HayamiHayami DTM and Azure DNS Private Resolver
These two are often weighed against each other, but they do different jobs, and plenty of environments run both. The resolver moves queries between networks. DTM decides what the answer is.
Different jobs, one resolution chain
Azure DNS Private Resolver is a managed forwarding bridge, and a good one: inbound endpoints let on-prem clients resolve into Azure, and outbound rules send chosen domains to other DNS servers. What it is not designed to be is an authoritative server: it does not own zones, and it does not health-check the things your names point at.
That is DTM's job. DTM serves your private zones authoritatively, probes every backend continuously, drops failing ones from the answer in tens of seconds, and load-balances across regions, all on private IPs. Point a resolver rule at DTM and the two compose: the resolver carries the query, DTM makes the answer worth having.
Where each one fits
An honest capability view. A “✗” means “not what it is designed for”, not a flaw: keep the resolver doing what it does well.
| Private Resolver | Hayami DTM | |
|---|---|---|
| Managed forwarding bridge between on-prem and Azure | ✓ | ✗ |
| Conditional forwarding rules between networks | ✓ | ✓ |
| Serve authoritative private zones you manage | ✗ | ✓ |
| Health-checked answers (failing backends drop out) | ✗ | ✓ |
| Load balancing and cross-region failover for private names | ✗ | ✓ |
| Weighted canary releases driven from CI | ✗ | ✓ |
| Fully managed PaaS, no VMs to run | ✓ | ✗ |
| Runs entirely inside your own subscription and VNet | ✓ | ✓ |
If all you need is forwarding between networks, the resolver alone is the right answer. DTM earns its place when the answers themselves need to be smart: health-gated, weighted, failing over across regions, and managed as code.
Running both, without the foot-guns
The common patterns are simple: point VNets at DTM and let it forward the rest to Azure, or leave VNet DNS untouched and add one resolver rule per DTM zone. Both are reversible, and the docs cover the forwarding-loop mistakes to avoid.
Coexistence patterns and wiring, in the docs · Health checks · ALIAS records (GSLB)
Keep the resolver. Add the answers.
Deploy DTM next to what you have and point one rule at it.
Questions? Email us.