Staff at Cascade Regional Airlines' on-premises office in Missoula report they cannot resolve the private-link name of an Azure storage account's private endpoint, and the query instead returns the storage account's public IP address. The privatelink DNS zone in Azure is correctly configured and linked to the VNet. What is most likely missing?
Select an answer to reveal the explanation.
Short Explanation
On-premises machines don't automatically know to ask Azure's private DNS zone about anything — they're still asking whatever DNS server they've always used, which only knows the public answer. Set up a conditional forwarder from on-prem to Azure for that privatelink zone, and Missoula's queries finally reach the record that actually resolves to the private IP.
Full Explanation
On-premises DNS servers have no automatic visibility into an Azure private DNS zone; that zone is only queryable by resources whose VNet holds a resolution link to it, or by external resolvers explicitly pointed at an in-VNet DNS forwarding path such as a VM running DNS forwarding or Azure DNS Private Resolver. Without that forwarding path, an on-premises client's query for the privatelink FQDN falls through to public DNS, which correctly returns the storage account's public IP rather than the private endpoint's address — matching the symptom exactly. Autoregistration only controls whether VM records get created automatically inside the zone and has no effect on whether on-premises clients can reach the zone at all. A public NS delegation is irrelevant, since privatelink zones are private, not delegated publicly, and delegating them would defeat their purpose. A load-balancing rule operates on Layer 4 traffic distribution and has nothing to do with DNS name resolution. The exam-relevant caveat: setting up conditional forwarding typically requires an inbound endpoint on an Azure DNS Private Resolver (or a forwarder VM) inside the VNet that on-premises DNS servers can reach over the VPN or ExpressRoute connection. To verify, run nslookup for the storage account's privatelink FQDN from a Missoula workstation and confirm it now returns the private endpoint's private IP address instead of the public one.