The concept of privatelink.database.windows.net

De Greyt Jurgen 146 Reputation points
2021-05-27T12:08:42.187+00:00

Please help me in my quest for knowledge...
I trying to achive DNS resolving for services in Azure from OnPrem. We have a hub and spoke architecture within Azure. We have a central hub, which has a DNS forwarder installed. This DNS forward forwards all DNS queries to 168.63.129.16. We created a conditional forwarding on our OnPrem dns servers to forward all requests for Database.windows.net to the DNS forwarder in Azure.
All as explained in following article: https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-dns
We have created private links for our SAAS deployments within the Spokes. As we have a multitude of SAAS deployments, we have many different privatelink.Database.windows.net dns zones, while we can only link one privatelink.database.windows.net zone to our Hub vNet where the forwarder lives. So using this procedure we can only resolve records from a single default private DNS zone, while we should be able to resolve all the required ones.

From there the idea came to create a custom Private DNS zone, for each project. The Private DNS name would then be project.company.xyz. OnPrem DNS we would create a single conditional forwarder which forwards all queries for company.xyz to the dns forwarder in Azure. All would be resolved as expected, however this does not work because the custom domain is not represented in the TLS certificate, hence failing to connect to the private IP: https://journeyofthegeek.com/2020/03/06/azure-private-link-and-dns-part-2/ see scenario 6.

I have read many articles the last couple of days around the concepts of Private DNS zones, Private Links and Private Endpoints, however failing to fulling understand the complete picture. It comes to me that it would be logic that privatelink.database.windows.net can only be linked once, because the zone has to be unique, which it isn't. I would also presume that the zone privatelink.database.windows.net can only be resolved from within the vNet to which it belongs, hence why a unique Custom Private DNS zone needs to be created.

Azure DNS
Azure DNS
An Azure service that enables hosting Domain Name System (DNS) domains in Azure.
598 questions
Azure Private Link
Azure Private Link
An Azure service that provides private connectivity from a virtual network to Azure platform as a service, customer-owned, or Microsoft partner services.
469 questions
0 comments
Accepted answer
  1. msrini-MSFT 9,256 Reputation points Microsoft Employee
    2021-06-01T12:43:50.943+00:00

    @De Greyt Jurgen ,

    The recommendation is to deploy one Private DNS Zone for "database.windows.net" and link all the VNET to the Zone created. By doing that you will maintain all the records in the centralized manner and it will help you to resolve IP across all the VNETs.

    Also you cannot use custom domain name with PE as of today. You need to use the Azure provided custom FQDN so that you can resolve the FQDN to the PE IP.

    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2022-09-15T06:53:30.527+00:00

    If we cannot use a custom domain name, and it always defaults to privatelink.database.windows.net, how can we follow the recommendation to use database.windows.net?

    1 person found this answer helpful.
    0 comments