Explanation:

In the Administering Windows Server Hybrid Core Infrastructure guidance for name resolution with Azure Private DNS, Microsoft describes the split-horizon scenario where you host contoso.com both as a Public DNS zone and as an Azure Private DNS zone linked to a virtual network. The documentation explains that Azure Private DNS "is resolvable only from within the VNet" and that the special Azure DNS virtual IP
168.63.129.16 is the target used by workloads inside the VNet to resolve private zone records. For hybrid resolution from on-premises, the guidance states that you deploy a DNS forwarder/proxy VM in the VNet (a Windows Server DNS role is acceptable) and configure it with a conditional forwarder for the private zone that forwards to 168.63.129.16. Then, on the on-premises DNS servers, you create a conditional forwarder for the same zone that points to the DNS forwarder VM in Azure across the Site-to-Site VPN. This pattern ensures on-premises queries for contoso.com resolve the private zone records via Azure, while public Internet clients continue to use the public DNS zone. Consequently:
* On VNet1, VM1 (DNS server) must forward contoso.com queries to 168.63.129.16.
* On the on-premises DNS, configure a conditional forwarder for contoso.com to VM1.Setting VNet DNS to the Azure-provided IP is unnecessary (it's the default for Azure VMs) and forwarding to the public zone would bypass the private zone, which is not desired.