Share via

What's needed in Active Directory DNS to force Azure resources to resolve to the Private IP Address? Is it a new Zone, Forwarder?

Perez, Alexis (ACS) 0 Reputation points
2025-12-01T14:12:12.0866667+00:00

We need to force Azure resource to resolve to the Private IPs as opposed to the public IP. The resources are under the azurecontainerapps.io domain.

Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Vallepu Venkateswarlu 1,235 Reputation points Microsoft External Staff Moderator
    2025-12-01T15:05:58.1166667+00:00

    Hi @ Perez, Alexis (ACS),

    Welcome to Microsoft Q&A Platform.

    What’s needed in Active Directory DNS to force Azure resources to resolve Azure Container Apps ( .azurecontainerapps.io ) to Private IP instead of Public IP? Do we need a new zone or a forwarder?

    On-prem client resolves an Azure private name by forwarding the query from the on-prem AD DNS server to the Inbound Endpoint of Azure DNS Private Resolver.

    Azure DNS then consults the Private DNS Zone and returns the private IP. If you get a public IP instead, likely causes are:

    • No conditional forwarder on AD DNS pointing to the inbound endpoint IP.
    • Inbound endpoint is missing or unreachable (wrong subnet/NSG/VPN).
    • Private DNS Zone is missing, not linked, or missing the A records.

    To resolve the issue, verify that your Active Directory DNS conditional forwarder points to the inbound endpoint IP address. Ensure that the inbound endpoint is deployed in a dedicated subnet and is reachable over VPN or ExpressRoute with UDP/TCP port 53 allowed. Confirm that the private DNS zone and records exist and are correctly linked to the virtual network.

    Follow the Traffic flow for an on-premises DNS query for more details.

    Architecture diagram that shows DNS Private Resolver name resolution traffic when an on-premises server queries an Azure private DNS service record.

    If you are trying to access Container Apps from a private network, make sure to enable a Private Endpoint for the container. This will automatically create a Private DNS Zone and link it to the selected VNet. Ensure that you select the same VNet where your resource is configured; if it is different, configure VNet peering.

    Note: Make sure public network access is disabled on the ACA environment, so that only the private endpoint is used, making the private DNS override meaningful.
    Ref: Private endpoints and DNS for virtual networks in Azure Container Apps environments
    Azure Private Endpoint DNS integration Scenarios

    Kindly let us know if the above helps or you need further assistance on this issue.

    Please 210246-screenshot-2021-12-10-121802.pngand “up-vote” if the information helped you. This will help us and others in the community as well.

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.