Using Azure Private DNS Resolver in front of Azure Firewall [DNS Proxy]

Question

Using Azure Private DNS Resolver in front of Azure Firewall [DNS Proxy]

Ashish Bang 20

In our Azure landing zone, workload VMs are configured to use Azure Firewall as the DNS proxy, and this configuration must remain intact because certain external/public endpoints are already whitelisted at the firewall level.

We now need to resolve on-premises FQDNs (e.g., Active Directory zones) from these Azure workload VMs. To achieve this, I am evaluating how best to integrate Azure DNS Private Resolver (with inbound/outbound endpoints and a DNS forwarding ruleset) into the design.

Should the Azure Firewall continue receiving DNS queries from workloads and then forward them to the Private DNS Resolver inbound endpoint, which applies conditional forwarding for on-premises domains via the outbound endpoint? Or is there an alternate best-practice flow for positioning the DNS Private Resolver relative to Azure Firewall in this hybrid scenario?

Additionally, what are the required configuration considerations (rulesets, NSGs, firewall policies) to ensure public DNS queries, Azure Private DNS zones, and on-premises DNS resolution all coexist without breaking the existing firewall-based FQDN filtering?

Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2025-08-20T01:02:01.9433333+00:00

Hello Ashish Bang

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Ashish Bang 20 Reputation points

2025-08-20T05:45:55.6566667+00:00

Hi Praveen. Thanks for followin up. We have proceeded with the solution. Will let you know once I progress on it & what is the outcome. Thanks
Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2025-08-20T06:17:29.4633333+00:00

Hello Ashish Bang
Thank you for your response. You can go ahead with my suggestion and let me know the result. If you have any further queries, feel free to ask. In the meantime, I have converted my comment into an answer please try to accept it, as this will help other community members find it more easily.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Answer accepted by question author

0 additional answers

Your answer

Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2025-08-20T01:02:01.9433333+00:00

Hello Ashish Bang

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Ashish Bang 20 Reputation points

2025-08-20T05:45:55.6566667+00:00

Hi Praveen. Thanks for followin up. We have proceeded with the solution. Will let you know once I progress on it & what is the outcome. Thanks
Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2025-08-20T06:17:29.4633333+00:00

Hello Ashish Bang
Thank you for your response. You can go ahead with my suggestion and let me know the result. If you have any further queries, feel free to ask. In the meantime, I have converted my comment into an answer please try to accept it, as this will help other community members find it more easily.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Answer 1

Hello Ashish Bang
I understand that you are configuring Azure DNS Private Resolver in a hybrid setup, with Azure Firewall serving as your DNS proxy.you can use Azure Firewall to handle DNS queries from your workloads before forwarding them to the Private DNS Resolver inbound endpoint, this approach is effective. It keeps your DNS resolution process consistent and ensures Azure resources’ requests go through the firewall, so your current whitelisting and filtering rules remain in place.

Using Azure Firewall as a DNS proxy is generally recommended. Routing all DNS requests through the firewall aligns with best practices, helping maintain consistent DNS resolution and supporting your FQDN filtering needs.

Make sure the DNS proxy feature is turned on for Azure Firewall. Set up Azure Firewall to send DNS queries to the IP address of the Inbound Endpoint on the Azure DNS Private Resolver. Keep the current firewall rules that permit, or block traffic based on the resolved FQDNs.
And in the azure firewall VNET configure the custom DNS server to use the inbound endpoint IP of the Private DNS Resolver. Verify that the DNS proxy is enabled on Azure Firewall.
Configure conditional forwarding in your Azure DNS Private Resolver ruleset to ensure that queries for on-premises domains are routed correctly. Also, make sure your firewall policies permit the necessary DNS traffic and that the DNS proxy settings are correctly configured.
Ensure that your NSGs are configured to permit traffic between Azure Firewall, Azure DNS Private Resolver, and you're on-premises DNS servers.
When setting up Azure Private DNS zones, make sure they do not overlap with Microsoft-owned domains to prevent any disruptions.

Kindly check the below document for more understanding:

Azure DNS Private Resolver

https://learn.microsoft.com/en-us/azure/dns/private-resolver-hybrid-dns#hybrid-dns-resolution
https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview

Hope the above answer helps! Please let us know do you have any further queries.

Please do not forget to "accept answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Praveen Bandaru 11,800 Reputation points Microsoft External Staff Moderator

2025-08-21T03:15:04.11+00:00

Hello Ashish Bang

I just wanted to follow up and see if you had a chance to review my response to your question. Please let us know if it was helpful, and feel free to reach out if you have any further queries.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.
Ashish Bang 20 Reputation points

2025-08-21T08:34:38.93+00:00

Hi Praveen, I have accepted the answer. Although I can only give a final confirmation once the solution works as expected. Thanks for all your support.