Azure Private DNS Conditional forwarders from on-prem/different cloud AD/DNS Server.

Question

Hello.

We have a very simple setup with ADDS/DNS VM in Azure & for redundancy a ADDS/DNS in an on-premises environment.
Both sites are linked via site-to-site VPN. All traffic is allowed.

So following the basic guidelines, we have a Virtual Network Link set up with Private DNS zone - privatelink.1.azurestaticapps.net
And a conditional forwarder in the VNET that is linked with the Private Zone - azurestaticapps.net, that points to 168.63.129.16 (as per instructions to use the Public domain name)

Resolution when querying the specific Azure based DNS server works with no issues whatsoever.

However the issue shows up when trying to set up a Conditional forwarder in the other DNS server.
As described in the article we have a DNS conditional forwarder for the zone - azurestaticapps.net, that points to the Azure DNS virtual machine.

However when trying to query the non-azure DNS Server, query always responds with public IP address, as if the Conditional Forwarder is ignored completely.

At the same time we have a non-cname based Private DNS zone e.g., contoso.lan, which is populated in Azure Private DNS with A records, and it works flawlessly from both DNS servers, which means that Conditional forwarding works with no issues.

Maybe it's something to do with Azure Static Web Apps and custom domain names.
We have an Azure Static Web app with enabled Private Endpoint, that has the FQDN passed from the Static Web App. And the setup is as per the Instructions.

PNE has FQDN - mango-field-9c2719f03.1.azurestaticapps.net
Private Zone (privatelink.1.azurestaticapps.net), has A record - mango-field-9c2719f03 that corresponds to the IP address of the PNE
And abovementioned DNS Conditional Forwarders are configured correctly.

Is there a mistake in the setup somewhere?

We've verified all traffic is passing through, DNS resolution works, AD Replication between both ADDS servers has no issues.

Any help would be appriciated.

Answer 1

Hello @Reinis Tropiņš ,

Apologies for the delay in response.

I understand that you have a conditional forwarder in your Azure VNET that is linked with the Private Zone - azurestaticapps.net, that points to 168.63.129.16, however, when trying to query the non-azure DNS Server, query always responds with public IP address and the Conditional Forwarder is ignored completely.

You can find all the details regarding conditional forwarding & the recommended config by Azure in the below doc:
https://github.com/dmauser/PrivateLink/tree/master/DNS-Integration-Scenarios#41-which-conditional-forwarder-zone-should-be-used

"There are reports that BIND-based DNS Servers (including Infoblox) work using conditional forwarders towards the privatelink.PaaS-domain zone (example: privatelink.blob.core.windows.net for storage accounts) without any issues. Therefore, please validate in your environment before deciding between adding the privatelink .PaaS-domain zone (privatelink.blob.core.windows.net as an example for storage accounts) or the default/Public PaaS zone (blob.core.windows.net)."

Most of On-premises DNS servers fall into the category where they will have a forwarder setup to point to another DNS server in customer's DMZ or point to ISP DNS Servers. Hence, conditional forwarding to the Public DNS forwarder is recommended because it is easy to implement.
Please check how your OnPrem DNS is configured and you may have an option to configure conditional forwarders to the PaaS domain zone or subdomain zone private link returned by the CNAME.

In your case, for Static webapps, the recommended Public DNS zone forwarder is either azurestaticapps.net or {partitionId}.azurestaticapps.net.
Refer : https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns#azure-services-dns-zone-configuration

Since, your Static webapp has a FQDN "mango-field-9c2719f03.1.azurestaticapps.net" which has a partition ID "1", I would advise you to setup the on-prem conditional forwarding to "1.azurestaticapps.net" and check again.

Could you please try the below setup:
Azure VM - 10.1.0.5 - Conditional forwarder pointing to - 168.63.129.16 for the zone 1.azurestaticapps.net
On-prem VM - 10.1.1.5 - Conditional forwarder pointing to - 10.1.0.5 for the zone 1.azurestaticapps.net

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Answer 2

Hi @Reinis Tropiņš

Thank you for asking this question on the **Microsoft Q&A Platform. **

I have kind of an analogous situation in my environment.

I fix it by doing the conditional forward in my On-premises to my ADDS/DNS VM in Azure not to 168.63.129.16

If you already have the conditional forward in your ADDS/DNS VM in Azure to 168.63.129.16 you won't have any issue.

Hope this helps,
Carlos Solís Salazar

----------

Accept Answer and Upvote, if any of the above helped, this thread can help others in the community looking for remediation for similar issues.
NOTE: To answer you as quickly as possible, please mention me in your reply.

---