Skip to content

Configure private DNS

Private DNS maps each service hostname to the Private Endpoint's private IP. Use the exact hostnames and private domain from deployment details.

Gather authoritative values

Record:

  • Elasticsearch, Kibana, and any other private service hostnames;
  • the Private Endpoint private IP;
  • the VNet from which clients query DNS;
  • the authoritative private DNS zone or corporate DNS owner.

Do not assume a privatelink.* zone name. This application can use a deployment-specific private domain.

Azure-native DNS

  1. Create or select the Azure Private DNS zone that is authoritative for the deployment's private domain.
  2. Link the zone to every VNet whose clients must resolve the names.
  3. For each hostname supplied by the deployment, create the required record pointing to the Private Endpoint IP. Derive the record label from the authoritative hostname, not from an internal resource name.
  4. Disable VM autoregistration unless the zone has a separate documented need for it.

  5. Query each hostname from a client in a linked VNet:

    nslookup <service-hostname>

  6. Confirm the response is the Private Endpoint's private IP.

Hybrid DNS

For on-premises or custom-DNS clients:

  1. Keep the Azure Private DNS zone linked to the endpoint VNet.
  2. Configure a supported Azure DNS forwarding path, such as Azure DNS Private Resolver, from the corporate DNS service.
  3. Add a conditional forwarder for the deployment's private domain.
  4. Test from both an Azure client and an on-premises client.

Do not forward on-premises queries directly to Azure's platform virtual IP. Use a supported resolver reachable from the client network.

Validate the result

DNS is complete when every documented service hostname resolves to the private IP from every approved client network. If it returns NXDOMAIN, a public IP, or an old private IP, follow connectivity troubleshooting.

Next, configure private TLS.