An Azure private DNS zone can only be resolved through the Azure-provided DNS resolver (168.63.129.16) by resources inside a virtual network the zone is linked to; it does not expose a directly queryable DNS server IP address that an on-premises server could target across the Site-to-Site VPN, so on-premises DC1 cannot resolve fabrikam.com by itself no matter what zone type it creates locally (ruling out a stub zone or secondary zone, both of which would need a real, reachable authoritative source to transfer from or refer to). The standard solution is to deploy a Windows Server virtual machine inside the linked virtual network and configure it as a DNS forwarder that forwards fabrikam.com queries to the Azure-provided resolver, which it can reach locally within the VNet; that VM ' s own IP address is then reachable from on-premises across the Site-to-Site VPN. With that forwarder VM in place, DC1 on-premises is configured with a conditional forwarder for the fabrikam.com domain pointed at the forwarder VM ' s IP address, so any fabrikam.com query DC1 receives is relayed across the VPN to the forwarder VM, which resolves it against Azure ' s private DNS resolution path. Modifying the VNet ' s DNS Servers setting is unnecessary for this specific requirement, since it changes name resolution for Azure resources, not for on-premises clients.