Azure Private Endpoint DNS Split-Brain: nslookup When the App Still Hits the Public IP

Azure · Techclick CLI troubleshooting lab

Private endpoint is approved. nslookup from the VM still returns the public IP. The app uses the public path and fails the firewall.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Azure for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Private endpoints need the privatelink DNS zone linked to the VNet. Without it, the public name never flips.

Why this ticket shows up

The resource FQDN only becomes private if the zone is linked. Approval of the endpoint is not DNS.

Symptoms operators actually see

• nslookup public IP

• Private endpoint approved

• Zone not linked

• Works from a peered hub that has the link

CLI first — copy this block

Run these on the Azure device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

nslookup mystorage.blob.core.windows.net
az network private-endpoint dns-zone-group list --endpoint-name pe1 -g rg1
az network vnet list --query "[].{name:name,id:id}"
az network private-dns link vnet list -g rg1 --zone-name privatelink.blob.core.windows.net -o table

How to read that output

You want a private A record in the privatelink zone and a VNet link. Public IP in nslookup means the link is missing on this VNet.

Triage order

1. nslookup from the VM

2. Check zone group on the PE

3. Link the privatelink zone to this VNet

4. Flush DNS

5. nslookup again

Classic traps

What you see	Real cause	Fix
Recreate the PE	DNS is the miss	Link the zone
Add a hosts file	Next VM will fail	Fix the zone
Open the public firewall	You defeated the PE	Fix DNS

Proof the ticket is closed

• nslookup returns 10.x

• TCP to 10.x:443 works

• Public IP no longer used

Say this in an interview

A private endpoint without a VNet-linked privatelink zone is just an unused NIC.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/