Azure Learning

private-dns

Properties2
tagsnetworking, dns, private-dns, name-resolution
aliasesPrivate DNS, private DNS zones, DNS resolution inside VNet

2 min read

Azure Private DNS

What it is

Azure Private DNS provides authoritative name resolution inside your Virtual Networks using private DNS zones (e.g. privatelink.database.windows.net), without exposing hosts to the public internet. It’s the counterpart of public Azure DNS for internal workloads.

Why it exists

Public DNS won’t resolve private IPs, and cloud-native auto-provided DNS (.internal, azureinternal) is generic. Workloads need custom, stable internal hostnames and must resolve Azure Private Link endpoints. Private DNS gives you clean names for VMs, DBs, storage accounts (via private endpoints) — all within the VNet.

Key ideas

  • Private DNS zone — like a public zone but linked to VNets so only VNet-connected resources resolve it.
  • Virtual network link + auto-registration: when auto-registration is on, VMs in a linked subnet can auto-create their A/PTR records (their hostname → private IP).
  • Resolution — the zone’s records resolve for any VM whose VNet is linked to it; name suffix differences across zones handled by priority/zone scope rules.
  • Common pattern: Private Endpoint + privatelink.<service>.windows.net zone records map the service private IP.
  • Public vs Private: Public zones are authoritative from the internet; private zones are authoritative inside linked VNets.

How it fits

[VM in VNet A] ──► [Private DNS zone  privatelink.database.windows.net]
                       linked to VNet A & B
                       A record → private IP of the DB private endpoint

private-dns - Microsoft diagram

Diagrams courtesy of Microsoft Learn / Azure docs: dns/private-dns-overview

Exam notes

  • Public Azure DNS = internet-facing; Private DNS = custom internal name resolution in your VNets.
  • Enable auto-registration on the VNet link to auto-populate VM A/PTR records.
  • Use privatelink.* zones with Private Endpoints for PaaS (SQL, Storage, etc.).
  • Split-horizon: a record that should resolve both inside and outside needs the public zone (for internet) and private zone (for internal) — keep them in sync or use the Private Endpoint pattern.

Home · azure-dns · vnet · subnet

📘 Source: Microsoft Learn — Private Dns

Graph View

Backlinks