Please help me in my quest for knowledge...
I trying to achive DNS resolving for services in Azure from OnPrem. We have a hub and spoke architecture within Azure. We have a central hub, which has a DNS forwarder installed. This DNS forward forwards all DNS queries to 184.108.40.206. We created a conditional forwarding on our OnPrem dns servers to forward all requests for Database.windows.net to the DNS forwarder in Azure.
All as explained in following article: https://docs.microsoft.com/en-us/azure/private-link/private-endpoint-dns
We have created private links for our SAAS deployments within the Spokes. As we have a multitude of SAAS deployments, we have many different privatelink.Database.windows.net dns zones, while we can only link one privatelink.database.windows.net zone to our Hub vNet where the forwarder lives. So using this procedure we can only resolve records from a single default private DNS zone, while we should be able to resolve all the required ones.
From there the idea came to create a custom Private DNS zone, for each project. The Private DNS name would then be project.company.xyz. OnPrem DNS we would create a single conditional forwarder which forwards all queries for company.xyz to the dns forwarder in Azure. All would be resolved as expected, however this does not work because the custom domain is not represented in the TLS certificate, hence failing to connect to the private IP: https://journeyofthegeek.com/2020/03/06/azure-private-link-and-dns-part-2/ see scenario 6.
I have read many articles the last couple of days around the concepts of Private DNS zones, Private Links and Private Endpoints, however failing to fulling understand the complete picture. It comes to me that it would be logic that privatelink.database.windows.net can only be linked once, because the zone has to be unique, which it isn't. I would also presume that the zone privatelink.database.windows.net can only be resolved from within the vNet to which it belongs, hence why a unique Custom Private DNS zone needs to be created.