Azure Hybrid DNS Architecture

Question

Azure Hybrid DNS Architecture

Trenton Whitaker 20

Sometime back we set up our hybrid azure connectivity and dns solution.

We force tunnel all internet traffic and public dns resolution to on premise. while privatelink DNS look ups went to a forwarder inside azure.

All recent documentation point to using azure private link for public resolution and not forwarding the privatelink zone alone. Where is the original documentation referencing this design?

Venkatesan S 6,350 Reputation points Microsoft External Staff Moderator

2026-03-06T17:40:58.0666667+00:00

Hi Trenton Whitaker,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up vote” if the information helped you. This will help us and others in the community as well.

Answer accepted by question author

1 additional answer

Your answer

Venkatesan S 6,350 Reputation points Microsoft External Staff Moderator

2026-03-06T17:40:58.0666667+00:00

Hi Trenton Whitaker,

We haven’t heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please “up vote” if the information helped you. This will help us and others in the community as well.

Answer 1

Hi Trenton Whitaker,

Thanks for reaching out in Microsoft Q&A forum,

All recent documentation point to using azure private link for public resolution and not forwarding the privatelink zone alone. Where is the original documentation referencing this design?

The original design you described force-tunneling all public/internet DNS to on-premises while using Azure forwarders specifically for Private Link zones (like privatelink.database.windows.net) stems from early hybrid networking guidance in Microsoft's Azure Architecture Center.

Core document:

This pattern is outlined in the 2022 article "Design a Hybrid Domain Name System (DNS) Solution by using Azure" (https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-dns-infra). It describes hub-spoke topologies where on-premises DNS handles general resolution via VPN/ExpressRoute, with conditional forwarders in a hub VNet's DNS servers (or VMs) directing only Private Link traffic to Azure's recursive resolver at xxxxxxx. Private DNS zones link to VNets for autoregistration, keeping public lookups on-prem.

Recent document:

Newer guidance (post-2024) favors Azure DNS Private Resolver for bidirectional resolution without per-zone forwarders, as in https://learn.microsoft.com/en-us/azure/dns/private-resolver-hybrid-dns. Your setup was standard before Private Resolver GA, aligning with pre-2023 best practices for split-brain DNS in hybrid environments.

While understandably correct for the new guidance. The previous guidance fits my Orgs security compliance, and I would like some assistance in finding the older reference documentation.

I understand your compliance needs favor the older hybrid DNS pattern forcing public/internet traffic on-premises while forwarding only privatelink.* zones to Azure which remains technically valid despite guidance evolution.

Your setup precisely follows, is documented in the Azure Architecture Center's longstanding guidance: 'Design a Hybrid Domain Name System (DNS) Solution by using Azure' (https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-dns-infra). This 2022 reference details:

VNets configured with on-premises DNS IPs for force-tunneled public resolution over VPN/ExpressRoute.
Hub-based DNS forwarders (typically VMs) with conditional forwarders exclusively for privatelink zones (e.g., privatelink.database.windows.net), querying Azure's xx8.xx.xxx.16 resolver.
Private DNS zones linked to VNets for Private Endpoint A-record resolution.

While newer docs emphasize forwarding public zones (database.windows.net) for Azure's internal CNAME aliasing to privatelink.*, your implementation matches the pre-2023 enterprise standard designed for strict security controls. This pattern continues to function reliably without requiring changes."

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

The current guidance is to forward the public Azure service zones (for example, database.windows.net) to Azure, and let Azure handle the split-brain behavior by internally redirecting to the corresponding privatelink.* zones. This is explicitly documented in the Azure Private Endpoint DNS integration guidance.

The design described there is:

On-premises DNS uses a conditional forwarder for the public zone (for example, database.windows.net).
That conditional forwarder points to Azure DNS via an Azure DNS Private Resolver.
Azure then internally redirects to the privatelink.* zone and answers with the private IP from the linked private DNS zone.

The key statement in the documentation is:

“The conditional forwarding must be made to the recommended public DNS zone forwarder. For example: database.windows.net instead of privatelink.database.windows.net.”

This reflects the updated pattern and replaces older designs where only the privatelink.* zones were forwarded.

The context provided here does not include the older/original document that recommended forwarding only the privatelink zones; it only contains the current, updated guidance that you are already seeing.

References:

Trenton Whitaker 20 Reputation points

2026-03-05T21:31:16.9333333+00:00

While understandably correct for the new guidance. The previous guidance fits my Orgs security compliance, and I would like some assistance in finding the older reference documentation.
Venkatesan S 6,350 Reputation points Microsoft External Staff Moderator

2026-03-06T17:41:17.2666667+00:00

Hi Trenton Whitaker,

Check the above response in comment.

Share via

Azure Hybrid DNS Architecture

1 additional answer

Your answer