Azure Firewall DNS Proxy Failing to Resolve SCM Records in Private DNS Zones

Sagar Baghel 10

I have a hub-and-spoke architecture in Azure where I'm using Azure Firewall in the hub as a DNS proxy. I have multiple private DNS zones configured in the hub and have established VNet links to my spoke networks. I've also added A records for my function apps.

When I perform an nslookup from a spoke VM for a function app (e.g., nslookup test-app.privatelink.azurewebsites.net), the DNS traffic is forwarded to the firewall's private IP, and I can successfully resolve the IP address. However, when I try to resolve the SCM record for the same function app (e.g., nslookup test-app.scm.privatelink.azurewebsites.net), I get a "non-existent domain" error.

I've observed the following:

Azure Firewall logs show a similar error for the SCM record lookup.
nslookup <SCM_FQDN> <AzureFirewallPrivateIP> fails.
nslookup <SCM_FQDN> <DNSServerUsedByFirewall> (using Azure's default DNS servers) succeeds.

What could be causing this issue with resolving SCM records through the Azure Firewall DNS proxy? Am I missing a configuration step or is there a limitation with Azure Firewall's DNS proxying capabilities?

Thanks in advance.

Ganesh Patapati 2,515 Reputation points Microsoft Vendor

2024-12-19T22:19:36.7833333+00:00
Hi Sagar Baghel

Greetings!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

The issue you're encountering with resolving the SCM records for your Azure Function Apps via the Azure Firewall DNS proxy is likely due to how Azure Firewall processes DNS queries for specific Azure services, especially with utilizing private link.

When you create a function app with a private endpoint, Azure automatically creates DNS records for both the function app and its SCM endpoint. The DNS records for the function app (e.g., test-app.privatelink.azurewebsites.net) and the SCM endpoint (e.g., test-app.scm.privatelink.azurewebsites.net) should resolve to the private IP of the private endpoint.

DNS proxy configuration requires three steps:

Enable the DNS proxy in Azure Firewall DNS settings.

Optionally, configure your custom DNS server or use the provided default.

Configure the Azure Firewall private IP address as a custom DNS address in your virtual network DNS server settings to direct DNS traffic to the Azure Firewall.

With DNS proxy enabled, Azure Firewall can process and forward DNS queries from a Virtual Network(s) to your desired DNS server. This functionality is crucial and required to have reliable FQDN filtering in network rules. You can enable DNS proxy in Azure Firewall and Firewall Policy settings. To learn more about DNS proxy, see Azure Firewall DNS settings.

Don’t create a Private DNS Zone with the domain name *.blob.core.windows.net and associate it with the Azure Firewall virtual network. If you override the default domain names, all the DNS queries are directed to the private DNS zone, and this breaks firewall operations. Instead, create a unique domain name such as *.<unique-domain-name>.blob.core.windows.net for the private DNS zone.

Alternatively, you can enable a private link for a storage account and integrate it with a private DNS zone, see Inspect private endpoint traffic with Azure Firewall.

Verify that the private DNS zone for privatelink.azurewebsites.net is correctly linked to your hub VNet and that the A records for both the function app and the SCM endpoint are present. You can check this in the Azure portal under the Private DNS Zones section.

Since you mentioned that the Azure Firewall logs show a "non-existent domain" error for the SCM record lookup, this indicates that the firewall is not able to resolve the SCM record. This could be due to the DNS forwarding configuration

Meanwhile can you please send me the topology of your requirement??

And let me verify about limitation with Azure Firewall's DNS proxying capabilities?

Hope this clarifies!

If above is unclear and/or you are unsure about something add a comment below.

Regards,

Ganesh
Sagar Baghel 10 Reputation points

2024-12-20T08:42:42.8366667+00:00

Hi @Ganesh Patapati ,

Thanks for your input. Please find below the architecture details :

Architecture:

I have a hub and spoke architecture with a hub (Hub vnet) and 2 spokes (spoke vnet1, spoke vnet2). I also have a DNS private Resolver Vnet which has a Azure Private DNS Resolver resource. Hub contains Azure Firewall, Private DNS zones and Virtual,Local network gateway for on-prem connectivity.

Objective: I want to use Azure Firewall as DNS proxy.

Implementation details :

I also updated the DNS setting for Spoke 1 Vnet to use Azure Firewall Private Ip as the custom DNS server.

Now from a VM in spoke 1 if I do a nslookup I am able to resolve the private IP address of the functionn app but it gives non-existant domain error for SCM endpoints. I checked firewall logs and I see the same error there.

Also, I noticed that some suffix are added automatically for my dns query when I am trying to resolve SCM endpoints. For example reddog.microsoft.com (all marked black). Only marked yellow are valid ones.

As I am able to resolve the function app IP from spoke VM it proves that the base configuration is correct.

1 answer

Ganesh Patapati 2,515 Reputation points Microsoft Vendor

2024-12-20T19:00:38.9666667+00:00
Hello @Sagar Baghel

Greetings!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Firstly, if you have created two records pointing to the private endpoint IP First is for your app, the second is for the SCM of your app.

Refer: https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint#dns

- Secondly use of Azure Private DNS resolver with Azure Firewall DNS proxy is not validated by PG and support request will be required here.

Hope this clarifies!

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh
Please sign in to rate this answer.
Ganesh Patapati 2,515 Reputation points Microsoft Vendor

2024-12-20T19:29:01.8233333+00:00

Hello @Sagar Baghel

Good day!

Use of Azure Private DNS resolver with Azure Firewall DNS proxy is not validated by PG and support request will be required here.

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh

Sagar Baghel 10 Reputation points

2024-12-20T19:32:36.4533333+00:00

Hi @Ganesh Patapati

Before using Azure Firewall as DNS proxy my private endpoints were working fine.

I have two records inserted in my private dns zone.

Also, I am not using Azure Private DNS Resolver as custom DNS server in Azure Firewall as of now, thats a different issue.

The configuration which I have done :

Enabled Azure Firewall DNS proxy with default DNS server.

Used Firewall's private IP as custom DNS server in Vnet.

My DNS zones have all the required records and Vlinks.

So even after doing all the configurations as mentioned in MS docs why I am not able to resolve nslookup test-app.scm.privatelink.azurewebsites.net ?

Ganesh Patapati 2,515 Reputation points Microsoft Vendor

2024-12-20T20:42:36.5733333+00:00

Hello Sagar Baghel

Please accept our sincere apologies for any inconvenience caused.

We understand this is a complex issue. We will check internally with our team and get back to you as soon as possible.

Regards,

Ganesh

Ganesh Patapati 2,515 Reputation points Microsoft Vendor

2024-12-23T18:06:24.84+00:00

Hello Sagar Baghel

We appreciate your Patience!

I did a Lab, and I was able to get this to work! I was not able to find any issue - look at my Screenshot below:

No Error from Firewall

From VM:

Can you please make sure the Private DNS Zone is linked to the VNET where the Firewall resides, and not the spoke

What is the

DNS Server of the Spoke VNET.

DNS Server configured in the Firewall.

If above is unclear and/or you are unsure about something add a comment below.

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Regards,

Ganesh

Ganesh Patapati 2,515 Reputation points Microsoft Vendor

2024-12-24T16:45:30.66+00:00

Hello Sagar Baghel

Good day!

Just checking in to see if you have got a chance to see my response to your question in resolving the issue.

Looking forward to your response and appreciate your time on this.

If your queries have been resolved, please acknowledge by clicking "Upvote" and "Accept Answer" on the post.

Regards,

Ganesh
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.