We are designing a SQL Server Always On Availability Group and Distributed Availability Group (DAG) architecture on Azure SQL VMs using a domain‑independent Windows Server Failover Cluster (WSFC) with a Hub‑and‑Spoke network topology. We would like to con

Hi INDRANI RAYCHOWDHURY,

Thanks for reaching out in Microsoft Q&A forum,

Azure Private DNS Zones fully support WSFC Cluster Name Objects (CNO) and Availability Group (AG) listener name resolution, including Distributed Network Name (DNN) listeners, in domain-independent setups on Azure SQL VMs with Hub-and-Spoke topologies.

1.Whether Azure Private DNS Zones can be reliably used for WSFC and AG listener name resolution. Yes, Azure Private DNS Zones provide reliable name resolution for WSFC Cluster Name Objects (CNO) and Availability Group (AG) listeners, including Distributed Network Name (DNN) listeners, in domain-independent Windows Server Failover Clusters on Azure SQL VMs. They support dynamic A-record registration and updates when zones are linked to all relevant virtual networks, working effectively in Hub-and-Spoke topologies via VNet peering.

2.If there are any known limitations, unsupported scenarios, or recommended alternatives.

Limitations include no support for single-label zones or NS delegations, potential VNet peering propagation delays in Hub-and-Spoke, and dynamic update issues if cluster permissions conflict with Azure DNS security. Unsupported scenarios involve auto-registration limits (one VNet per zone) and complex on-premises hybrids without testing; pre-stage records manually as an alternative. Test failover thoroughly in staging for production reliability.

3.Microsoft‑recommended DNS patterns for WSFC and AG listeners in a Hub‑and‑Spoke model (e.g., Azure‑provided DNS, custom DNS servers, or hybrid forwarding).

Microsoft recommends starting with Azure-provided DNS (168.xx.1x9.1x) for baseline resolution, enhanced by Private DNS Zones linked to each VNet for custom control. In Hub-and-Spoke, use Azure DNS Private Resolver in the Hub VNet for cross-spoke forwarding, or deploy custom DNS servers with conditional forwards to Azure DNS; avoid public exposure.

Also if we are using DNN Listener in case of automatic failover of AG how the behaviour of DNN Listener will be.

In automatic failover, the DNN listener updates its A-record to the new primary's IP instantly from cluster scope, with clients resolving via cached TTL (set to 60s recommended). No load balancer needed; traffic shifts seamlessly across subnets in multi-replica setups.

Official Documentation:

• Azure Private DNS Zone Overview | Microsoft Learn
• Overview of SQL Server Always on Availability Groups - SQL Server on Azure VMs | Microsoft Learn
• Quickstart - Create an Azure private DNS zone using the Azure portal | Microsoft Learn

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Azure Private DNS Zones can be used for Windows Server Failover Cluster (WSFC) and Availability Group (AG) listener name resolution, including Distributed Network Name (DNN) listeners. However, there are certain considerations and best practices to keep in mind:

1. Reliability: Azure Private DNS Zones can provide reliable name resolution for WSFC and AG listeners. When using DNN listeners, the DNS setup should ensure that the DNN resource is correctly configured to resolve to the IP addresses of all nodes in the cluster.
2. Limitations and Unsupported Scenarios: While Azure Private DNS is generally supported, there may be specific limitations or unsupported scenarios that could arise, particularly in complex network topologies or when integrating with on-premises DNS solutions. It's recommended to thoroughly test the DNS setup in a staging environment before deploying to production.
3. Recommended DNS Patterns: In a Hub-and-Spoke model, Microsoft typically recommends using Azure-provided DNS for simplicity and reliability. However, if custom DNS servers are used, ensure they are properly configured to resolve the necessary names. Hybrid forwarding may also be an option, depending on your architecture and requirements.

Regarding the behavior of the DNN listener during an automatic failover of the AG, the DNN listener should seamlessly redirect traffic to the new primary replica without requiring any changes in the client connection strings, as long as the DNN is correctly configured and the DNS records are updated accordingly.

References:

• Windows Server Failover Cluster with SQL Server on Azure VMs
• Create a domain-independent availability group