<companyname>.privatelink.unstructuredapp.io) resolves to the private IP of your Azure Private Endpoint. This step happens after you create your Private Endpoint as part of onboarding.
Clients must connect using the dedicated instance hostname because TLS is terminated using a provider-managed certificate. The two most common setups are below — choose the one that matches your authoritative DNS.
Choose your setup
A Zero Trust Network (such as Zscaler) is a network path, not a DNS authority. Clients connecting through a ZTN still resolve DNS through whichever DNS system you use, so the section that matches your authoritative DNS already covers them. Note that some ZTN configurations intercept or proxy DNS queries — if your ZTN performs DNS interception, verify that queries for
<companyname>.privatelink.unstructuredapp.io are forwarded to your configured DNS system and not resolved independently by the ZTN.You use Azure DNS
This is the simplest setup if you already use Azure DNS in your subscription.In-VNet clients
When you create your Private Endpoint, select Integrate with private DNS zone and choose or create an Azure Private DNS Zone namedprivatelink.unstructuredapp.io. Azure automatically creates an A record in the zone that resolves your dedicated instance hostname to the Private Endpoint’s private IP. Link the zone to every VNet that needs access. No additional DNS configuration is needed.
For more on automatic registration, see Private Endpoint DNS integration scenarios.
On-premises clients (ExpressRoute or VPN)
The Private DNS Zone integration in the previous section only works for clients inside a linked VNet. If you have on-premises clients reaching the platform over ExpressRoute or a VPN, bridge your on-premises DNS to Azure DNS with an Azure DNS Private Resolver inbound endpoint and a conditional forwarder. This assumes you already have a private network connection (ExpressRoute or VPN) between your on-premises network and your VNet, and that the Private DNS Zone is linked to the VNet that hosts the Private Resolver.-
Create an Azure DNS Private Resolver inbound endpoint. In the Azure portal, go to DNS Private Resolvers, create a resolver in the VNet linked to the Private DNS Zone, then add an inbound endpoint in a dedicated subnet. Azure assigns the endpoint a private IP (for example,
10.0.10.4). Note this IP. -
Add a conditional forwarder on your on-premises DNS. Forward queries for
privatelink.unstructuredapp.ioto the inbound endpoint IP. Forwarding the parent zone covers<companyname>.privatelink.unstructuredapp.ioand all subdomains (for exampleapi.<companyname>.privatelink.unstructuredapp.io) automatically — no per-instance rules are needed. Examples for common DNS systems:-
Windows DNS Server / Active Directory DNS: Open DNS Manager → Conditional Forwarders → New Conditional Forwarder. Enter
privatelink.unstructuredapp.ioas the DNS Domain and add the inbound endpoint IP. -
BIND: Add the following to
named.conf, then runrndc reload: -
Infoblox: Go to Data Management → DNS → Forward Zones → Add. Enter
privatelink.unstructuredapp.ioas the zone name and add the inbound endpoint IP as the forwarder.
-
Windows DNS Server / Active Directory DNS: Open DNS Manager → Conditional Forwarders → New Conditional Forwarder. Enter
- Validate from an on-premises client. See Validation.
You use your own DNS
If your authoritative DNS is something other than Azure DNS — for example, Infoblox, BIND, or Active Directory DNS — this is the recommended path. The same records serve clients in your VNet, on-premises clients reaching the platform over ExpressRoute or VPN, and laptops routed through a Zero Trust Network. There is no separate setup per client location, and no Azure DNS Private Resolver is required. Unstructured cannot create these records for you because your Private Endpoint and its private IP live in your subscription.Recommended: A records to the Private Endpoint’s private IP
Add an apex and wildcard A record on a per-dedicated-instance zone in your internal DNS. The records resolve directly to the Private Endpoint’s private IP. The wildcard ensures all current and future subdomains — for exampleapi. and platform-api. — resolve without additional DNS changes.
Example records for a Private Endpoint with private IP 10.0.5.12:
An Azure Private Endpoint has a single primary private IP per region. A TTL of 300 seconds is recommended. Find the Private Endpoint’s private IP in the Azure portal: open the Private Endpoint resource, go to DNS configuration, and read the IP addresses column.
Multiple dedicated instances
Customers with multiple dedicated instances configure a separate zone per dedicated instance. For example, a customer with development, staging, and production instances configures:<companyname>-dev.privatelink.unstructuredapp.io→ A records pointing at the dev instance’s Private Endpoint IP<companyname>-staging.privatelink.unstructuredapp.io→ A records pointing at the staging instance’s Private Endpoint IP<companyname>-prod.privatelink.unstructuredapp.io→ A records pointing at the prod instance’s Private Endpoint IP
privatelink.unstructuredapp.io namespace on your internal DNS and lets you connect to additional dedicated instances later without conflicts.
Validation
From within the target network, run the following:nslookup instead of dig.
Both queries should return private IP addresses within your VNet CIDR range. If they return public IP addresses or fail to resolve, see Troubleshooting.