Azure hub and spoke, Firewall with DNS proxy using default DNS

Andrea Pasquino 40 Reputation points
2026-09-15T07:53:19.9133333+00:00

Hello,

we have this setting:

Azure hub and spoke, Firewall with DNS proxy using default DNS, spoke vnets that point to the Firewall ip.

We have private dns zones with virtual network links to the hub.

We have private dns resolver with indbound and outbound endpoint, and a dns forwaring policy with virtual network links to the hub.

DNS resolution for all scenarios (public, private, hybrid) work perfectly.

Is there any good reason to set the firewall dns proxy to the ip of the inbound endpoint of the dns private resolver ?

Best Regards

Andrea

Azure DNS
Azure DNS

An Azure service that enables hosting Domain Name System (DNS) domains in Azure.

0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-09-15T07:53:39.99+00:00

    Not if the current design already resolves public, private, and hybrid names correctly.

    A good reason to point Azure Firewall DNS proxy to the Azure DNS Private Resolver inbound endpoint is when Azure Firewall must remain the DNS server for workloads, but DNS queries also need centralized handling by Private Resolver for scenarios such as forwarding specific domains to on-premises DNS. In that model, workloads send DNS to the firewall, and the firewall forwards upstream queries to the resolver inbound endpoint.

    In the described design, the main reasons to keep Azure Firewall DNS proxy enabled are:

    1. FQDN filtering in network rules: Azure Firewall requires DNS proxy to be enabled, and client virtual machines must use the firewall as their DNS server for consistent FQDN resolution.
    2. Consistent DNS resolution: If clients do not use the firewall as DNS proxy, the firewall and clients can resolve names differently.
    3. DNS logging: Routing DNS through Azure Firewall provides DNS request logging coverage.

    If those goals are already met and name resolution is already working for public, private, and hybrid scenarios, there is no documented requirement to change the firewall’s upstream DNS from default Azure-provided DNS to the Private Resolver inbound endpoint.

    A practical reason to change it would be to make the firewall forward DNS queries to Private Resolver so that conditional forwarding and centralized resolver logic are applied behind the firewall. That pattern is also reflected in Microsoft Q&A guidance for hybrid/on-premises name resolution when workloads must continue using Azure Firewall as DNS proxy.

    One important caveat: if Azure Firewall uses a custom DNS server, that IP must be from the virtual network and must not be part of the Azure Firewall subnet.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.