Conditional Forwarder to Azure DNS Private resolver sometimes returns a public IP address for a private endpoint.

Question

We have a Windows Server 2022 that we are using for DNS queries on our domain.  This server is virtual and in Azure.

We have an SQL server that has a Private endpoint configured.

We have setup a private dns zone(privatelink.database.windows.net) for the sql server in azure and created a dns private resolver.

On the DNS server, we have created a conditional forwarder for privatelink.database.windows .net.

On the Server, Initially, if we run Nslookup xxx-xxx-xxx-xxx.privatelink.database.windows.net then it all works fine, and it returns the Private IP address.

If we then run Nslookup xxx-xxx-xxx-xxx.database.windows.net then it returns the public IP address, which is also correct.

The problem is now if we again run NSlookup xxx-xxx-xxx-xxx.privatelink.database.windows.net then this time it returns the same public address as returned when we run Nslookup xxx-xxx-xxx-xxx.database.windows.net and NOT the private address.

Eventually, after waiting sometime running NSlookup xxx-xxx-xxx-xxx.privatelink.database.windows.net will return the correct private IP address.

Why does running NSlookup to xxx-xxx-xxx-xxx.database.windows.net cause NSlookup to xxx-xxx-xxx-xxx.privatelink.database.windows.net to stop returning the private IP address?

Answer 1

Hi Richard Ward,

Thank you for reaching out to us on the Microsoft Q&A forum.

As an original poster cannot accept their own answer, I am reposting it so that you can accept it an answer. Accepted answer will help other community members navigate to the appropriate solutions.

Issue: Conditional Forwarder to Azure DNS Private resolver sometimes returns a public IP address for a private endpoint.

Solution: We have now resolved the issue. On the internal windows DNS server, we initially created a conditional forwarder to privatelink.database.windows.net. However, what we did to resolve the issue was to remove this and create a conditional forwarder to database.windows.net. After doing this, running nslookup to xxx-xxx-xxx-xxx.privatelink.database.windows.net always returns the correct result.

---

Remember to "Accept Answer" so that others in the community who are experiencing similar challenges can easily find a solution.

Your contribution is greatly appreciated.

Regards,

Ganesh

Answer 2

We have now resolved the issue. On the internal windows DNS server, we initially created a conditional forwarder to privatelink.database.windows.net. However, what we did to resolve the issue was to remove this and create a conditional forwarder to database.windows.net. After doing this, running nslookup to xxx-xxx-xxx-xxx.privatelink.database.windows.net always returns the correct result.