internal DNS zone for Container Apps is not being injected into my VNet

Hi @DT ,

Thanks for reaching out to Microsoft Q&A.

It looks like you’ve done everything on the Container Apps side, but DNS for your internal FQDN isn’t magically “injected” into your VNet, you have to wire up that private DNS yourself or forward queries to Azure’s recursive resolver.

Follow below steps to get your *.internal.<env>.<region>.azurecontainerapps.io names to resolve from your VMs:

1. Verify your environment is really deployed with internal ingress and in the VNet -Run

      
      az containerapp env show \
      
       -n <YourEnvName> \
      
       -g <YourEnvRG> \
      
       --query "{subnet:infrastructureSubnetId, dnsSuffix:customDomainConfiguration.customDomainLabel}"
      
   

   • Confirm you see a non-null infrastructureSubnetId and your DNS suffix looks like

    `mancont312.internal.bravewater-d9e2aebd.eastus2.azurecontainerapps.io`
   

2. Get the internal (ILB) IP address of your environment • Look in the MC_… resource group that Azure Container Apps created—find the Load Balancer resource and note its private frontend IP
3. Create an Azure Private DNS zone for your default domain • In the Portal or via CLI, make a Private DNS zone named exactly <UNIQUE_ENV_ID>.internal.<REGION>.azurecontainerapps.io (e.g. bravewater-d9e2aebd.eastus2.internal.eastus2.azurecontainerapps.io – check your actual suffix!) • In that zone, add an “A” record: • Name: * (or your app-specific host if you prefer) • IP address: the ILB frontend IP from step 2
4. Link that DNS zone to your VNet • In the Private DNS zone’s “Virtual network links” blade, link it to the same VNet where your VMs live (and where the Container Apps environment is deployed)
5. Check your VM’s DNS settings • If you’re using Azure-provided DNS, you’re done—just nslookup your FQDN and you should get the ILB IP • If you have a custom DNS server: make sure it forwards unresolved queries to Azure’s recursive resolver at 168.63.129.16 (or allow the AzurePlatformDNS service tag through your firewall/NSG)

Once your zone is linked and the record is in place, any VM in that VNet asking for

nslookup mancont312.internal.bravewater-d9e2aebd.eastus2.azurecontainerapps.io

will get back your private VIP and be able to route traffic to your container app via the internal load balancer.

Hope this helps!

References:

Deploy a Container Apps environment to a VNet

Securing a custom VNet in Azure Container Apps (NSG rules)

Private endpoints and DNS for virtual networks in Azure Container Apps environments

Azure recursive resolvers & forwarding (168.63.129.16)