Azure DNS / Private DNS Zones / Private Resolver Complete Guide: Hybrid DNS Design

1) Azure DNS (Public): authoritative DNS hosting for public domains (such as example.com), name resolution via Microsoft's global Anycast network, designed for Microsoft 365 and websites. 2) Azure Private DNS Zones: private DNS zones scoped to a VNet, essential for Private Endpoint and VM internal name resolution, invisible from the public internet. 3) Azure DNS Private Resolver: a managed hybrid DNS resolution service that went GA in 2022, enabling bidirectional DNS forwarding between on-premises and Azure. Each is an independent service, and they are commonly used in combination. Private DNS Zones are practically required when you use Private Endpoints, and adding Private Resolver is the modern best practice for hybrid environments.

A Private DNS Zone is a DNS zone scoped to a VNet. Typical use cases: 1) Private Endpoint name resolution (for example, create the privatelink.blob.core.windows.net zone, link it to your VNet, and A records are registered automatically when you create a Private Endpoint), 2) VM internal name resolution (custom zone such as corp.contoso.local), 3) supporting AKS Service Discovery. Setup steps: create the Private DNS Zone → associate it with the target VNet via a Virtual Network Link (use Registration Enabled for automatic VM DNS registration, or Resolution Only for read-only). The privatelink.* zones used together with Microsoft Entra Connect Sync follow Microsoft's recommended naming convention and are auto-configured when you create a Private Endpoint in the Azure Portal.

Azure DNS Private Resolver is a managed DNS resolution service that went GA in 2022. It provides bidirectional forwarding between on-premises DNS servers and Azure Private DNS Zones. It exposes two endpoints: the Inbound Endpoint (receives DNS queries from on-premises DNS, resolves Private DNS Zones, and returns the answers) and the Outbound Endpoint (forwards queries for specific on-premises domains from Azure VMs to on-premises DNS). The DNS Forwarding Ruleset declaratively manages which domain forwards to which target. Previously you had to build a VM-based DNS forwarder (BIND or Windows DNS Server) inside the VNet, but Private Resolver makes this fully managed. Starting at roughly 200-300 USD per month, it dramatically simplifies DNS infrastructure for hybrid environments.

Conditional Forwarding is the pattern of forwarding queries for specific domains to another DNS server. Common patterns: 1) on-premises DNS forwards privatelink.blob.core.windows.net to the Azure DNS Private Resolver Inbound Endpoint (10.x.x.x) → Private Endpoints can now be resolved from on-prem, 2) an Azure VM DNS forwarder forwards corp.contoso.local to on-premises DNS (192.168.x.x) → on-prem resources can be resolved from Azure. Private Resolver's Outbound Endpoint plus DNS Forwarding Ruleset manages this declaratively. On the on-premises side (Windows DNS Server, BIND, F5 BIG-IP, etc.) you must also configure a Conditional Forwarder. Without consistent configuration on both sides, name resolution will fail.

Azure DNS (Public) is Microsoft's Anycast-based authoritative DNS, resolves from edge locations worldwide, offers a 100% SLA (for a single DNS zone), and costs roughly USD 0.50 per zone per month plus USD 0.40 per million queries — among the cheapest options. Functionally it is equivalent to Cloudflare DNS, Google Cloud DNS, and AWS Route 53. For Azure-centric organizations, Azure DNS is the natural choice from an operations consolidation, cost, and integration perspective. Differentiators: 1) Alias Record integration with Azure resources (App Service, Application Gateway) that automatically tracks IP changes, 2) zone management secured by Microsoft Entra ID + RBAC, 3) Azure Monitor integration. Unless you have a specific reason to stick with a third-party DNS, Azure DNS is the default choice.

DNSSEC for Azure DNS (Public) is moving from Preview to GA in 2024, and as of this writing is available in some regions. Once fully GA, DNSSEC can be enabled on every public zone. DNSSEC prevents tampering of DNS responses (DNS spoofing) and is often a hard requirement for government and financial institutions. Azure DNS's DNSSEC is fully Microsoft-managed — no key management on your side, and Zone Sign / KSK / ZSK rollover are all automatic. The added cost is small (a few USD per month), and enabling it requires you to register a DS record at the parent zone (the TLD registrar — e.g., GoDaddy or Cloudflare Registrar for .com). Once Microsoft completes DNSSEC GA, enabling it on production public zones is recommended.

Common pitfalls: 1) forgetting to integrate a Private DNS Zone when creating a Private Endpoint, causing name resolution failures, 2) setting VNet Custom DNS (Custom DNS = on-prem DC IP) which disables the Azure-provided DNS so Private DNS Zones stop working (you must point VNet DNS at the Private Resolver Inbound Endpoint), 3) creating the same Private DNS Zone separately in multiple VNets, which leads to inconsistency (consolidate in the Hub VNet), 4) forgetting the on-premises Conditional Forwarder, so Private Endpoints cannot be resolved from on-prem, 5) using the same FQDN on both Public and Private DNS, leading to unexpected split-horizon DNS behavior, 6) setting DNS TTL too high, causing slow change propagation (under 1 hour is recommended), 7) forgetting Resource Locking on Azure DNS, creating accidental deletion risk. With the rise of Private Endpoint, DNS design has become dramatically more critical.

AZ-700 (Network Engineer Associate) tests Azure DNS, Private DNS Zone, and Private Resolver deeply, with hybrid DNS design appearing frequently. AZ-104 (Administrator) covers the fundamentals in domain 4, AZ-305 (Solutions Architect Expert) addresses DNS strategy from the architect viewpoint, AZ-800 / AZ-801 (Windows Server Hybrid) covers hybrid AD DS DNS, and SC-100 (Cybersecurity Architect Expert) covers zero-trust networking and name-resolution security. In modern Azure designs that rely heavily on Private Endpoints, understanding DNS is an essential skill.