override only while MS investigates. If the app may ever use VNet/private endpoints, don’t hardcode public DNS resolvers.

    https://learn.microsoft.com/en-us/azure/cosmos-db/mongodb/vcore/quickstart-nodejs

    https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference-node

    https://learn.microsoft.com/en-us/azure/app-service/overview-name-resolution

    I’d open a Functions/App Service support case w/ Function App name, region, plan type, Node version, runtime version, Cosmos Mongo vCore cluster name, UTC repro time, and the querySrv ECONNREFUSED error. Ask them to check SRV DNS resolution from the worker/stamp for *.global.mongocluster.cosmos.azure.com.

    So not a MongoDB auth issue. It’s either an Azure Functions/App Service DNS resolver issue or a platform regression around SRV lookups in that runtime/stamp.

    rgds,

    Alex

    &

    If my answer was helpful pls mark it and additional thx if u follow me at Q&A portal
    

    and at my blog https://ctrlaltdel.blog/

     

    Was this answer helpful?

    0 comments No comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.