DNS Forwarding Rulesets
To control where queries go, you configure a DNS forwarding ruleset. This is a collection of rules that say, "queries for the corp.contoso.com domain should be sent to this specific on-premises DNS server IP." This is called conditional forwarding. You can link one ruleset to many virtual networks, which is useful in a hub-and-spoke network design to centralize DNS management. The resolver uses the outbound endpoint to send these forwarded queries.
Azure Private DNS Zones
For internal name resolution within Azure, you use Azure Private DNS zones. These zones host records for your private domains (like private.contoso.com) and are only accessible from virtual networks you link to them, not the public internet. To make a virtual machine use a private zone, you must create a virtual network link between the zone and the VM's network. You can also enable autoregistration, which lets VMs automatically create their own A records in the private zone when they get an IP address.
Using Custom DNS Servers
Sometimes you need to use your own custom DNS servers for a virtual network, such as when joining VMs to an on-premises Active Directory domain. You specify the IP addresses of these servers in the virtual network's settings. A common setup is to have your custom server handle queries for your internal corporate domains and then forward all other queries (like for public Azure services) to the Azure recursive resolver at the special IP address 168.63.129.16. This ensures VMs can resolve both internal and Azure hostnames.
Precedence and Propagation of DNS Settings
DNS settings can be configured at two levels: the virtual network or directly on a network interface (NIC). The NIC-level settings always win over the network-level settings. If you enable custom DNS for a network but don't list any server IPs, Azure will ignore the setting and use its default DNS. When you change the DNS servers for a virtual network, running VMs won't see the change until they renew their DHCP lease, which you can force with a command like ipconfig /renew on Windows. Avoid setting DNS inside the VM's operating system, as Azure may overwrite it during maintenance.
Advanced Configuration and the Private Resolver
For complex forwarding, like sending queries for a specific domain to a particular server, you set up conditional forwarding rules on your custom DNS servers. If using Windows Server as a forwarder, you must set the forwarding timeout to more than four seconds. This gives the Azure resolver enough time to respond and prevents it from incorrectly returning a public IP address for a private name. As a managed alternative, the Azure DNS Private Resolver simplifies this with built-in high availability and scalability. It integrates with Network Security Groups (NSGs), so you can control DNS traffic on port 53 while ensuring the resolver's necessary traffic is allowed.
StudyCerts
StudyCerts