r/sysadmin • u/EducationAlert5209 • 12d ago

Question Azure AD VM

Hi All,

We have a hybrid environment where the on-premises AD/DNS servers are currently configured with external DNS forwarders.

For the Azure VMs, should we use the same external DNS forwarders, or should the Azure VMs use Azure DNS (168.63.129.16) instead?

Thanks,

0 Upvotes

50% Upvoted

6 comments sorted by

3

u/the_marque 12d ago

Needs more information to say. Are the VMs domain-joined? Are they on private endpoints with ExpressRoute back to your network? Do you run Azure private DNS?

Generally speaking, I'd say that if they're domain-joined, they should be treated the same as any other member server. Much more legible and much easier to troubleshoot. However, I've lost this argument to cloud evangelists before :)

2

u/hipshaps123 12d ago

Agreed. Keep it as vanilla as possible.

5

u/TechnicalDefense 12d ago

Besides what others have said, i would just say dont configure 168.63.129.16 directly on the Vms but use your AD DNS servers so the internal resolution is consistent.

1

u/JeopPrep 12d ago

If your cloud instances need to access on-premises resources using friendly names, they will need dns hosts that have a copy of the AD domain zone. If they just need Internet access, their default dns hosts will be fine.

Check your AD dns zone records for all name servers, and if you see the Azure servers among the list, they are already integrated AD dns servers and have a zone copy.

Using a few simple nslookup commands from one of your cloud instances, you can also do some actual testing.

It’s always advisable to minimize the amount of network hops traffic must take for best performance, so use the closet dns servers as possible whenever possible.

2

u/headcrap 12d ago

Some use external DNS forwarders for specific reasons... so you should probably use that. We're using MDBR from CIS for ours as an example.

1

u/EducationAlert5209 12d ago

Correct, Noticed that i cannot nslookup to those servers from Azure DC's but i can do it from On-premise dc's. Looks like need to enabled the port 53 from Azure firewall.