Azure private DNS resolution problem

Question

I currently need to perform DNS resolution for a private Azure DNS zone from an on-premises environment using the Private DNS Resolver service. I have already configured the Private DNS Resolver's VNET to the Virtual Network Link of the private DNS zone, and I also have the Private Endpoint's VNET associated with the Virtual Network Link, but it always responds with the public IP address.

Answer 1

Hi @David Fernando Lopez Cueca

If on-premises clients are still resolving the public IP, the first thing I would verify is whether the query is actually reaching the Inbound Endpoint of Azure DNS Private Resolver.

The expected path should be:

On-premises DNS

→ Conditional Forwarder

→ DNS Private Resolver Inbound Endpoint

→ Private DNS Zone

→ Private Endpoint IP

A few checks:

• Confirm the on-premises DNS Conditional Forwarder points to the private IP of the Resolver's Inbound Endpoint.

• Confirm the Private DNS Zone is linked to the resolver VNet.

• Confirm the expected A record exists in the Private DNS Zone and points to the Private Endpoint IP.

• Make sure you are using the correct "privatelink.*" zone for the Azure service.

A very useful test is:

"nslookup <resource-fqdn> <inbound-endpoint-ip>"

If that returns the private IP, the Azure side is working and the issue is most likely your on-premises DNS forwarding configuration.

If it still returns the public IP, I would focus on the Private DNS Zone, VNet link, or missing/incorrect Private Endpoint record.

Also, for many Azure Private Endpoint scenarios, the Conditional Forwarder should be configured for the public service namespace, for example "database.windows.net", rather than only the "privatelink.*" namespace.

If you share the Azure service involved, the Private DNS Zone name, and the "nslookup" output, we can narrow it down quickly.

If this answer was helpful, please consider marking it as helpful or accepting it as the answer.