IOT DNS request for BLOB storage connection

Hi Joseph Castelnovo ,

Thanks for your question on the Microsoft Q&A portal!

It sounds like you're trying to understand how your on-premises IoT device connects to Azure Blob Storage while behind a NAT gateway.

Here is the Step-by-step breakdown of the connection flow:

Here’s how the connection from the IoT device to Azure Blob Storage works, even with the NAT gateway in place.

Step 1: IoT Device DNS Resolution (Private Resolver)

• The IoT device, being on a private network, needs to resolve the domain name for Blob Storage (e.g., yourstorageaccount.blob.core.windows.net).
• It sends a DNS request to the Azure Private DNS Resolver at IP address 168.63.129.16. This request is for resolving the Blob Storage domain. DNS Request Example:
  • Requested Domain:  yourstorageaccount.blob.core.windows.net
  • DNS Server: 168.63.129.16

Step 2: Azure DNS Resolver (Private Resolver)

• Azure’s DNS resolver does not use public internet DNS. Instead, it checks if the requested service is available via Azure's private IP space.
• If the requested Blob Storage endpoint is part of the private Azure network, the resolver responds with a private IP (which is only accessible from within the Azure network or via a VPN/ExpressRoute). The DNS response might look like:
  • Private IP Address: 10.x.x.x (private network IP in Azure, part of the same region)
  • The IoT device gets this private IP instead of a public IP address.

Step 3: Establishing the SSL Tunnel

• Now that the IoT device has resolved the Blob Storage’s private IP address from the DNS request, it will initiate an SSL/TLS connection to that IP over port 443 (standard HTTPS port).
• This connection is  secure and encrypted, meaning your IoT device communicates directly with Azure Blob Storage using SSL over the private IP.

Step 4: NAT Gateway Handling Outbound Traffic

• Since your IoT device is behind a NAT gateway, it will use the gateway to route its outbound traffic to the internet. The NAT gateway translates the private IP of the IoT device to a public IP address (making it possible for the IoT device to communicate with Azure, but still without directly exposing the device to the internet).
  • This means, even though the device is behind a NAT, the device still sends traffic to Azure Blob Storage securely via the private IP assigned by the Azure resolver. The key point: no inbound traffic can reach your IoT device directly because of the NAT Gateway, but the outbound traffic (from the IoT device to Azure Blob Storage) is allowed.

Step 5: Blob Storage Connection Established

• The IoT device establishes a secure SSL connection to Azure Blob Storage without ever needing to use a public IP address.
• Communication with the Blob Storage happens over the private IP, avoiding internet exposure while using the SSL tunnel for security.

Here is the detailed answer which is asked in the question("The Azure private resolver returns what ? A configuration message that provides hostname, connection logon information ?)

 if you’re using Azure DNS Private Resolver, it acts as a bridge between your on-prem DNS and Azure’s private DNS zones. It:

• Accepts DNS queries from your on-prem network
• Resolves them using Azure’s private DNS zones
• Returns the private IP of the endpoint

No configuration messages or credentials are returned via DNS—just IP addresses.

Would you be open to sharing an update or letting me know if further clarification or assistance would be helpful?

Thank you again for your time. I’m happy to continue supporting you—your experience and insights can also benefit others in the community.

Thanks,

Pranitha