You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn Azure Private Endpoint DNS Configuration
4
+
services: private-link
5
+
author: mblanco77
6
+
ms.service: private-link
7
+
ms.topic: conceptual
8
+
ms.date: 04/14/2020
9
+
ms.author: allensu
10
+
---
11
+
# Azure Private Endpoint DNS Configuration
12
+
13
+
14
+
When connecting to a private link resource using a fully qualified domain name (FQDN) as part of the connection string, it's important to correctly configure your DNS settings to resolve to the allocated private IP address. Existing Azure services might already have a DNS configuration to use when connecting over a public endpoint. This needs to be overridden to connect using your private endpoint.
15
+
16
+
The network interface associated with the private endpoint contains the complete set of information required to configure your DNS, including FQDN and private IP addresses allocated for a given private link resource.
17
+
18
+
You can use the following options to configure your DNS settings for private endpoints:
19
+
-**Use the Host file (only recommended for testing)**. You can use the host file on a virtual machine to override the DNS.
20
+
-**Use a private DNS zone**. You can use [private DNS zones](../dns/private-dns-privatednszone.md) to override the DNS resolution for a given private endpoint. A private DNS zone can be linked to your virtual network to resolve specific domains.
21
+
-**Use your custom DNS server**. You can use your own DNS server to override the DNS resolution for a given private link resource. If your [DNS server](../virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances.md#name-resolution-that-uses-your-own-dns-server) is hosted on a virtual network, you can create a DNS forwarding rule to use a private DNS zone to simplify the configuration for all private link resources.
22
+
23
+
> [!IMPORTANT]
24
+
> It's not recommended to override a zone that is actively in use to resolve public endpoints. Connections to resources won't be able to resolve correctly without DNS forwarding to the public DNS. To avoid issues, create a different domain name or follow the suggested name for each service below.
25
+
26
+
## Azure services DNS zone configuration
27
+
Azure services will create a canonical name DNS record (CNAME) on the public DNS to redirect the resolution to the suggested private domain names. You'll be able to override the resolution with the private IP address of your private endpoints.
28
+
29
+
Your applications don't need to change the connection URL. When attempting to resolve using a public DNS, the DNS server will now resolve to your private endpoints. The process does not impact your existing applications.
30
+
31
+
For Azure services, use the recommended zone names as described in the following table:
32
+
33
+
|Private Link resource type |Subresource |Zone name |
34
+
|---------|---------|---------|
35
+
|SQL DB (Microsoft.Sql/servers) | Sql Server (sqlServer) | privatelink.database.windows.net |
The FQDN of the services resolves a public ip address, you have to change your DNS configuration to resolve the private IP address of the private endpoint.
70
+
71
+
DNS is a critical component to make the application work correctly by resolving in a right manner the private endpoint IP address.
72
+
73
+
Based on your preferences, the following scenarios are available for DNS resolution integrated:
74
+
75
+
-[Virtual Network workloads without custom DNS server](#virtual-network-workloads-without-custom-dns-server)
76
+
77
+
78
+
## Virtual Network workloads without custom DNS server
79
+
80
+
This configuration is appropriate for virtual network workloads without custom DNS server. In this scenario the client queries for the private endpoint IP address to Azure provided DNS [168.63.129.16](../virtual-network/what-is-ip-address-168-63-129-16.md). Azure DNS will be responsible for DNS resolution of the private DNS zones.
81
+
82
+
83
+
> [!NOTE]
84
+
> This scenario is using Azure SQL database recommended Private DNS zone. For other services you can adjust the model using the following reference [Azure services DNS zone configuration](#azure-services-dns-zone-configuration).
85
+
86
+
To configure properly you would need the following resources :
87
+
88
+
- Client virtual network
89
+
90
+
- Private DNS zone [privatelink.database.windows.net](../dns/private-dns-privatednszone.md) with [type A Record](../dns/dns-zones-records.md#record-types)
91
+
92
+
- Private endpoint information (FQDN record name and Private IP Address)
93
+
94
+
The following diagram illustrates the DNS resolution sequence from virtual network workloads using private dns zone
95
+
96
+
:::image type="content" source="media/private-endpoint-dns/single-vnet-azure-dns.png" alt-text="single virtual network and azure provided dns":::
97
+
98
+
This model can be extended to multiple peered virtual networks that are associated to the same private endpoint. This can be done by [adding new virtual network links](../dns/private-dns-virtual-network-links.md) to the private DNS zone for all peered virtual networks.
99
+
100
+
> [!IMPORTANT]
101
+
> A single private DNS zone is required for this configuration, creating multiple zones with the same name for different virtual networks would need manual operations to merge the DNS records
102
+
103
+
In this scenario there's a [hub & spoke](https://docs.microsoft.com/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) networking topology with the spoke networks sharing a common private endpoint and all the spoke virtual network are linked to the same private dns zone.
104
+
105
+
:::image type="content" source="media/private-endpoint-dns/hub-and-spoke-azure-dns.png" alt-text="hub and spoke with azure provided dns":::
106
+
107
+
108
+
## Next steps
109
+
-[Learn about Private Endpoints](private-endpoint-overview.md)
|**Azure Data Lake Storage Gen2**| Microsoft.Storage/storageAccounts | Blob (blob, blob_secondary)<BR> Data Lake File System Gen2 (dfs, dfs_secondary) |
@@ -100,52 +100,11 @@ Alias is a unique moniker that is generated when the service owner creates the p
100
100
When connecting to a private link resource using a fully qualified domain name (FQDN) as part of the connection string, it's important to correctly configure your DNS settings to resolve to the allocated private IP address. Existing Azure services might already have a DNS configuration to use when connecting over a public endpoint. This needs to be overridden to connect using your private endpoint.
101
101
102
102
The network interface associated with the private endpoint contains the complete set of information required to configure your DNS, including FQDN and private IP addresses allocated for a given private link resource.
103
-
104
-
You can use the following options to configure your DNS settings for private endpoints:
105
-
-**Use the Host file (only recommended for testing)**. You can use the host file on a virtual machine to override the DNS.
106
-
-**Use a private DNS zone**. You can use private DNS zones to override the DNS resolution for a given private endpoint. A private DNS zone can be linked to your virtual network to resolve specific domains.
107
-
-**Use your custom DNS server**. You can use your own DNS server to override the DNS resolution for a given private link resource. If your [DNS server](../virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances.md#name-resolution-that-uses-your-own-dns-server) is hosted on a virtual network, you can create a DNS forwarding rule to use a private DNS zone to simplify the configuration for all private link resources.
108
-
109
-
> [!IMPORTANT]
110
-
> It's not recommended to override a zone that is actively in use to resolve public endpoints. Connections to resources won't be able to resolve correctly without DNS forwarding to the public DNS. To avoid issues, create a different domain name or follow the suggested name for each service below.
111
-
112
-
For Azure services, use the zone names as described in the following table:
113
103
114
-
|Private Link resource type |Subresource |Zone name |
115
-
|---------|---------|---------|
116
-
|SQL DB (Microsoft.Sql/servers) | Sql Server (sqlServer) | privatelink.database.windows.net |
Azure will create a canonical name DNS record (CNAME) on the public DNS to redirect the resolution to the suggested domain names. You'll be able to override the resolution with the private IP address of your private endpoints.
147
-
148
-
Your applications don't need to change the connection URL. When attempting to resolve using a public DNS, the DNS server will now resolve to your private endpoints. The process does not impact your applications.
104
+
For complete detailed information about best practices and recommendations to configure DNS for Private Endpoints, please review [Private Endpoint DNS configuration article](private-endpoint-dns.md).
0 commit comments