I have AD-integrated DNS on domain controllers both on premises and in Azure. Azure servers use the Azure DCs for DNS. An Azure Files storage account has a private endpoint, a linked private DNS zone, and a DNS Private Resolver inbound endpoint.
Should the conditional forwarder use file.core.windows.net or the privatelink zone? Can I replicate it to all DCs, and what should I check if drive mapping still fails?
For this setup, try a conditional forwarder for file.core.windows.net pointing directly to the resolver's inbound endpoint. Make sure the privatelink.file.core.windows.net private DNS zone is linked to the virtual network containing that resolver.
Use the normal share path, such as \\storageaccount.file.core.windows.net\sharename, rather than putting privatelink in the drive mapping. The normal name should resolve through to the private endpoint address when the DNS path is working.
You can store that forwarder in AD and replicate it to the Azure DCs as well, provided they can reach the inbound endpoint and the forwarder points directly there. That is different from forwarding on-premises queries to an Azure DC as an intermediate hop.
There is another valid route if you want an Azure DC to handle the query: forward the zone from on premises to the Azure DC, then have that DC forward it to Azure DNS at 168.63.129.16. The private DNS zone needs to be linked to the Azure DC's virtual network for that lookup path.
Be careful with AD replication in that design. If the on-premises forwarder points at the Azure DC, replicating the same setting onto that DC can make it forward the query back to itself. Configure the two hops deliberately instead.
A DNS proxy is another option if there is already an Azure Firewall in the path. DCs can send queries to the firewall's DNS proxy, which forwards to the private resolver. The resolver's virtual network still needs access to the linked private DNS zones, and each hop needs to be reachable.
Answers are reviewed before publication.
_t38+clampmarble.7:
Check the normal storage account name from both locations and confirm it returns the private endpoint IP. That separates the DNS question from any remaining network or authentication issue.