Hybrid DNS

DNS resolution across on-prem & cloud — Azure · AWS · GCP

Concept

Hybrid DNS allows name resolution between on-premises and cloud environments. Both sides can resolve each other's hostnames via conditional forwarding or private zones.

Private DNS

Azure Private DNS Zones

Route 53 Private Hosted Zones

Cloud DNS Private Zones

On-prem to Cloud

Conditional Forwarder on on-prem DNS

Route 53 Resolver Inbound Endpoint

Cloud DNS Inbound Forwarding

Cloud to On-prem

Azure DNS Private Resolver (outbound)

Route 53 Resolver Outbound Endpoint

Cloud DNS Outbound Forwarding (forwarding zone)

Cross-VPC/VNet

VNet Peering (auto-registration optional)

VPC Peering + Route 53 Resolver

VPC Peering (auto, if private zone shared)

Custom Domains

Any (zone delegation)

Any (managed zone delegation)

GCP Hybrid DNS Setup

# 1. Create private DNS zone
gcloud dns managed-zones create gcp-internal \
  --dns-name="gcp.internal.simplelinks.co." \
  --description="Internal DNS" \
  --visibility=private \
  --networks=my-shared-vpc

# 2. Create forwarding zone for on-prem DNS resolution
gcloud dns managed-zones create onprem-forward \
  --dns-name="onprem.simplelinks.co." \
  --description="Forward to on-prem" \
  --visibility=private \
  --networks=my-shared-vpc \
  --forwarding-targets=10.0.0.53,10.0.0.54

# 3. Set up inbound forwarding endpoints (for on-prem to resolve GCP)
gcloud dns inbound-forwarding create gcp-dns-inbound \
  --network=my-shared-vpc \
  --ip-addresses=10.0.1.100,10.0.1.101

○ Azure — Azure Private DNS

Private DNS Zone: Links to VNets for internal resolution. Private Resolver enables inbound/outbound forwarding to on-prem DNS.

CLI:
az network private-dns zone create -g prod-rg -n internal.contoso.com

○ AWS — AWS Route 53

Private Hosted Zone: Associates with VPCs. Resolver endpoints (inbound/outbound) for hybrid DNS with on-prem forwarding.

CLI:
aws route53 create-hosted-zone --name internal.example.com --vpc VPCRegion=us-east-1,VPCId=vpc-xxx --caller-reference $(date)

○ GCP — GCP Cloud DNS

Managed Zone: Public or private. Inbound/outbound forwarding for hybrid scenarios. Private zones automatically resolve across peered VPCs.