Private Endpoint DNS¶
Most Integration Platform components are exposed only through Azure Private Link. For people and systems on your own networks (for example on-premises) to resolve these endpoints to their private addresses, your DNS must forward the relevant public DNS zones to the Azure DNS path of the platform. This page lists the zones for the reference design. It is for the platform team and the network team of the customer.
Reference list
This is the narrowed list for the Integration Platform as described in the reference design. It is not a generic Azure Private Link list. Review it whenever you add a capability that uses private endpoints, for example Azure AI services or other services with private endpoints. For the MCP design of private DNS, see DNS design.
Required base domains¶
| Base domain | Used by |
|---|---|
windows.net |
Storage, Service Bus and Event Hubs private endpoints |
azure.net |
Key Vault and Data Factory private endpoints |
azurewebsites.net |
Logic App Standard and Function App private endpoints |
azure-api.net |
API Management private endpoints |
azurecr.io |
Azure Container Registry private endpoints |
Examples of the names that fall under these domains:
| Domain | Example names |
|---|---|
windows.net |
blob.core.windows.net, queue.core.windows.net, table.core.windows.net, file.core.windows.net, dfs.core.windows.net, servicebus.windows.net |
azure.net |
vault.azure.net, datafactory.azure.net |
Who does what¶
| Step | Who |
|---|---|
| Decide which of the base domains apply to your platform (only those of the services you run) | Platform team |
| Configure conditional forwarding on the on-premises DNS servers to the Azure DNS path of the platform | Customer network team |
| Check name resolution from an on-premises host (the name must resolve to a private address) | Both |