Azure VNET cannot resolve a specific domain name

gerard bastos 0

I currently Have an Azure VNET which cannot resolve my Dynamics 365 domain name when I try to query the API.

This VNET is setup with private DNS zones for an azure APIM instance and for my test, I allowed all ports in the associated Network security group.

I have a VM within this VNET And I am trying to query the Dynamics 365 API from it (using a powershell script).

The domain name of this endpoint is sandbox.operations.eu.dynamics.com. When I try to query this api from my VM am getting the following error:

The remote name could not be resolved: 'xxxx-xxxx.sandbox.operations.eu.dynamics.com'

The strange thing is that When I try to query this API from my laptop (outside this VM), it is working fine. I have also tried to query other APis like the like reqres.in from my VM and it worked fine, I am only experiencing this issue with my Dynamics domain name.

What could i do to fix it ?

Thank you

KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-11-06T04:20:20.8+00:00
@gerard bastos

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are unable to resolve a particular domain within your VNET.

Can you share the list of names of all the Private DNS Zone Linked to this VNET?

From the VM, open a CMD as Admin and run,

nslookup <yourDomain>

nslookup <yourDomain> 168.63.129.16

nslookup <yourDomain> 8.8.8.8

Please share the results of the above,

Cheers,

Kapil

gerard bastos 0

Thank you @KapilAnanth-MSFT for your quick answer, I am getting the following results (anonymized) :

C:\Users\mayname>nslookup xxxx-xxxx..sandbox.operations.eu.dynamics.com
Server:  UnKnown
Address:  168.63.129.16

Non-authoritative answer:
Name:    xxxx-xxxx..sandbox.operations.eu.dynamics.com


C:\Users\mayname>nslookup xxxx-xxxx..sandbox.operations.eu.dynamics.com 168.63.129.16
Server:  UnKnown
Address:  168.63.129.16

Non-authoritative answer:
Name:    xxxx-xxxx..sandbox.operations.eu.dynamics.com


C:\Users\mayname>nslookup xxxx-xxxx..sandbox.operations.eu.dynamics.com 8.8.8.8
Server:  dns.google
Address:  8.8.8.8

Non-authoritative answer:
Name:    apimgmths3vubg0xxxxxhvqvojf5mrzwpvi2gw2hxcija.cloudapp.net
Address:  20.128.65.181
Aliases:  xxxx-xxxx..sandbox.operations.eu.dynamics.com
          d365-ops-prod-xx-xxx-westeurope-xvdwe15.azure-api.net
          apimggttmwqrnthwknm9ekqv6hryjrkl28suhgxdk7ebukpl7z.trafficmanager.net
          d365-ops-prod-xx-xxx-westeurope-sndwe15-westeurope-01.regional.azure-api.net

KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-11-07T10:20:21.7733333+00:00
@gerard bastos

Thanks for sharing the info.

What about my question, "Can you share the list of names of all the Private DNS Zone Linked to this VNET?"

It appears you have the private DNS zone "sandbox.operations.eu.dynamics.com" linked to your VNET.

May I ask if this is correct?

If so, may I ask why you have linked this zone to VNET?

Is there any document you are following?

Private DNS Zones are only expected to be used should you be connecting to the resource via a Private EndPoint .

If your intention is to connect via Public Internet, then you should not link the zone to the VNET.

Cheers,

Kapil
gerard bastos 0 Reputation points

2023-11-07T10:55:21.54+00:00
Hello @KapilAnanth-MSFT

I do not have the sandbox.operations.eu.dynamics.com dns zone linked to my VNET.

I currently have the following private dns zones:

azure-api.net

developer.azure-api.net

management.azure-api.net

portal.azure-api.net

scm.azure-api.net

My original goal was to create an Azure API management instance in internal mode, for this, I simply followed the exact setup of the Microsoft apim-landing-zone accelerator Project.

In this project, the rationale for using dns zones is as follows

Due to the Azure Functions being exposed over a private endpoint that this reference architecture uses, you must use a private DNS zone.

I am not using azure functions in my project but I am using an Application gateway instance, If i remove the private DNS zones will it work ?

Thank you in advance for your help !
KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-11-07T11:33:46.77+00:00
@gerard bastos

Thanks for the information.

I still suspect there is a private DNS Zone with "sandbox.operations.eu.dynamics.com" or maybe just "dynamics.com" .

As next actions,

#1

You can simply deploy a dummyVM in a dummyVNET and see if DNS resolution works in this dummyVM

This is to make sure that Azure Wireserver IP 168.63.129.16 has no problem.

#2

Generally, App gateway does not have any dependency on Private DNS Zone.

However, we cannot confirm without looking at the environment or architecture.

If this is a test environment, or if you could spin up a new similar test environment , you can delete all the private DNS Zones and give it a try.

Cheers,

Kapil
KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-11-08T06:29:54.9366667+00:00

@gerard bastos

Can you please update us if the action plan provided was helpful?

Thanks,

Kapil
KapilAnanth-MSFT 47,491 Reputation points Microsoft Employee

2023-11-09T09:47:38.9766667+00:00

@gerard bastos

May I know if you got a chance to review my previous comment?

Please let me know if you are facing any challenges or if there are any follow-up questions, I shall be glad to address them.

Thanks,

Kapil

Share via

Azure VNET cannot resolve a specific domain name

Your answer