# Azure Private DNS Resolver > Source-anchored research for Azure Private DNS Resolver. Run status: COMPLETED. Parent: [MongoDB Atlas on Azure](https://llms-explorer.com/tree/mongodb-atlas-on-azure/) · 5 facets · 17 facts · page: https://llms-explorer.com/tree/azure-private-dns-resolver/ ## How it works - Inbound endpoint addresses support static or dynamic allocation. A dynamic address stays unchanged during normal operation but can change when the endpoint is reprovisioned, so forwarder configuration must account for that lifecycle. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) ## How-to and procedures - Create only the endpoints required by query direction: inbound for external clients querying Azure-visible names; outbound plus forwarding rules for Azure queries sent to external DNS servers. Bidirectional deployments can need both. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) ## Problems, failure modes and limitations - Each resolver endpoint needs a separate, dedicated subnet delegated to Microsoft.Network/dnsResolvers. Microsoft documents supported endpoint subnet sizes from /28 through /24; the subnet cannot host another service. (high confidence) (verified as of 2026-06-22) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) ## Comparisons and alternatives - An outbound endpoint uses a dedicated subnet but has no provisioned listener IP like an inbound endpoint; configure forwarding rulesets rather than pointing clients at an outbound endpoint IP. (low confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) - Microsoft rejects 168.63.129.16 as a forwarding-rule destination with the error "Exception while making add request for rule". Use an appropriate reachable DNS server target rather than that Azure platform address. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) - Chris Hailes provides an original Bicep deployment example containing resolver, inbound endpoint, outbound endpoint, forwarding ruleset, VNet link and forwarding-rule resources; the example illustrates the resource dependencies, rather than proving production readiness. (low confidence) — [source](https://blog.brewedinthecloud.com/p/azure-dns-privateresolver/) ## Facts and statements - Azure DNS Private Resolver provides managed recursive resolution and conditional forwarding between Azure and external networks; inbound endpoints receive queries, while outbound endpoints apply forwarding rulesets. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) - An on-premises conditional forwarder targets the inbound endpoint's private IP over existing private connectivity. That endpoint resolves private zones linked to its own VNet. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) - Azure clients using Azure-provided DNS consult linked private zones before forwarding rulesets. Matching forwarding rules use the most specific DNS suffix; unmatched queries proceed through Azure DNS. Custom VNet DNS settings send queries to the configured custom servers instead. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) - A ruleset that forwards a namespace to an inbound endpoint must not be linked to that endpoint's own VNet: the configuration can create a DNS forwarding loop. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) - For Atlas, resolver deployment is conditional on DNS requirements, not an established universal prerequisite. This is a synthesis: Azure documents hybrid forwarding, while Atlas documents endpoint-specific connection strings resolving to private interface IPs. DNS success alone does not establish database connectivity. (medium confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) - AzureRM provider 3.93.0 historically rejected private_ip_address for a Static inbound endpoint with "Value for unconfigurable attribute". Issue #25026 records the reproducer and closure through #25035 on March 4, 2024; this is historical provider behavior, not evidence of a current Azure service restriction. (low confidence) — [source](https://github.com/hashicorp/terraform-provider-azurerm/issues/25026) - Resolver endpoints require separate dedicated subnets delegated to Microsoft.Network/dnsResolvers; the parent resolver references one VNet, and each endpoint belongs within that resolver's network. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) - Azure DNS Private Resolver replaces self-managed DNS forwarding servers with managed inbound and outbound resolution between Azure and external private environments. Hybrid use still requires network connectivity, such as VPN or ExpressRoute. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview) - An inbound endpoint exposes a private IP that external DNS servers can use as a conditional-forwarding target. It resolves private zones linked to the endpoint VNet. An outbound endpoint supplies forwarding egress and has no equivalent client-facing listener IP. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) - A forwarding rule targeting the resolver inbound endpoint must not be applied through a ruleset link to that inbound endpoint VNet: this can create a DNS forwarding loop. A wildcard rule also requires a target that can resolve public dependencies. (high confidence) — [source](https://learn.microsoft.com/en-us/azure/dns/private-resolver-endpoints-rulesets) - For DNS troubleshooting, repeat one FQDN and record type from affected and control networks. Record the actual resolver, response code, answer, TTL and timing; test UDP and TCP separately before attributing timeouts to a loop. (medium confidence) — [source](https://naxaya.com/articles/azure-dns-private-resolver-diagnose-forwarding-loop-before-changing-zones/)