Azure Private DNS Resolver
Parent: MongoDB Atlas on Azure · Published reference · snapshot 2026-10-23 · skill mongodb-cohort-fb5f4021932f
↓ Facts as markdownall context files
Source-anchored research for Azure Private DNS Resolver. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
How it works
- Inbound endpoint addresses support static or dynamic allocation. A dynamic address stays unchanged during normal operation but can change when the endpoint is reprovisioned, so forwarder configuration must account for that lifecycle. (high confidence) [source]
How-to and procedures
- Create only the endpoints required by query direction: inbound for external clients querying Azure-visible names; outbound plus forwarding rules for Azure queries sent to external DNS servers. Bidirectional deployments can need both. (high confidence) [source]
Problems, failure modes and limitations
- Each resolver endpoint needs a separate, dedicated subnet delegated to Microsoft.Network/dnsResolvers. Microsoft documents supported endpoint subnet sizes from /28 through /24; the subnet cannot host another service. (high confidence) (verified as of 2026-06-22) [source]
Comparisons and alternatives
- An outbound endpoint uses a dedicated subnet but has no provisioned listener IP like an inbound endpoint; configure forwarding rulesets rather than pointing clients at an outbound endpoint IP. (low confidence) [source]
- Microsoft rejects 168.63.129.16 as a forwarding-rule destination with the error "Exception while making add request for rule". Use an appropriate reachable DNS server target rather than that Azure platform address. (high confidence) [source]
- Chris Hailes provides an original Bicep deployment example containing resolver, inbound endpoint, outbound endpoint, forwarding ruleset, VNet link and forwarding-rule resources; the example illustrates the resource dependencies, rather than proving production readiness. (low confidence) [source]
Facts and statements
- Azure DNS Private Resolver provides managed recursive resolution and conditional forwarding between Azure and external networks; inbound endpoints receive queries, while outbound endpoints apply forwarding rulesets. (high confidence) [source]
- An on-premises conditional forwarder targets the inbound endpoint's private IP over existing private connectivity. That endpoint resolves private zones linked to its own VNet. (high confidence) [source]
- Azure clients using Azure-provided DNS consult linked private zones before forwarding rulesets. Matching forwarding rules use the most specific DNS suffix; unmatched queries proceed through Azure DNS. Custom VNet DNS settings send queries to the configured custom servers instead. (high confidence) [source]
- A ruleset that forwards a namespace to an inbound endpoint must not be linked to that endpoint's own VNet: the configuration can create a DNS forwarding loop. (high confidence) [source]
- For Atlas, resolver deployment is conditional on DNS requirements, not an established universal prerequisite. This is a synthesis: Azure documents hybrid forwarding, while Atlas documents endpoint-specific connection strings resolving to private interface IPs. DNS success alone does not establish database connectivity. (medium confidence) [source]
- AzureRM provider 3.93.0 historically rejected private_ip_address for a Static inbound endpoint with "Value for unconfigurable attribute". Issue #25026 records the reproducer and closure through #25035 on March 4, 2024; this is historical provider behavior, not evidence of a current Azure service restriction. (low confidence) [source]
- Resolver endpoints require separate dedicated subnets delegated to Microsoft.Network/dnsResolvers; the parent resolver references one VNet, and each endpoint belongs within that resolver's network. (high confidence) [source]
- Azure DNS Private Resolver replaces self-managed DNS forwarding servers with managed inbound and outbound resolution between Azure and external private environments. Hybrid use still requires network connectivity, such as VPN or ExpressRoute. (high confidence) [source]
- An inbound endpoint exposes a private IP that external DNS servers can use as a conditional-forwarding target. It resolves private zones linked to the endpoint VNet. An outbound endpoint supplies forwarding egress and has no equivalent client-facing listener IP. (high confidence) [source]
- A forwarding rule targeting the resolver inbound endpoint must not be applied through a ruleset link to that inbound endpoint VNet: this can create a DNS forwarding loop. A wildcard rule also requires a target that can resolve public dependencies. (high confidence) [source]
- For DNS troubleshooting, repeat one FQDN and record type from affected and control networks. Record the actual resolver, response code, answer, TTL and timing; test UDP and TCP separately before attributing timeouts to a loop. (medium confidence) [source]
Children
- No children recorded.