Resolve names with DNS Private Resolver

The hub has an Azure DNS Private Resolver, dnspr-hub, with an inbound endpoint at 10.0.5.4 and a ruleset, rs-onprem, linked to the hub. Use it for two things: private endpoint names for vm-spoke1, like stlogs01 at 10.0.3.4, and the on-premises zone corp.contoso.com, which lives on dns-onprem at 192.168.10.10. app.corp.contoso.com is srv-onprem.

1. See the inbound endpoint and its IP.

   az dns-resolver inbound-endpoint list -g rg-lab --dns-resolver-name dnspr-hub -o tableType it
   What's this?

   Shows a DNS Private Resolver's inbound endpoints and their IP addresses.

   • -g the resource group the resources live in

2. Use it as vnet-spoke1's DNS server.

   az network vnet update -g rg-lab --name vnet-spoke1 --dns-servers 10.0.5.4Type it
   What's this?

   Changes a virtual network, such as its address space or the DNS servers its VMs use.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

3. Add a rule that sends corp.contoso.com to the on-premises DNS server.

   az dns-resolver forwarding-rule create -g rg-lab --ruleset-name rs-onprem --name corp --domain-name corp.contoso.com. --target-dns-servers "[{ip-address:192.168.10.10,port:53}]"Type it
   What's this?

   Works with a forwarding rule: queries for one domain go to the DNS servers you name. It applies in networks linked to the rule's ruleset. If two rules match, the longer domain wins.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change
   • --domain-name corp.contoso.com. note the trailing dot
   • --target-dns-servers where matching queries go

4. Connect to vm-spoke1.

   ssh vm-spoke1Type it
   What's this?

   Opens a shell on vm-spoke1, so the next commands run on that VM. In this lab it's a shortcut. In real Azure you'd connect through something like Azure Bastion, or SSH to an address you can reach.

5. Look up the private endpoint name.

   nslookup stlogs01.blob.core.windows.netType it
   What's this?

   Asks the VM's DNS server what IP address a name points to. Run it on the VM that has the problem, because each VM can get a different answer.

6. Look up the on-premises name. Type exit when done.

   nslookup app.corp.contoso.comType it
   What's this?

   Asks the VM's DNS server what IP address a name points to. Run it on the VM that has the problem, because each VM can get a different answer.

7. Answer the question below.

   With Azure-provided DNS, what's checked first: linked private DNS zones or forwarding ruleset links?

   Azure-provided DNS

   The DNS Azure gives every virtual network unless you set your own servers.

   Zone link

   Connects a private DNS zone to a virtual network, so VMs there can look up its names.

   Private DNS zone

   A DNS zone for private names, which you link to virtual networks. A privatelink zone holds the private IPs of private endpoints.

   Forwarding rule

   Sends DNS queries for one domain to DNS servers you choose. A ruleset is a group of them.

   Check