Private resolver and DNS name resolution issue

Hi, if your on-prem DNS sometimes resolves an Azure Private Endpoint to a public IP, it’s likely because you’re forwarding only the privatelink. sub-zone (e.g. privatelink.database.windows.net) to Azure. But clients usually query the public FQDN (like myserver.database.windows.net), which is a CNAME that ultimately points to the private IP. If your DNS resolves the public name through the Internet first, it caches the public A record, and future lookups “flip” to the wrong IP.

-Fix-

Delete the conditional forwarder for privatelink.database.windows.net and instead create a forwarder for the parent zone database.windows.net, pointing it to your Azure DNS Private Resolver’s inbound endpoint (e.g. 10.1.0.4). Then flush DNS on your servers and clients.

This change ensures every step of the CNAME chain stays inside Azure, and your DNS will always return the correct private IP.

-Checklist-

– Private DNS zone is linked to the right VNet

– Inbound endpoint is reachable from on-prem

– No 8.8.8.8 or public resolvers in the forwarder list

– TTL is default (10 min)

– All on-prem DNS servers use the same forwarder

After that, everything will resolve consistently to the private IP, no more flapping.