private-dns

Azure Private DNS

What it is

Azure Private DNS hosts DNS records that linked virtual networks can resolve. A private DNS zone gives internal workloads a meaningful name for a private address—for example, a Private Endpoint address—without putting that name and address into public DNS.

Why it exists

Workloads need stable internal names, and Private Endpoints need names that resolve to their private addresses from the right networks. Private DNS provides that naming layer without operating DNS servers just to host the zone.

Key ideas

• Private DNS zone: a zone that holds internal DNS records. Link a VNet to let resources in that VNet resolve the zone’s records.
• Virtual-network link: the connection between the VNet and the zone. Linked VNets can resolve all records in that zone, even if the VNets are not peered; network connectivity for the resulting traffic is a separate requirement.
• Autoregistration: when enabled on a VNet link, Azure automatically creates and updates A records for VMs in that VNet as they are created, changed, or deleted. A VNet can have autoregistration enabled for only one private zone.
• Private Endpoint pattern: a service-specific privatelink zone maps the service name to the endpoint’s private IP. Follow the service’s documented zone name rather than inventing a suffix.
• Split horizon: a public and private zone can share a name and return different answers inside and outside the VNet.

How it fits

[VM in VNet A] ──► [Private DNS zone  privatelink.database.windows.net]
                       linked to VNet A & B
                       A record → private IP of the DB private endpoint

Diagrams courtesy of Microsoft Learn / Azure docs: dns/private-dns-overview

Northwind example

Northwind gives its private database endpoint a Private DNS name. The ordering VNet and reporting VNet are both linked to the relevant private zone, so their workloads resolve the database name to its private endpoint address. That DNS answer does not by itself create a usable network path or grant database access: routing, network rules, and database authorization still apply.

Avoid these mix-ups

• Public Azure DNS answers internet DNS queries; Private DNS answers through linked VNets.
• Private DNS is a naming service, not a network tunnel and not an access-control service.
• For name resolution between Azure and on-premises networks, use a supported forwarding design such as Azure DNS Private Resolver; VNet linking alone does not configure on-premises DNS.

Related

Home · azure-dns · vnet · subnet

📘 Source: Microsoft Learn — What is Azure Private DNS?