This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(307.2, 81%, 39%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERJ%3C/text%3E%3C/svg%3E)
Hello.
I'm going to have a bunch of context followed by a question, so bear with me.
Context:
I have a DNS / Privatelink question / issue.
I have two VNETs, one is our "private", main, internal VNET (VNET1), the 2nd is a VNET (VNET2) that we have a 3rd party building an application in for us. I have an Express Route from my on-prem datacenter to Azure.
We have the VNETs peered with NSG in place and there is connectivity.
Both VNETs have private links configured for the resources and there are duplicate privatelink.xxx.com/net private dns zones for each VNET. In particular, privatelink.azurewebsites.net
Until now, I had just created the privatelink.azurewebsites.net zone on our internal DNS / DDI platform (Infoblox) and manually put in the handful of entries we needed in there. Now that VNET2 is being used, there are around 70 or so entries in that zone for that VNET.
My goal is to keep from having to update my on-prem DNS server with the entries from both privatelink private dns zones in azure.
I learned about the Private DNS Resolver. I deployed one in VNET1 and setup Infoblox to forward privatelink.azurewebsites.net requests to the Private DNS resolver in VNET1, and I can resolve private DNS entries in VNET1 as expected.
Then, I setup a second Private DNS Resolver in VNET2, I set Infoblox to forward requests to that IP, again, working as expected for private entries in VNET2.
I setup Infoblox with two forwarders for that zone, one to each private resolver, but, it only forwards the requests to ONE of the resolvers based on the order I enter them into the config. I was hoping it would forward to BOTH and return whichever entry comes back, but that's not the case.
Question(s):
Is there any way I can access the dns entires for BOTH VNETs without having to manually manage the zone on-prem? Is there any way to use the private resolver with outbound endpoints or anything to access the other VNET?
Hello @Ryan Jensen ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
May I know what is the reason for using 2 Azure DNS Private Resolvers in 2 Vnets?
You can simply deploy one Azure DNS Private Resolver and use them for both Vnets (hub-spoke network topology) as explained in the below docs:
https://learn.microsoft.com/en-us/azure/dns/private-resolver-architecture
https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets
When using 2 Azure DNS Private Resolvers, the DNS query will use the client's default DNS server. This setup is usually configured for resiliency and DNS failover.
Refer: https://learn.microsoft.com/en-us/azure/dns/private-resolver-reliability
DNS failover is enabled by assigning a local resolver as your primary DNS and the resolver in an adjacent region as secondary DNS. If the primary DNS server fails to respond, DNS clients automatically retry using the secondary DNS server.
When configuring on-premises DNS forwarding, it will use the default/primary DNS server. If the server you want to query is not the default, you'll need to query it's IP address directly (ex: nslookup test.azure.contoso.com 10.100.0.2) after forwarding is configured.
Regards,
Gita
@Ryan Jensen , could you please provide an update on this post and share the requested detail/information for further discussion?
@Ryan Jensen , do you have any updates on this post?
@Ryan Jensen , Could you please provide an update on this post? Kindly let us know if the above helps or you need further assistance on this issue.
@Ryan Jensen , I would request to close the thread by clicking "Accept the answer", as this can be beneficial to other community members.
And, if you have any further questions do let us know.
Yes, sorry. Forgot to come back here.
This is resolved; I was able to link the 3 VNETs to the ONE privatelink DNS zone and then manually merge them together.
Now I can use one Private Resolver to access all the records I need.
@Ryan Jensen , thank you for the update. Glad to hear that the issue is now resolved.
Since you cannot accept your own answer, I'm summarizing the answer below.
Please "Accept the answer" as this will help us and others in the community as well.
Regards,
Gita
Hello @Ryan Jensen ,
You wanted to know if there is a way to access the DNS entries for 2 Vnets without having to manually manage the DNS records in your on-prem DNS server and if it is possible by using the Azure DNS Private Resolver with outbound endpoints.
You were using 2 Azure DNS Private Resolvers in 2 Vnets but this is not recommended unless your requirement is DNS failover.
When using 2 Azure DNS Private Resolvers, the DNS query will use the client's default DNS server. This setup is usually configured for resiliency and DNS failover.
Refer: https://learn.microsoft.com/en-us/azure/dns/private-resolver-reliability
DNS failover is enabled by assigning a local resolver as your primary DNS and the resolver in an adjacent region as secondary DNS. If the primary DNS server fails to respond, DNS clients automatically retry using the secondary DNS server.
When configuring on-premises DNS forwarding, it will use the default/primary DNS server. If the server you want to query is not the default, you'll need to query it's IP address directly (ex: nslookup test.azure.contoso.com 10.100.0.2) after forwarding is configured.
You can simply deploy one Azure DNS Private Resolver and use them for both Vnets (hub-spoke network topology) as explained in the below docs:
https://learn.microsoft.com/en-us/azure/dns/private-resolver-architecture
https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets
The spoke virtual networks are linked to private DNS zones, which makes it possible to resolve the names of private link resources.
You were able to link 3 Vnets to a single private DNS zone and then manually merge them together.
And now you can use a single Azure DNS Private Resolver to access all the records you need.
Kindly let us know if you need further assistance on this issue.
Please don’t forget to close the thread by clicking "Accept the answer", as this can be beneficial to other community members.