Snippets

Azure snippet: check the Private DNS Resolver path before changing a zone

A short sequence to confirm private zone, VNet link, ruleset and forwarding rule before touching DNS records.

17 Jun 2026 azureprivate-dnsdns-resolvernetworkingprivate-endpointclirunbookhybrid

Before adding a DNS rule or fixing a record during an incident, confirm that resolution actually goes through the expected zone, linked VNet and Private DNS Resolver ruleset.

bash private-dns-resolver-path.sh

SUBSCRIPTION="00000000-0000-0000-0000-000000000000"
RG_DNS="rg-dns-prod"
ZONE="privatelink.database.windows.net"
RULESET="dnsrs-hub-prod"

az account set --subscription "$SUBSCRIPTION"
az network private-dns link vnet list --resource-group "$RG_DNS" --zone-name "$ZONE" --query "[].{name:name,vnet:virtualNetwork.id,registration:registrationEnabled}" -o table

az network private-dns record-set a list --resource-group "$RG_DNS" --zone-name "$ZONE" --query "[].{record:name,ttl:ttl,ips:aRecords[].ipv4Address}" -o table

az network dns forwarding-ruleset rule list --resource-group "$RG_DNS" --ruleset-name "$RULESET" --query "[].{domain:domainName,enabled:forwardingRuleState,target:targetDnsServers[].ipAddress}" -o table

Quick read: if the consumer VNet is not linked, fix the link before the zone; if the record exists but points to an old private IP, handle Private Endpoint drift; if a forwarding rule captures the suffix, validate the downstream DNS target first.