I have Active Directory-integrated DNS on on-premises domain controllers and additional domain controllers in Azure, all in the same forest and domain. Azure servers currently use the Azure domain controllers for DNS.
A storage account has a private endpoint for Azure Files, with a Private DNS zone named privatelink.file.core.windows.net linked to the Azure virtual network. I have also deployed an Azure DNS Private Resolver with an inbound endpoint at 192.168.x.4.
For on-premises DNS, should I create a conditional forwarder for file.core.windows.net that points to the resolver's inbound IP? I initially forwarded privatelink.file.core.windows.net, but authentication and drive mapping to the Azure file share failed.
Should the conditional forwarder be stored in Active Directory and replicated to every domain controller, including those in Azure? If the Azure domain controllers act as an intermediate DNS hop, should they forward the private-link name to Azure's 168.63.129.16 resolver address instead?
3 Answers
Another working design is to send domain-controller DNS traffic to a DNS proxy, such as an Azure Firewall DNS proxy, which then forwards to the Azure DNS Private Resolver. The resolver has access to the linked private DNS zones. Whichever architecture you choose, keep the lookup flow consistent and verify that the private zone is linked to the correct virtual network. Also remember that private-endpoint DNS behavior varies by Azure service, so some services may require different zones or forwarding rules.
Forward the public service zone, not the private-link zone. In this case, configure file.core.windows.net on the on-premises DNS servers and point it to the DNS Private Resolver inbound endpoint, 192.168.x.4. The private DNS zone privatelink.file.core.windows.net must be linked to the virtual network containing the resolver. Clients should also map the share using \storageaccount.file.core.windows.net rather than using the privatelink hostname. Storing the forwarder in Active Directory and replicating it is appropriate if every DNS server should use the same resolver path.
If the on-premises DNS servers forward to Azure domain controllers first, use a two-stage setup. The on-premises servers forward file.core.windows.net to the Azure DNS/DC hop, and that Azure DNS server forwards the relevant Azure resolution to 168.63.129.16. The private DNS zone still needs to be linked to the Azure virtual network where that DNS path exists. In this design, be careful about replicating a forwarder to Azure domain controllers if doing so would make them forward back through the same path or create a loop.
That makes sense. My Azure domain controllers currently use the on-premises DNS servers, so I need to avoid creating a circular forwarding path.