DNS lookup is not giving the right private IP address

Question

From azure cloud, I set up a key vault with a private endpoint and configured the name resolution in the private DNS zone A records. I also created a virtual machine in the same VNET and subnet as the key vault and tried to query the DNS, but the private IP address was wrong and returning from the range of below reference link.

Azure Custom Routes

My VM is Linux (ubuntu 22.04) and has a size of Standard D4s v5 (4 vcpus, 16 GiB memory).

We have set up the private DNS zone to link to the same VNET as the key vault resource. The private endpoint connection has been approved and connected to the key vault. We are using the same VNET and subnet for both resources. There is no on premises networks enabled or configured.

DevOps: I am deploying infrastructure through ARM Template Deployment Task with Microsoft hosted pipeline and its success.

Actual Outcome: Address: 20.61.103.228

Expected Outcome: Address: 10.0.0.0.6

Answer 1

Looking at the configuration posted, it doesn't look like we expect the resolution to happen as expected. The private dns zone posted is

".privatelink.vaultcore.azure.net" which has the A "recordpoc-privatetest-kv"

So the domain which would resolve to 10.0.0.6 configured is: "recordpoc-privatetest-kv..privatelink.vaultcore.azure.net"

The issue is that "recordpoc-privatetest-kv.privatelink.vaultcore.azure.net" is being resolved publicly.

I would suggest two different solutions:

1. update the CNAME record for "recordpoc-privatetest-kv.vaultcore.azure.net" to point to "recordpoc-privatetest-kv..privatelink.vaultcore.azure.net"
2. Change your private dns zone from ".privatelink.vaultcore.azure.net" to "privatelink.vaultcore.azure.net" and create your A record, "recordpoc-privatetest-kv" in the new private dns zone

Ether approach should help you resolve "recordpoc-privatetest-kv.vaultcore.azure.net" to "10.0.0.6"