10.4 Hybrid Name Resolution with Azure DNS Private Resolver

Hybrid Name Resolution with Azure DNS Private Resolver

1. Hybrid DNS Resolution Challenges & The Special VIP (168.63.129.16)

In Microsoft Azure, default DNS resolution inside Virtual Networks is handled by the Azure wire server virtual IP: 168.63.129.16.

+-----------------------------------------------------------------------------+
|                  THE HYBRID DNS RESOLUTION ROUTING DILEMMA                  |
|                                                                             |
|   [ON-PREMISES NETWORK]                          [AZURE CLOUD VNET]         |
|   +-----------------------+                      +------------------------+ |
|   | On-Premises DNS       |                      | Azure Default Resolver | |
|   | (10.0.1.10)           |                      | 168.63.129.16 (VIP)    | |
|   +-----------------------+                      +------------------------+ |
|              |                                                |             |
|              | =====[ ExpressRoute / S2S VPN Tunnel ]=========              |
|              |                                                |             |
|              x (CANNOT ROUTE)                                 x             |
|              +---> 168.63.129.16 is a non-routable link-local  |             |
|                    IP address unreachable from on-premises.   |             |
+-----------------------------------------------------------------------------+

The Two Hybrid DNS Dilemmas:

1. On-Premises to Azure Resolution: When on-premises servers attempt to resolve Azure Private Endpoints (mysqldb.privatelink.database.windows.net), they cannot forward queries to 168.63.129.16 because that IP address is a link-local virtual IP reachable only from within the local Azure VNet host hypervisor.
2. Azure to On-Premises Resolution: If an Azure VNet's DNS settings are changed from "Default (Azure-provided)" to "Custom" (pointing to on-premises DC IP 10.0.1.10), Azure VMs can resolve on-premises records, but they lose native resolution for Azure Private DNS zones, breaking Private Endpoint connectivity for Azure Storage, Azure SQL, and Azure Key Vault.

2. Azure DNS Private Resolver Architecture

The Azure DNS Private Resolver is a fully managed, cloud-native PaaS service that bridges Azure Virtual Networks with on-premises DNS infrastructure without requiring custom virtual machines.

+-----------------------------------------------------------------------------+
|                 AZURE DNS PRIVATE RESOLVER FULL TOPOLOGY                    |
|                                                                             |
|   [ON-PREMISES DATACENTER]                       [AZURE CLOUD INFRASTRUCTURE]|
|   +-----------------------+                      +------------------------+ |
|   | Windows DNS Server    |                      | Azure DNS Resolver VNet| |
|   | (10.0.1.10)           |                      |                        | |
|   |                       |                      | +--------------------+ | |
|   | Conditional Forwarder |                      | | Inbound Endpoint   | | |
|   | for *.privatelink ->  | ---(VPN/ExpressRoute)| | Subnet (/28)       | | |
|   | points to Inbound IP  | ===================> | | IP: 10.100.1.4     | | |
|   +-----------------------+                      | +---------+----------+ | |
|              ^                                   |           |            | |
|              |                                   |           v            | |
|              |                                   | [168.63.129.16 / Azure | |
|              |                                   |  Private DNS Zones]    | |
|              |                                   |           |            | |
|              |                                   |           v            | |
|              |                                   | +--------------------+ | |
|              |                                   | | Outbound Endpoint  | | |
|              |                                   | | Subnet (/28)       | | |
|              |                                   | +---------+----------+ | |
|              |                                   +-----------|------------+ |
|              |                                               |              |
|              +---(Queries corp.contoso.com forwarded via)----+              |
|                  Forwarding Ruleset linked to Spoke VNets                   |
+-----------------------------------------------------------------------------+

Core Components of Azure DNS Private Resolver:

