Cloud Transformation

Hybrid DNS with Azure DNS Private Resolver

On-premises and Azure resolve each other's private names, so private endpoints work from both sides.

Private endpoints only help if every client resolves them to private addresses. A DNS Private Resolver in the hub answers on-premises queries for Azure private zones through its inbound endpoint, and forwards Azure queries for on-premises names through its outbound endpoint and ruleset.

name lookupforwardresolvePrivate Linkon-prem namesOn premisesMicrosoft AzureHub virtual networkPrivate endpoint subnetInbound endpoint subnetOutbound endpoint subnetSpoke virtual networkOn-premises DNSconditional forwardersOn-premises clientsservers, desktopsExpressRouteor VPNPrivate endpointfor Azure SQLInbound endpointDNS Private ResolverOutbound endpointDNS Private ResolverForwarding ruleseton-premises domainsAzure-provided DNS168.63.129.16Private DNS zoneprivatelink zoneAzure SQL Databasepublic access offAzure MonitorNetwork WatcherWorkload VMin a spoke

Point at a component to light its links; select it for what it does here and the practice that makes it right on Azure.

When to use it

  • PaaS behind private endpoints that on-premises users or systems must reach
  • A hybrid period where servers on both sides call each other by name
  • Replacing DNS forwarder VMs in the hub with a managed service

How NGT delivers it

Built from code, reviewed at a gate by an NGT architect, and handed over with runbooks your team can run.

Cloud Transformation