Azure Hybrid DNS Architecture – Microsoft Q&A

The current guidance is to forward the public Azure service zones (for example, database.windows.net) to Azure, and let Azure handle the split-brain behavior by internally redirecting to the corresponding privatelink.* zones. This is explicitly documented in the Azure Private Endpoint DNS integration guidance.

The design described there is:

• On-premises DNS uses a conditional forwarder for the public zone (for example, database.windows.net).
• That conditional forwarder points to Azure DNS via an Azure DNS Private Resolver.
• Azure then internally redirects to the privatelink.* zone and answers with the private IP from the linked private DNS zone.

The key statement in the documentation is:

“The conditional forwarding must be made to the recommended public DNS zone forwarder. For example: database.windows.net instead of privatelink.database.windows.net.”

This reflects the updated pattern and replaces older designs where only the privatelink.* zones were forwarded.

The context provided here does not include the older/original document that recommended forwarding only the privatelink zones; it only contains the current, updated guidance that you are already seeing.

References: