diff --git a/content/en/docs/deployment/mx-azure/configuration/_index.md b/content/en/docs/deployment/mx-azure/configuration/_index.md index d8970896ebf..b6a61c5bc60 100644 --- a/content/en/docs/deployment/mx-azure/configuration/_index.md +++ b/content/en/docs/deployment/mx-azure/configuration/_index.md @@ -104,7 +104,6 @@ The following configurations can be modified directly through the [Microsoft Azu | Configure virtual network peering on the vNet hosting Mendix on Azure | For more information, see [Implementing private connectivity using Azure Virtual Network Peering](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#network-peering). | | Deploy Private Link Service to expose Mendix apps in other Azure virtual networks | For more information, see [Using Private Link Service to expose Mendix apps in other Azure virtual networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#pls). | | Deploy Private Endpoints to establish connectivity between Mendix apps and other services | For more information, see [Accessing private services via Private Endpoints](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#pe-internal). | -| Override DNS configuration on the vNet hosting Mendix on Azure | For more information, see [DNS name resolution towards resources in other networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#name-resolution-dns-override). | | Tune server parameters on the shared PostgreSQL Flexible Server | For more information, see [Tuning PostgreSQL Server Parameters](/developerportal/deploy/mendix-on-azure/configuration/postgresql-parameter-tuning/). | ### Configuring AKS Planned Maintenance Windows {#aks-maintenance-windows} @@ -168,6 +167,7 @@ Certain configuration changes require Mendix intervention and can only be perfor | Configuration Change | Description | | --- | --- | +| Configure conditional DNS forwarding for internal domain resolution | Raise a support ticket. For more information, see [DNS name resolution toward resources in other networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#name-resolution-dns-override). | | PostgreSQL Maintenance Window | Configure a dedicated maintenance window for the PostgreSQL database hosting your Mendix app databases. Since maintenance might cause temporary app downtime, you can request a custom schedule instead of the default system-managed one. For more information, see the [Microsoft documentation on PostgreSQL maintenance windows](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-maintenance). This is separate from AKS maintenance windows, which you can configure directly (see [Configuring AKS Planned Maintenance Windows](#aks-maintenance-windows)). | {{% alert color="info" %}} diff --git a/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md b/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md index 6c68a807598..4f0324c35c7 100644 --- a/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md +++ b/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md @@ -95,11 +95,30 @@ Because the zone lives in a resource group you own, you can add, change, or remo This is standard Azure Private DNS configuration, not something specific to Mendix on Azure. Refer to the Microsoft documentation linked above for full details on managing Private DNS zones and virtual network links. {{% /alert %}} -##### Option 2: Override DNS Resolution on the Mendix Virtual Network +##### Option 2: Configure Conditional DNS Forwarding -Configuring the Mendix virtual network to use your own DNS server, as described in [Microsoft's DNS configuration instructions](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances), requires modifying the virtual network itself. Because the Mendix virtual network is located in the [Managed Resource Group](/developerportal/deploy/mendix-on-azure/configuration/#mrg), which is protected by [Azure deny assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments), you cannot make this change yourself. +If your Mendix applications need to resolve internal domains in your organization's network (for example, on-premises services or resources in peered Azure VNets), Mendix Support can configure conditional DNS forwarding via CoreDNS. -To apply this change, [raise a support ticket](/developerportal/deploy/mendix-on-azure/support/) with Mendix Support, specifying your desired DNS server IP addresses and the names of the Mendix on Azure environments the change should be applied to. +Mendix on Azure uses CoreDNS within the Kubernetes cluster to handle DNS resolution for your application pods. Support can configure specific domain suffixes (for example, `internal.yourcompany.com`) to be forwarded to your organization's DNS servers, while all other DNS queries continue to use Azure's default DNS. + +###### Prerequisites + +Before requesting conditional DNS forwarding, ensure that you fulfill the following prerequisites: + +* Network connectivity - Your DNS servers must be reachable from the Mendix on Azure virtual network (through VNet peering, VPN Gateway, or ExpressRoute). +* Firewall rules - You must allow UDP and TCP traffic on port 53 from the Mendix on Azure virtual network to your DNS servers. +* DNS server configuration - Your DNS servers must be configured to resolve the domains which you want to forward. + +###### Requesting Conditional DNS Forwarding + +To request conditional DNS forwarding, raise a support ticket with Mendix Support and provide the following information: +* Environment names - Specify which Mendix on Azure environments need this configuration. +* Domain suffixes - List the internal domains which your apps need to resolve (for example, `internal.yourcompany.com`, `onprem.company.local`). +* DNS server IP addresses - List the IP addresses of your organization's DNS servers that should receive forwarded queries. + +{{% alert color="info" %}} +CoreDNS matches domains by longest suffix. Because of that, configuring `yourcompany.com` automatically covers all subdomains like `api.internal.yourcompany.com`. +{{% /alert %}} ### Solution 2: PrivateLink with Private Endpoints