We have a hybrid environment where our on-premises Active Directory and DNS servers use external DNS forwarders. For virtual machines running in Azure, should we configure those same external forwarders, or should the VMs use Azure's built-in DNS resolver at 168.63.129.16? We want internal name resolution and connectivity between Azure and on-premises systems to work reliably.
4 Answers
Avoid configuring 168.63.129.16 directly on the VM when the VM needs Active Directory or private-zone resolution. Use your AD DNS servers, and configure those servers with the appropriate forwarders and conditional forwarders. Azure’s resolver can still be used indirectly, depending on how your virtual network DNS settings are designed.
If Azure instances need to access on-premises systems by hostname, their DNS servers must be able to resolve a copy of the AD DNS zone. Check the zone’s name-server records to confirm whether Azure-based domain controllers or DNS servers are integrated. You can also run nslookup from an Azure VM to verify the actual resolution path. In general, use the closest DNS servers that contain the zones your workloads need, while ensuring network connectivity between Azure and on-premises DNS.
It depends on how the VMs are being used. If they’re domain-joined or need to resolve on-premises resources, treat them like the rest of your member servers and point them to your AD-integrated DNS servers. That keeps internal resolution consistent and is generally easier to troubleshoot. If they only need Internet name resolution, Azure’s default DNS service may be sufficient.
There’s no universal reason to replace your existing external forwarders. If they’re required for security, filtering, or policy reasons, keep using them through your AD DNS servers. Just make sure Azure can reach those DNS servers over the network and that firewalls allow DNS traffic, including TCP and UDP port 53. Test from both Azure and on-premises rather than assuming the routing and firewall rules are symmetrical.
That firewall detail is easy to miss. If DNS works on-premises but not from Azure, check the Azure network security rules, firewalls, routes, and both TCP and UDP port 53.
Agreed—keeping the DNS setup conventional and consistent usually avoids a lot of unnecessary troubleshooting.