Azure DNS
An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
462 questions
Dev Boxes connected to Virtual Network using DNS Resolvers not functioning as expected
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(9.6, 80%, 10%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EN8%3C/text%3E%3C/svg%3E)
NicholsonChristian-8918
0
Reputation points
We have a Dev Center that has a network connection setup to use a Virtual Network which has DNS Resolvers setup. When using the Private DNS resolvers in a traditional VM setup, DNS resolution happens as expected with the intermittent timeout issue. However VMs created through dev center are not using the DNS resolvers and DNS is not properly resolving even though these virtual machines are connected to the same virtual network, and the firewall rules and such in place on the network are still being respected.
{count} votes
-
KapilAnanth-MSFT 16,576 Reputation points Microsoft Employee2023-05-24T04:30:09.4833333+00:00 Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
It appears that Microsoft Dev Box is in preview
Now with Private DNS Resolver in this VNet,
- I believe you should be using a Centralized DNS architecture
- i.e, The DNS forwarding ruleset is linked to the VNet which hosts the private DNS Resolver
- And this VNet is configured to use default Azure provided DNS
Please let me know if the above configuration is not correct.
- From your Devbox, for the problematic domain,
- Open an elevated CMD and run
- nslookup www.contoso.com
- nslookup www.contoso.com 168.63.129.16
- nslookup www.contoso.com <Inbound EndPoint of Private Resolver>
- and share the results
Also, when you say it's not working properly, can you elaborate what's the issue you are facing?
Cheers,
Kapil
-
NicholsonChristian-8918 0 Reputation points
2023-05-24T18:30:49.16+00:00 Thanks @KapilAnanth-MSFT
We are using the Centralized DNS architecture, and the DNS forwarding ruleset is linked to the VNet and working properly when used with a standalone VM or host pool on that VNet, it is only the DevBoxes that aren't resolving correctly. The VNet is configured to use the default Azure provided DNS.Running the NSlookup on the Contoso domain in all cases works as expected and gets a response of the same series of IPs in each case 20.53.203.50,20.112.52.29 etc
But looking up a dns name for an item which we know is working in the standalone VM and hostpool which are in the same VNet, we get continuous DNS timeouts. The only working workaround we have is to tell the VNet to use designated DNS servers, one of the onprem DNS server connected via the Hybrid VPN architecture, and a second being the default 168.63.129.16, when using the toggle for Azure provided, any attempt to lookup one of the onprem addresses that do have matching DNS resolver rules, and work normally in a standalone VM or hostpool VM, returns a "DNS Timeout" error
-
KapilAnanth-MSFT 16,576 Reputation points Microsoft Employee
2023-05-25T08:34:06.2733333+00:00 I understand DNS resolution with <Inbound EndPoint of Private Resolver> with timeout errors.
Is it possible for you to share the screenshot for the below queries from a Devbox please? (so I can check it internally as well)
- nslookup www.contoso.com <Inbound EndPoint of Private Resolver>
- nslookup www.contoso.com
Because,
- With Centralized DNS architecture the default DNS server would be 168.63.129.16
-
- I want to know if Step3 (highlighted by me) is happening at all or not.
-
- Only if 168.63.129.16 is unable to resolve , will the queries reach the Inbound EndPoint of Private Resolver.
- So, I would like to know if the problem is whether
- The requests never reach the Inbound EndPoint to begin with
- Or is that the requests do reach the Inbound EndPoint, but for some reason, DevBoxes requests are not processed by Private DNS Resolver.
- So, please do nslookup www.contoso.com <Inbound EndPoint of Private Resolver> and share the output.
Cheers,
Kapil
-
KapilAnanth-MSFT 16,576 Reputation points Microsoft Employee
2023-05-26T06:08:23.0166667+00:00 Can you please update us if the action plan provided was helpful?
Should there be any follow-up questions or concerns, please let us know and we shall try to address them.
Thanks,
Kapil
-
NicholsonChristian-8918 0 Reputation points
2023-05-26T19:43:23.2533333+00:00 <Deleted due to duplicate post>
-
NicholsonChristian-8918 0 Reputation points
2023-05-26T20:18:38+00:00 Unfortunately the steps did not help.
As mentioned in my original response, when doing a nslookup www.contoso.com <Inbound EndPoint of Private Resolver> we receive the expected response with the microsoft IPs
See the attached slightly redacted screenshot which shows the response received when making the request for contoso as compared to making the request for an item specified in the DNS resolver rules. We have confirmed that the DNS resolver works as expected on standalone VMs and host pools configured in the traditional manner, however we get this response on a Dev Box instance which is connected to the same Virtual Network as the standalone test VM which did not have DNS issues. We retrieve the timeout shown here when we specify the internal resolver as well as when we do not specify the dns server to use.
We can also confirm that the network is appropriately connected and can reach the DNS server located on premise that is setup in Private Resolver as the forward as if we specify the onprem server as the server to use directly in the nslookup, it resolves appropriately. -
KapilAnanth-MSFT 16,576 Reputation points Microsoft Employee
2023-05-29T04:20:32.3466667+00:00 Thanks for the update.
In this case, we will need a specialized 1:1 session, where a support engineer can have a screen share session to pinpoint the issue. If you have a support plan you may file a support ticket, else please do let us know, we will try and help you get a one-time free technical support.
In case you need a one-time free technical support could you please send an email to AzCommunity[At]Microsoft[Dot]Com with the below details.
- Subject : Attn Kaananth | Dev Boxes connected to Virtual Network using DNS Resolvers not functioning as expected
- Thread URL: Link to this thread.
- Subscription ID: Subscription ID in which this Private DNS Resolver is hosted.
Cheers,
Kapil
Sign in to comment