To ensure your migrated Windows Server can continue resolving names in the Azure Private DNS zone after moving to the on-premises datacenter, follow these steps:
1. Provision an Inbound Endpoint: Create an inbound endpoint on the Azure DNS Private Resolver within your Azure virtual network. This endpoint will be assigned a private IP address from a dedicated subnet in your VNet.
2. Link the Private DNS Zone: Verify that the Azure Private DNS zone is linked to the virtual network where the Private Resolver is deployed.
*-> 3. Configure a Conditional Forwarder: On the migrated Windows Server (now on-premises), configure a Conditional Forwarder for the specific domain name of your Azure Private DNS zone.
Set the IP address of this forwarder to the IP address of the Azure DNS Private Resolver's inbound endpoint.
4. Verify Connectivity: Ensure that traffic for DNS queries (UDP/TCP port 53) can flow from the on-premises datacenter to the inbound endpoint's IP address over the ExpressRoute circuit.
This setup allows the on-premises server to forward queries for Azure resources directly to the resolver, which then uses the Azure-provided DNS (168.63.129.16) to resolve records from the linked private zone.
Reference:
https://learn.microsoft.com/en-us/azure/dns/dns-private-resolver-overview