Troubleshoot DNS resolution between Azure and on-premises networks using Azure DNS Private Resolver, forwarding rulesets and private DNS zones.
Start with Identify the DNS direction and work through the six diagnostic checks in order.
Record results before changing configuration and validate the original symptom after each controlled change.
Quick checks
Start with the basic checks in this runbook before moving to deeper troubleshooting.
- Confirm the affected service or component is available.
- Check recent configuration or connectivity changes.
- Run the relevant commands and compare the result with the expected state.
Identify the DNS direction
Determine whether the failure is on-premises to Azure, Azure to on-premises, or both directions.
Check inbound endpoint reachability
Confirm the inbound endpoint is reachable and accepts DNS queries from the intended source networks.
Check outbound forwarding
Verify the outbound endpoint and forwarding ruleset are associated with the correct VNet and target DNS servers.
Check network path
Check VPN or ExpressRoute routing, NSGs, firewalls and TCP/UDP 53 reachability across the path.
Check recursion and forwarding
Validate forwarding rules, recursive behavior and the authoritative or upstream DNS server being queried.
Test large DNS responses
If basic lookups work but larger responses fail, investigate MTU, fragmentation and DNS transport behavior.
Useful commands
Run these checks from an appropriate administrative session and replace example values with your environment.
DNS query
Resolve-DnsName <fqdn> -Server <dns-server>Network reachability
Test-NetConnection <dns-server> -Port 53Quick troubleshooting path
Use this sequence to isolate the failing dependency before changing production configuration.
- Identify the DNS direction → Determine whether the failure is on-premises to Azure, Azure to on-premises, or both directions.
- Check inbound endpoint reachability → Confirm the inbound endpoint is reachable and accepts DNS queries from the intended source networks.
- Check outbound forwarding → Verify the outbound endpoint and forwarding ruleset are associated with the correct VNet and target DNS servers.
- Check network path → Check VPN or ExpressRoute routing, NSGs, firewalls and TCP/UDP 53 reachability across the path.
- Check recursion and forwarding → Validate forwarding rules, recursive behavior and the authoritative or upstream DNS server being queried.
- Test large DNS responses → If basic lookups work but larger responses fail, investigate MTU, fragmentation and DNS transport behavior.
What good troubleshooting looks like
Good infrastructure troubleshooting is evidence-driven. Capture the original state, test the dependency that can prove or disprove your hypothesis, make the smallest safe change and repeat the original test.
Symptom → hypothesis → direct test → result → controlled change → validation → documentation