Reference: How-To Post

Sun, 11 Oct 2026 00:00:00 +0000

Private Endpoint DNS is one of those things that looks straightforward until it isn’t. The Azure docs cover the happy path well enough. What they don’t cover is what happens in a hub-and-spoke environment where your DNS lives in the hub and your workloads are spread across spokes.

This is the setup I run into most often in practice, and it has a few non-obvious gotchas.

The problem
#

When you create a Private Endpoint, Azure creates a private DNS zone and links it to the VNet the endpoint lives in. In a flat network, that’s fine. In hub-and-spoke, your workloads in the spoke VNets won’t resolve the private IP — they’re not linked to that zone, and your central DNS forwarder in the hub doesn’t know about it either.

Networking on takebakker.dev

Reference: How-To Post

The problem #

The problem
#