How to get on-prem DNS to resolve the FQDN of Azure Resource to it's IP

MS Techie 2,686 Reputation points
2022-03-10T09:01:18.263+00:00

We have Azure to on-premises connectvity via Express Route.

When we create a private endpoint for any azure resource (take example as Azure Storage blob), it creates the Azure Private DNS zone first time. Now i have a private IP for my Azure Storage and an FQDN for the same , which can be seen in Azure Private DNS zone.

My on-premises servers are not able to resolve this Azure Storage private endpoint FQDN to private IP.
So my question is how to make sure that on-premise servers are able to resolve this Azure FQDN of private endpoint to this private IP ?

Azure DNS
Azure DNS
An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
629 questions
Azure Private Link
Azure Private Link
An Azure service that provides private connectivity from a virtual network to Azure platform as a service, customer-owned, or Microsoft partner services.
484 questions
0 comments
Accepted answer
  1. GitaraniSharma-MSFT 49,261 Reputation points Microsoft Employee
    2022-03-10T10:03:29.59+00:00

    Hello @MS Techie ,

    Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

    I understand that you have Azure to on-premises connectivity via Express Route and have created private endpoints for Azure resources for secured connection, however your on-premises servers are not able to resolve the private endpoint FQDN to private IP and would like to know how to fix it.

    For on-premises workloads to resolve the FQDN of a private endpoint, use a DNS forwarder to resolve the Azure service public DNS zone in Azure. A DNS forwarder is a Virtual Machine running on the Virtual Network linked to the Private DNS Zone that can proxy DNS queries coming from other Virtual Networks or from on-premises. This is required as the query must be originated from the Virtual Network to Azure DNS. A few options for DNS proxies are: Windows running DNS services, Linux running DNS services, Azure Firewall.

    Reference : https://video2.skills-academy.com/en-us/azure/private-link/private-endpoint-dns#on-premises-workloads-using-a-dns-forwarder

    If you check the table in Name resolution for resources in Azure virtual networks article, you can find the below:
    https://video2.skills-academy.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

    181837-image.png

    Currently, there is no other way to accomplish this requirement as conditional forwarding isn't natively supported for Azure Private DNS but Azure Private DNS Zone resolution from On-Premise is planned and is on the roadmap. You can vote for this feature in the below forum:
    https://feedback.azure.com/d365community/idea/f50bd7e3-8526-ec11-b6e6-000d3a4f0789

    Hence, at the moment, you need to configure your on-premises DNS solution to forward DNS traffic to Azure DNS via a conditional forwarder that references the DNS forwarder deployed in Azure.

    Kindly let us know if the above helps or you need further assistance on this issue.

    ----------------------------------------------------------------------------------------------------------------

    Please "Accept the answer" below if the information helped you. This will help us and others in the community as well.

    5 people found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest