From 6027a9cf6ddbadd75b54c724a9684bb90c8a6f3f Mon Sep 17 00:00:00 2001 From: Clyde Waal Date: Fri, 16 Oct 2026 00:15:10 +0200 Subject: [PATCH 1/3] Replace VNet DNS override with CoreDNS conditional forwarding - Remove deprecated Option 2 (Override DNS Resolution on Mendix Virtual Network) - Add new Option 2 (Configure Conditional DNS Forwarding) with CoreDNS-based forwarding - Move DNS configuration from self-service to support-ticket section in configuration overview - Update reflects MXFORAZURE-837 implementation (deployed Oct 15, 2026) Related: MXFORAZURE-837 Co-Authored-By: Claude Sonnet 4.5 --- .../mx-azure/configuration/_index.md | 2 +- ...-azure-network-interconnecting-networks.md | 28 +++++++++++++++++-- 2 files changed, 26 insertions(+), 4 deletions(-) diff --git a/content/en/docs/deployment/mx-azure/configuration/_index.md b/content/en/docs/deployment/mx-azure/configuration/_index.md index d8970896ebf..9e5a87dae73 100644 --- a/content/en/docs/deployment/mx-azure/configuration/_index.md +++ b/content/en/docs/deployment/mx-azure/configuration/_index.md @@ -104,7 +104,6 @@ The following configurations can be modified directly through the [Microsoft Azu | Configure virtual network peering on the vNet hosting Mendix on Azure | For more information, see [Implementing private connectivity using Azure Virtual Network Peering](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#network-peering). | | Deploy Private Link Service to expose Mendix apps in other Azure virtual networks | For more information, see [Using Private Link Service to expose Mendix apps in other Azure virtual networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#pls). | | Deploy Private Endpoints to establish connectivity between Mendix apps and other services | For more information, see [Accessing private services via Private Endpoints](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#pe-internal). | -| Override DNS configuration on the vNet hosting Mendix on Azure | For more information, see [DNS name resolution towards resources in other networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#name-resolution-dns-override). | | Tune server parameters on the shared PostgreSQL Flexible Server | For more information, see [Tuning PostgreSQL Server Parameters](/developerportal/deploy/mendix-on-azure/configuration/postgresql-parameter-tuning/). | ### Configuring AKS Planned Maintenance Windows {#aks-maintenance-windows} @@ -168,6 +167,7 @@ Certain configuration changes require Mendix intervention and can only be perfor | Configuration Change | Description | | --- | --- | +| Configure conditional DNS forwarding for internal domain resolution | Raise a support ticket. For more information, see [DNS name resolution towards resources in other networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#name-resolution-dns-override). | | PostgreSQL Maintenance Window | Configure a dedicated maintenance window for the PostgreSQL database hosting your Mendix app databases. Since maintenance might cause temporary app downtime, you can request a custom schedule instead of the default system-managed one. For more information, see the [Microsoft documentation on PostgreSQL maintenance windows](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-maintenance). This is separate from AKS maintenance windows, which you can configure directly (see [Configuring AKS Planned Maintenance Windows](#aks-maintenance-windows)). | {{% alert color="info" %}} diff --git a/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md b/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md index 6c68a807598..e7437815f10 100644 --- a/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md +++ b/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md @@ -95,11 +95,33 @@ Because the zone lives in a resource group you own, you can add, change, or remo This is standard Azure Private DNS configuration, not something specific to Mendix on Azure. Refer to the Microsoft documentation linked above for full details on managing Private DNS zones and virtual network links. {{% /alert %}} -##### Option 2: Override DNS Resolution on the Mendix Virtual Network +##### Option 2: Configure Conditional DNS Forwarding -Configuring the Mendix virtual network to use your own DNS server, as described in [Microsoft's DNS configuration instructions](https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances), requires modifying the virtual network itself. Because the Mendix virtual network is located in the [Managed Resource Group](/developerportal/deploy/mendix-on-azure/configuration/#mrg), which is protected by [Azure deny assignments](https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments), you cannot make this change yourself. +If your Mendix applications need to resolve internal domains in your organization's network (for example, on-premises services or resources in peered Azure VNets), Mendix Support can configure conditional DNS forwarding via CoreDNS. -To apply this change, [raise a support ticket](/developerportal/deploy/mendix-on-azure/support/) with Mendix Support, specifying your desired DNS server IP addresses and the names of the Mendix on Azure environments the change should be applied to. +###### How It Works + +Mendix on Azure uses CoreDNS within the Kubernetes cluster to handle DNS resolution for your application pods. Support can configure specific domain suffixes (for example, `internal.yourcompany.com`) to be forwarded to your organization's DNS servers, while all other DNS queries continue to use Azure's default DNS. + +###### Prerequisites + +Before requesting conditional DNS forwarding, ensure: + +1. **Network connectivity** - Your DNS servers must be reachable from the Mendix on Azure virtual network (via VNet peering, VPN Gateway, or ExpressRoute) +2. **Firewall rules** - Allow UDP and TCP traffic on port 53 from the Mendix on Azure virtual network to your DNS servers +3. **DNS server configuration** - Your DNS servers must be configured to resolve the domains you want to forward + +###### How to Request + +Raise a support ticket with Mendix Support, providing: + +1. **Environment name(s)** - Which Mendix on Azure environment(s) need this configuration +2. **Domain suffix(es)** - The internal domain(s) your apps need to resolve (for example, `internal.yourcompany.com`, `onprem.company.local`) +3. **DNS server IP address(es)** - The IP address(es) of your organization's DNS servers that should receive forwarded queries + +###### Important Notes + +- CoreDNS matches domains by longest suffix - configuring `yourcompany.com` automatically covers all subdomains like `api.internal.yourcompany.com` ### Solution 2: PrivateLink with Private Endpoints From 10460e6e64f2f4574586f4f6ef38f6a778463391 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 16 Oct 2026 10:01:14 +0200 Subject: [PATCH 2/3] Update _index.md --- content/en/docs/deployment/mx-azure/configuration/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/deployment/mx-azure/configuration/_index.md b/content/en/docs/deployment/mx-azure/configuration/_index.md index 9e5a87dae73..b6a61c5bc60 100644 --- a/content/en/docs/deployment/mx-azure/configuration/_index.md +++ b/content/en/docs/deployment/mx-azure/configuration/_index.md @@ -167,7 +167,7 @@ Certain configuration changes require Mendix intervention and can only be perfor | Configuration Change | Description | | --- | --- | -| Configure conditional DNS forwarding for internal domain resolution | Raise a support ticket. For more information, see [DNS name resolution towards resources in other networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#name-resolution-dns-override). | +| Configure conditional DNS forwarding for internal domain resolution | Raise a support ticket. For more information, see [DNS name resolution toward resources in other networks](/developerportal/deploy/mendix-on-azure/configuration/interconnecting-networks/#name-resolution-dns-override). | | PostgreSQL Maintenance Window | Configure a dedicated maintenance window for the PostgreSQL database hosting your Mendix app databases. Since maintenance might cause temporary app downtime, you can request a custom schedule instead of the default system-managed one. For more information, see the [Microsoft documentation on PostgreSQL maintenance windows](https://learn.microsoft.com/en-us/azure/postgresql/flexible-server/concepts-maintenance). This is separate from AKS maintenance windows, which you can configure directly (see [Configuring AKS Planned Maintenance Windows](#aks-maintenance-windows)). | {{% alert color="info" %}} From 79428f61872dcc4af147d0474684d3cf03666c07 Mon Sep 17 00:00:00 2001 From: katarzyna-koltun-mx <108737161+katarzyna-koltun-mx@users.noreply.github.com> Date: Fri, 16 Oct 2026 16:33:36 +0200 Subject: [PATCH 3/3] Update mx-azure-network-interconnecting-networks.md --- ...-azure-network-interconnecting-networks.md | 27 +++++++++---------- 1 file changed, 12 insertions(+), 15 deletions(-) diff --git a/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md b/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md index e7437815f10..4f0324c35c7 100644 --- a/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md +++ b/content/en/docs/deployment/mx-azure/configuration/mx-azure-network-interconnecting-networks.md @@ -99,29 +99,26 @@ This is standard Azure Private DNS configuration, not something specific to Mend If your Mendix applications need to resolve internal domains in your organization's network (for example, on-premises services or resources in peered Azure VNets), Mendix Support can configure conditional DNS forwarding via CoreDNS. -###### How It Works - Mendix on Azure uses CoreDNS within the Kubernetes cluster to handle DNS resolution for your application pods. Support can configure specific domain suffixes (for example, `internal.yourcompany.com`) to be forwarded to your organization's DNS servers, while all other DNS queries continue to use Azure's default DNS. ###### Prerequisites -Before requesting conditional DNS forwarding, ensure: - -1. **Network connectivity** - Your DNS servers must be reachable from the Mendix on Azure virtual network (via VNet peering, VPN Gateway, or ExpressRoute) -2. **Firewall rules** - Allow UDP and TCP traffic on port 53 from the Mendix on Azure virtual network to your DNS servers -3. **DNS server configuration** - Your DNS servers must be configured to resolve the domains you want to forward - -###### How to Request +Before requesting conditional DNS forwarding, ensure that you fulfill the following prerequisites: -Raise a support ticket with Mendix Support, providing: +* Network connectivity - Your DNS servers must be reachable from the Mendix on Azure virtual network (through VNet peering, VPN Gateway, or ExpressRoute). +* Firewall rules - You must allow UDP and TCP traffic on port 53 from the Mendix on Azure virtual network to your DNS servers. +* DNS server configuration - Your DNS servers must be configured to resolve the domains which you want to forward. -1. **Environment name(s)** - Which Mendix on Azure environment(s) need this configuration -2. **Domain suffix(es)** - The internal domain(s) your apps need to resolve (for example, `internal.yourcompany.com`, `onprem.company.local`) -3. **DNS server IP address(es)** - The IP address(es) of your organization's DNS servers that should receive forwarded queries +###### Requesting Conditional DNS Forwarding -###### Important Notes +To request conditional DNS forwarding, raise a support ticket with Mendix Support and provide the following information: +* Environment names - Specify which Mendix on Azure environments need this configuration. +* Domain suffixes - List the internal domains which your apps need to resolve (for example, `internal.yourcompany.com`, `onprem.company.local`). +* DNS server IP addresses - List the IP addresses of your organization's DNS servers that should receive forwarded queries. -- CoreDNS matches domains by longest suffix - configuring `yourcompany.com` automatically covers all subdomains like `api.internal.yourcompany.com` +{{% alert color="info" %}} +CoreDNS matches domains by longest suffix. Because of that, configuring `yourcompany.com` automatically covers all subdomains like `api.internal.yourcompany.com`. +{{% /alert %}} ### Solution 2: PrivateLink with Private Endpoints