1. Inbound Endpoints:
   • Provisioned in a dedicated subnet (minimum subnet size: /28; cannot contain any other resources).
   • Receives an allocated private IP address from the subnet (e.g., 10.100.1.4).
   • Function: Serves as the target IP address for on-premises Windows Server conditional forwarders. Queries received from on-premises are routed directly to Azure's internal resolver (168.63.129.16) to resolve Azure Private DNS zones and Private Endpoints.
2. Outbound Endpoints:
   • Provisioned in a separate dedicated subnet (minimum subnet size: /28).
   • Function: Originates DNS queries from Azure and transmits them to on-premises DNS servers or external public targets based on rules.
3. DNS Forwarding Rulesets & Rules:
   • A Ruleset contains one or more DNS forwarding rules and is linked to one or more Virtual Networks.
   • Each Rule specifies:
     • Domain Name: Suffix to match (e.g., corp.contoso.com. or 10.in-addr.arpa.).
     • Target DNS Servers: List of on-premises DNS IP addresses and ports (e.g., 10.0.1.10:53, 10.0.1.11:53).
     • Rule State: Enabled or Disabled.
     • Priority: Value between 100 and 1000 (lower number = higher precedence).
   • When an Azure VM in a linked VNet queries server01.corp.contoso.com, the Outbound Endpoint intercepts the query and forwards it directly to the on-premises domain controller.

3. Architecture Comparison: PaaS Resolver vs. Custom IaaS Forwarder VMs

4. Hybrid DNS Deployment Workflow via PowerShell

# PowerShell: End-to-End Hybrid DNS Resolution with Azure DNS Private Resolver

# 1. Register the Microsoft.Network provider
Register-AzResourceProvider -ProviderNamespace 'Microsoft.Network'

# 2. Deploy the Azure DNS Private Resolver
$Resolver = New-AzDnsResolver `
    -Name 'Resolver-EastUS' `
    -ResourceGroupName 'RG-HybridDNS' `
    -Location 'eastus' `
    -VirtualNetworkId '/subscriptions/.../subnets/default'

# 3. Create the Inbound Endpoint (for queries originating from on-premises)
$InboundSubnet = '/subscriptions/.../subnets/snet-resolver-inbound'
New-AzDnsResolverInboundEndpoint `
    -DnsResolverName 'Resolver-EastUS' `
    -Name 'Inbound-Endpoint' `
    -ResourceGroupName 'RG-HybridDNS' `
    -Location 'eastus' `
    -IpConfiguration @{ SubnetId = $InboundSubnet; PrivateIpAllocationMethod = 'Dynamic' }

# 4. Create the Outbound Endpoint and DNS Forwarding Ruleset
$OutboundSubnet = '/subscriptions/.../subnets/snet-resolver-outbound'
$OutboundEndpoint = New-AzDnsResolverOutboundEndpoint `
    -DnsResolverName 'Resolver-EastUS' `
    -Name 'Outbound-Endpoint' `
    -ResourceGroupName 'RG-HybridDNS' `
    -Location 'eastus' `
    -SubnetId $OutboundSubnet

$Ruleset = New-AzDnsForwardingRuleset `
    -Name 'Ruleset-OnPrem' `
    -ResourceGroupName 'RG-HybridDNS' `
    -Location 'eastus' `
    -DnsResolverOutboundEndpoint $OutboundEndpoint

# 5. Add a Forwarding Rule for the On-Premises Active Directory Domain
$TargetDNS = New-AzDnsForwardingRulesetTargetDnsServerObject -IpAddress '10.0.1.10' -Port 53
New-AzDnsForwardingRule `
    -DnsForwardingRulesetName 'Ruleset-OnPrem' `
    -Name 'Rule-CorpContoso' `
    -ResourceGroupName 'RG-HybridDNS' `
    -DomainName 'corp.contoso.com.' `
    -TargetDnsServer $TargetDNS `
    -ForwardingRuleState 'Enabled'

# 6. Link the Ruleset to Spoke Virtual Networks
New-AzDnsForwardingRulesetVirtualNetworkLink `
    -DnsForwardingRulesetName 'Ruleset-OnPrem' `
    -Name 'Link-VNet-Spoke01' `
    -ResourceGroupName 'RG-HybridDNS' `
    -VirtualNetworkId '/subscriptions/.../virtualNetworks/VNet-Spoke01'

# 7. On-Premises Windows Server DNS: Add Conditional Forwarder for Private Link
# Points to the Azure Private Resolver Inbound Endpoint IP (10.100.1.4)
Add-DnsServerConditionalForwarderZone `
    -Name 'privatelink.database.windows.net' `
    -MasterServers '10.100.1.4' `
    -ReplicationScope 'Forest'