Azure Private DNS Zone!

Sakthivel     02/06/2026     15

Introduction

As more organisations adopt Azure for hosting applications and services, ensuring secure network connectivity become a key requirement. Azure Private Endpoints provide a secure way to access Azure services such as Storage Accounts, SQL Databases, and Key Vaults over the Azure backbone network, without exposing traffic to the public internet.

Once a service is connected through a Private Endpoint, clients still need a mechanism to resolve the service name to its private IP address. Azure Private DNS Zone helps achieve this by providing private DNS resolution within Azure Virtual Networks.

In this article, we will explore Azure Private DNS Zone, understand how they integrate with Private Endpoints, and learn how Azure resolves service names to private IP addresses behind the scenes.

What is a Private DNS Zone?

Azure Private DNS Zone is a DNS service that enables name resolution within Azure Virtual Networks without exposing DNS records to the public internet.

Unlike Public DNS Zone, which resolve publicly accessible domain names, Private DNS Zone is accessible only from the Azure Virtual Networks that are linked to them.

Example :

Storage Account Name :

mystorage.blob.core.windows.net

Public Resolution :

52.123.98.72 (Public IP)

Private Endpoint Resolution :

10.0.1.4 (Private IP)

When a Private Endpoint is configured for the Storage Account, Azure Private DNS Zone ensures that resources within the linked Virtual Network resolve the storage account name to its private IP address instead of the public IP address. This allows traffic to remain within the Azure backbone network, improving both security and network isolation.

Why do we need Private DNS Zone?

Without a Private DNS Zone, applications will continue to resolve Azure services to their public IP addresses.

Azure Private DNS Zone addresses this issue by mapping service names to the corresponding Private Endpoint IP addresses, ensuring that traffic remains within the Azure network.

Important: DNS records are created automatically only when the Private Endpoint is integrated with a Private DNS Zone, and the required permissions are available. If a Private DNS Zone is not configured or automatic DNS registration is not enabled, the DNS records must be created manually.

Application Flow Diagram

Creating a Private DNS Zone

1. In the Azure portal, search for Private DNS Zone
2. Click Create.
3. Enter Zone Name

Example :

privatelink.azurewebsites.net

4. Create the Zone.
5. Link it to the Virtual Network.



Hostname	Private IP
mywebapp.privatelink.azurewebsites.net	10.1.0.4

How Name Resolution Works

As shown in the diagram below, when Azure Front Door attempts to access a Web App, Azure performs the following steps:

1. Azure Front Door sends a DNS request.
2. Azure DNS checks the Private DNS Zone.
3. A matching DNS record is found.
4. Azure returns the Private Endpoint IP address.
5. Traffic flows entirely through the Azure backbone network.

NSLookup

When you execute the nslookup command, it should return the private IP address associated with Private Endpoint.

Example :

nslookup mywebapp.privatelink.azurewebsites.net

Expected Output :

10.1.0.4

Conclusion

Azure Private DNS Zone is a critical component of secure Azure networking. They ensure that Azure services exposed through Private Endpoints are resolved to private IP addresses rather than public endpoints.

By combining Private Endpoints, Private Link, and Private DNS Zone, organizations can build secure, scalable, and private cloud architectures while maintaining seamless connectivity for applications and users.