How to forward privatelink addresses only, and reliably?

Sean 0 Reputation points
2026-09-08T16:41:55.2866667+00:00

The request I'm trying to fulfill without success is keeping (for example, but not limited to) table.core.windows.net resolving to the public IP without a conditional forwarder, but allowing the privatelink.table.core.windows.net addresses to resolve against the conditional forwarder.

Everything is fine when I follow the guides and forward the full domains. I'm working a hybrid DNS with conditional forwards. When I forward the entire domain from on-prem to my Azure DNS, everything comes back as expected for both the privatelink fqdn and the regular fqdn. No issues.

When I set my on-prem to forwarder to only the privatelink.table.core.windows.net addresses to Azure it does so sometimes, but not others. The most reliable thing I've tracked it down to is a DNS "poisoning" taking place after querying the public DNS.

The boxes highlight the different queries.

User's image

Boxes 1 and 2 come back as expected, and box 1 is repeatable until box 2 runs. Packet captures confirm that I'm doing a lookup in boxes 1 and 2, but not for the 3rd lookup. This leads me to believe box 3 seems to be "poisoned" by the CNAME in box 2's lookup and persists until TTL expires.

I know my request goes against official documentation, but in theory it should work. Is having box 1 always return the same result something I can/should try to achieve in the way I described?

Azure Private Link
Azure Private Link

An Azure service that provides private connectivity from a virtual network to Azure platform as a service, customer-owned, or Microsoft partner services.

0 comments

1 answer

Sort by: Newest
Most helpful Newest Oldest
  1. Gulnaz Mushtaq 490 Reputation points MVP
    2026-09-08T17:38:27.19+00:00

    Box 3 is most likely DNS caching and not poisoning.

    The resolver caches the CNAME from the public lookup of table.core.windows.net

    It can answer from the cache on the next request. So, it never queries privatelink.table.core.windows.net . This means your conditional forwarder is not invoked.

    Because the initial query hits the conditional forwarder. So, forwarding the entire domain is reliable.

    Inherently unreliable with normal recursive DNS caching if you forward only the privatelink target.

    This is not something you can reliably achieve with standard conditional forwarding. Making box 1 always return the public answer while selectively forwarding the CNAME target.

    You need a DNS architecture that does the initial query for the relevant name to reach the resolver authoritative for the Private Link zone, rather than relying on CNAME chasing to trigger forwarding.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.