Hello @Mahesh Badgujar ,
Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.
I understand that you would like to use Azure DNS private resolver in your network setup to resolve Azure Private DNS zones but are concerned about the recommendation from Microsoft mentioned here about deploying Azure DNS Private Resolver into a virtual network that has an ExpressRoute virtual network gateway and setting wildcard rules.
The recommendation provided in the doc is not against deploying Azure DNS Private Resolver into a virtual network that has an ExpressRoute virtual network gateway, but it is against deploying Azure DNS Private Resolver with wildcard rules to direct all name resolution to a specific DNS server, into a Vnet that has an ExpressRoute gateway.
This is because of the rule processing behavior mentioned in the below doc:
Certain domains are ignored when using a wildcard rule for DNS resolution, because they are reserved for Azure services. See Azure services DNS zone configuration (https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#azure-services-dns-zone-configuration) for a list of domains that are reserved. The two-label DNS names listed in this article (for example: windows.net, azure.com, azure.net, windowsazure.us) are reserved for Azure services. So, as long as you are not using a wildcard rule for DNS resolution, you can deploy Azure DNS Private Resolver into a virtual network that has an ExpressRoute virtual network gateway without any issues.
You can see the suggested architecture below:
Kindly let us know if the above helps or you need further assistance on this issue.
Please don’t forget to "Accept the answer" wherever the information provided helps you, this can be beneficial to other community members.