Why does azure bot's .directline.botframework.com DNS not resolve with private endpoint enabled, but the .privatelink does.

Question

Why does azure bot's .directline.botframework.com DNS not resolve with private endpoint enabled, but the .privatelink does.

nslookup

Default Server:  UnKnown

Address:  168.63.129.16

 

TestBot890.directline.botframework.com

Server:  UnKnown

Address:  168.63.129.16

 *** UnKnown can't find TestBot890.directline.botframework.com: Non-existent domain

TestBot890.privatelink.directline.botframework.com

Server:  UnKnown

Address:  168.63.129.16

 

Non-authoritative answer:

Name:    TestBot890.privatelink.directline.botframework.com

Address:  10.0.0.7

 

Answer 1

Hi Pooja-5119

Thanks for using the Q&A platform.

This behavior is expected when you enable Private Endpoint for Azure Bot Service. When a Private Endpoint is enabled for a PaaS service like Direct Line, Azure configures a private DNS zone to route traffic over a private IP.

Azure uses split-horizon DNS to isolate private endpoint traffic from public networks. When the private endpoint is in use:

• Public resolution is disabled or suppressed to avoid accidental data leakage over the public internet.
• Clients in the VNet must use the private DNS zone or have appropriate DNS forwarding rules in place.

Use the *.privatelink.directline.botframework.com address internally for bot communication.

If you must use the public hostname, avoid binding a private endpoint to Direct Line or configure DNS forwarding selectively.

Find documentation: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns

If the response was helpful, please feel free to mark it as “Accepted Answer” and consider giving it an upvote. This helps others in the community as well.

Regards,

Obinna.