Private DNS Zones
Name resolution inside virtual networks, including auto-registration, zone links and hybrid forwarding.
Readiness
0%
1h 40m baseline
Exam memorization points
- Private DNS zones are not resolvable from the internet; they exist only through virtual network links.
- Virtual network links are per network. Linking a zone to one VNet does not make it available to a peered VNet unless that VNet is also linked.
- Auto-registration links create and remove A records automatically for VMs in the linked network, and require a single zone per VNet for registration.
- privatelink zones are the naming pattern Azure services expect for private endpoint resolution.
- VMs use Azure-provided DNS at 168.63.129.16 unless custom DNS servers are set at the VNet level.
- Azure DNS Private Resolver provides inbound and outbound endpoints plus forwarding rule sets, so on-premises can query private zones.
Traps & distractors
- Enabling auto-registration together with custom DNS servers, a combination that is not supported.
- Creating two zones with the same name in different resource groups and linking both - resolution becomes unpredictable.
- Linking the zone to the VNet where the resource lives instead of where the client lives.
- Forgetting that a wildcard record or conditional forwarding is needed for on-premises clients to resolve privatelink names.
Suggested lab
Resolve private names from on-premises style clients
Practise links, auto-registration and hybrid forwarding.
- 1Create an internal private zone such as corp.internal and link it to the VNet with auto-registration enabled.
- 2Deploy a VM and confirm an A record was registered automatically, then delete the VM and confirm removal.
- 3Inspect the privatelink zone created by a private endpoint and confirm which VNet links exist.
- 4Deploy Azure DNS Private Resolver with an inbound endpoint and note the resolver IP.
- 5Add a forwarding rule set that forwards privatelink zones to the inbound endpoint address.
Microsoft Learn
- What is Azure Private DNS?doc
- Search Microsoft Learn: private DNS zone virtual network link auto-registration DNS private resolversearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
High priority
Strong exam value. Schedule this week.
- Exam importance80% × 30% = 24.0
Learner-agnostic frequency on the real exam (4/5).
- Blueprint weight78% × 25% = 19.4
This topic's domain carries 17.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
1h 40m
Complexity
3 / 5
Remaining to target
1h 25m
Status weight
0%
Topics: private dns, zone, auto-registration, vnet link, 168.63.129.16, forwarding
Weak neighbours in Networking