Does VNet encryption support DNS Private Resolver where the DNS Private Resolver resource is not in the same VNet?

ZHANG, YI 20

VNet encryption limitation around DNS Private Resolver is documented. However can someone provide more description on the limitation?

I have a use case where the DNS Private Resolver is implemented in a hub VNet in a different subscription where VNet encryption is not enabled. But the spoke VNet subnet is linked to the hub DNS Private Resolver and the spoke VNet does have VNet encryption enabled. Does that limitation still apply here?

Ganesh Patapati 1,275 Reputation points Microsoft Vendor

2024-10-08T16:14:24.7033333+00:00
Hello ZHANG, YI,

Greetings,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Virtual networks with encryption enabled don't support Azure DNS Private Resolver.

Note: Other services that currently don't support virtual network encryption are included in our future roadmap.

In this article

Requirements

Availability

Limitations

Supported scenarios

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-encryption-overview

Please feel free to ask any more questions. We are pleased to help you.

Thanks,

Ganesh
ZHANG, YI 20 Reputation points

2024-10-08T16:50:35.73+00:00

Sorry but you didn't answer my question. I think you are stating that DNS Private Resolver is not supported period when VNet encryption is enabled (even for the use case that I brought up). Can you confirm that please?
Ganesh Patapati 1,275 Reputation points Microsoft Vendor

2024-10-08T17:08:03.95+00:00

Hello ZHANG, YI,

From what I understand, you're trying to set up a hub-and-spoke architecture where the DNS Private Resolver is in a different subscription than the spoke VNet. The spoke VNet has VNet encryption enabled, but the hub VNet does not.

In this scenario, the limitation of VNet encryption not being supported with DNS Private Resolver which is not possible. The reason is that the DNS Private Resolver is in a different subscription, and the VNet encryption is enabled on the spoke VNet, not the hub VNet.

Please feel free to ask any more questions. We are pleased to help you.

Regards,

Ganesh
ZHANG, YI 20 Reputation points

2024-10-08T17:17:34.4166667+00:00
Ganesh, thank you for the reply. Please confirm that the VNet encryption limitation does not apply when implemented in hub-and-spoke fashion where:

hub vnet contains the dns private resolver resource, and vnet encryption is disabled

spoke vnet is linked to the hub vnet dns private resolver, and vnet encryption is enabled

I think you are stating because the hub vnet does not have vnet encryption where dns private resolver is, this documented limitation does not apply to the hub-and-spoke use case as described. Is that correct?
Ganesh Patapati 1,275 Reputation points Microsoft Vendor

2024-10-08T18:10:00.3333333+00:00
Hey ZHANG, YI,Thank you for getting back!

I have reached out to the product team internally to obtain confirmation on this, and I will let you know soon.

With Regards,

Ganesh

Accepted answer

Ganesh Patapati 1,275 Reputation points Microsoft Vendor

2024-10-10T12:46:55.84+00:00

Hey ZHANG, YI,

Greetings,

We appreciate your patience!

As we got a confirmation from the Product team internally:

NOTE: The limitation is only on the VNET where the resolver endpoints are provisioned so it shouldn’t be an issue.

As for the limitation, VNET encryption only supports a few SKUs of VMs which under the hood is what runs Private Resolver.

If the above response helps answer your question, remember to "Upvote it" and "Accept Answer" so that others in the community facing similar issues can easily find the solution.

Your contribution is highly appreciated.

Best wishes,

Ganesh
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Does VNet encryption support DNS Private Resolver where the DNS Private Resolver resource is not in the same VNet?

0 additional answers

Your answer