Hello, Is there any limit for the number of virtual network links we can create from private DNS zones to DNS private resolver? I am asking because we might have in future a lot of subscriptions where owners will create private DNS zones which will be linked to Private DNS resolver. We would like to know upfront for any possible limitations for the number of virtual links. Thanks

@Aliaksandr Azherelyeu , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I am afraid I did not quite understand your question. Technically, "virtual network links we can create from private DNS zones to DNS private resolver" is not correct. Virtual Network Link can exist between Private DNS Zone and a VNET DNS forwarding ruleset and a VNET Both of these limits are as below : Virtual Network Links per private DNS zone - 1000 See : Azure Limits Virtual network links per DNS forwarding ruleset - 500 See : DNS forwarding rules Also, keep in mind the below numbers as well Number of private DNS zones a virtual network can get linked - 1000 Please let us know if we can be of any further assistance here. Thanks, Kapil Please Accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

Limitation for the number of virtual links to DNS private resolver

Accepted answer

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-07-29T08:41:30.5066667+00:00
@Aliaksandr Azherelyeu ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I am afraid I did not quite understand your question.

Technically, "virtual network links we can create from private DNS zones to DNS private resolver" is not correct.

Virtual Network Link can exist between

Private DNS Zone and a VNET

DNS forwarding ruleset and a VNET

Both of these limits are as below :

Virtual Network Links per private DNS zone - 1000

See : Azure Limits

Virtual network links per DNS forwarding ruleset - 500

See : DNS forwarding rules

Also, keep in mind the below numbers as well

Number of private DNS zones a virtual network can get linked - 1000

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Please sign in to rate this answer.
Aliaksandr Azherelyeu 20 Reputation points

2024-07-29T09:20:19.4033333+00:00

Hello @KapilAnanth-MSFT

Thanks for reaching me out!

Sorry for the confusion. Yeah, what I meant is the creation of a virtual network link from private DNS zone to VNet of Private DNS resolver. I've just realized I can't link private DNS zones with the same name (privatelink.file.core.windows.net) located in different subscriptions to the same VNet of the Private DNS resolver:

So, the question for limit isn't valid anymore. But this reply is also valuable - Number of private DNS zones a virtual network can get linked - 1000

What I am trying to achieve is the resolving of resources configured with a privatelink from private DNS zone, e.g.,:
tesalextestpss.privatelink.file.core.windows.net belongs to pss subscription
tesalextesttst.privatelink.file.core.windows.net belongs to tst subscription

How can I make them resolvable using DNS private resolver?

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-07-29T09:55:13.4433333+00:00

You are welcome @Aliaksandr Azherelyeu .

I take it that "tesalextestpss" and "tesalextesttst" are entries in the Private DNS Zone privatelink.file.core.windows.net.

In this case,

You will have only one Private DNS Zone privatelink.file.core.windows.net which is linked to the VNET that hosts the DNS Resolver.

Private DNS Resolver is capable of resolving both these records provided the configuration is correct.

The resolution should be straightforward.

If your intention is to restrict users from one tenant/subscription to query resource of another tenant/subscription, I am afraid this won't be possible.

Instead, I would suggest you leverage NSGs on the private endpoint's subnets.

This way, even if "pss" subscription could resolve the IP value of "tesalextesttst.privatelink.file.core.windows.net" - they will not be able to connect to the resource.

See : Network security groups support for private endpoints

Hope this adds more clarity

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Aliaksandr Azherelyeu 20 Reputation points

2024-07-29T12:30:47.0333333+00:00

Hello @KapilAnanth-MSFT

I take it that "tesalextestpss" and "tesalextesttst" are entries in the Private DNS Zone privatelink.file.core.windows.net. - we are going to have two same private dns zone names privatelink.file.core.windows.net in two different subscriptions:

So, linking inbound endpoint of Private DNS resolver to two private DNS zones isn't possible due to an error above.

What if I create custom private DNS zones per subscription, e.g., tst.testalex.com and pss.testalex.com and create CNAMes. Would it solve the problem?

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-07-30T10:52:01.1933333+00:00

This is not recommended @Aliaksandr Azherelyeu .

The suggestion would be to have a single zone in linked to the VNET that contains the Private DNS Resolver.

And configure all DNS records into this.

For a custom domain, "testalex.com"

Having two zones as "tst.testalex.com" and "pss.testalex.com" might be okay

Provided that the service actually supports the hostname for SNI

i.e.,

Consider a website that uses the hostname www.testalex.com

However, because of the DNS, all the requests would reach the site with the host as either www.tst.testalex.com or www.pss.testalex.com

The site should support such hostnames in it's TLS

For a PaaS Service's domain, say "file.core.windows.net"

The private endpoint would support both <FILENAME>.file.core.windows.net and <FILENAME>privatelink.file.core.windows.net

So it makes sense to have the prefix "privatelink" before the actual domain.

But the service would not support any other hostnames other than the above mentioned two.

Hope this adds some clarity

Cheers,

Kapil

Aliaksandr Azherelyeu 20 Reputation points

2024-07-31T08:10:03.4033333+00:00

Hi @KapilAnanth-MSFT

I found this article https://learn.microsoft.com/en-us/answers/questions/561794/vnet-link-to-multiple-private-dns-zones which describes exactly the same use case. As I understand from your reply as well as from the article I must have only one Private DNS zone where all entries to be registered. What I need to do is to allow Landing zone owners to be able to access the subnet to register their private endpoints in that Private DNS zone. I assume auto-registration doesn't work for PaaS resources.

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-08-01T09:58:25.5466667+00:00

@Aliaksandr Azherelyeu ,

This actually depends.

#1 All the private endPoints are created in the VNET (which has the Private DNS Zone linked to it)

In that case, this is straight forward

As you/users create new private endPoints, their IPs are updated into the Zone (during creation from Portal) automatically

#2 The Private endPoints are created in different VNETs (different subscription within same tenant as well)

In that case too, the private endpoint created can be linked to the Private DNS Zone in the Hub's VNET (which has the Private DNS Zone linked to it)

This is straight forward from portal

#3 The Private endPoints are created in different VNETs (different tenants )

In this case, you have to manually update the Zone linked to the VNET with the IP values.Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Aliaksandr Azherelyeu 20 Reputation points

2024-08-01T11:03:36.4766667+00:00

Hi @KapilAnanth-MSFT

The only one remark is that DNS recordsets of PaaS resources are not automatically added in custom private DNS zones:

It only works if I click "Yes" and choose privatelink.* zone

KapilAnanth-MSFT 46,876 Reputation points Microsoft Employee

2024-08-01T11:10:23.76+00:00

@Aliaksandr Azherelyeu , that is correct.

You get the option to enable/disable and choose the Private DNS Zone (and Subscription) while you use the Portal

Should you select "Yes", the record is automatically updated into the DNS Zone.

However, with Powershell/CLI,

You have additional steps

See : Configure the private DNS zone

This additional step can be eliminated with Portal with a single click.

Thanks,

Kapil

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Limitation for the number of virtual links to DNS private resolver

0 additional answers

Your answer