# Cloud Networking, DNS and Private Endpoints

> How cloud networking really behaves: DNS caching, private endpoints as DNS overrides, NAT and MTU traps, and the VNet, VPC and global VPC differences.

- Web page: https://www.alesanalytics.com/architecture/networking
- Markdown: https://www.alesanalytics.com/architecture/networking.md
- Part of: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md), section "Cloud platforms"
- Last verified: 13 October 2026
- Publisher: Ales Analytics

## What a network has to answer

A packet needs an address, a path and permission. A name has to be turned into an address by somebody you trust. Most networking incidents in the cloud are a failure of one of those four things, and most of them are DNS.

The question to ask of any network design is: **who can talk to whom, over what path, resolved by whose DNS, under what policy?**

## The parts

- **Primitives:** CIDR addressing, longest-prefix routing, BGP, NAT, DNS, layer 4 against layer 7, TLS and mutual TLS.
- **Components:** VPCs and VNets, gateways, transit hubs, firewalls, load balancers, forward and reverse proxies, private endpoints, WAFs and CDNs.
- **Flows:** north-south traffic comes in through a WAF or CDN to a layer 7 load balancer. East-west traffic between services runs over a service mesh with mutual TLS. Egress leaves through NAT or a proxy with an allow-list of fully qualified domain names.
- **Patterns:** hub and spoke, Shared VPC, private-endpoint-only platform services, identity-aware proxies, split-horizon DNS.
- **What it costs:** data transfer between zones and regions, NAT charged per gigabyte, hourly charges for each private endpoint, and internet egress.

## How DNS really behaves

**Answers are cached for their TTL by recursive resolvers, and negative answers are cached too.** If a record goes missing for a minute, "this name doesn't exist" can be remembered for the negative-caching TTL after the record comes back.

**Some clients cache longer than the TTL.** Language runtimes, connection pools and long-lived processes are the usual culprits. A five-minute TTL is a request, not a guarantee.

**Split-horizon DNS returns different answers depending on where the question comes from.** It's how one name can mean a private address inside the network and a public one outside it.

**Private endpoints are a DNS override.** This is the mechanism that surprises people most, so it gets its own diagram.

**Figure: A private endpoint is a DNS override, which makes the zone owner the gatekeeper.** A client looks up the storage account's public name. A private DNS zone answers that name with a private address, such as 10.1.4.7. The client connects to the private endpoint, a network interface in the client's virtual network, which reaches the storage account over Private Link. The storage account still decides on identity. AWS PrivateLink and Google's Private Service Connect work the same way. The public name still exists. A private DNS zone answers it with a private address for anyone who resolves through that zone, so whoever owns the zone owns the path. An on-premises client that resolves through the wrong forwarder silently goes to the public endpoint, or nowhere. AWS PrivateLink and Google's Private Service Connect work the same way, with the same question of who owns the DNS.

A private endpoint doesn't change the service's public name. It puts a network interface with a private address in your network, and a private DNS zone answers the public name with that address for anyone who resolves through the zone. The consequence is the important part: **whoever owns the zone owns the path.** An on-premises client whose resolver doesn't forward to the right place either fails or quietly goes to the public endpoint. And private connectivity isn't a data perimeter: a private endpoint to *another tenant's* storage account is just as private, which is why exfiltration controls need endpoint policies or a perimeter on top.

## Less obvious mechanics

- **NAT maps many internal flows onto a few public address and port pairs.** Concurrent connections to one destination are bounded by the ports available per source address. Run out and new connections fail while old ones carry on.
- **An MTU mismatch with ICMP blocked produces black-hole connections** that work for small requests and hang on large ones. It looks like an application bug for days.
- **Stateful firewalls drop asymmetric return traffic.** If the request goes out through one firewall and the reply comes back through another, the second has no record of the connection.
- **IPv6 and dual-stack paths can carry different policy from IPv4.** A control that exists only on the IPv4 path isn't a control.

## Architectures that work

Hub and spoke, or a transit network, with centralised egress through an FQDN allow-list. Hybrid DNS with conditional forwarders for each private zone. Global traffic management, either anycast at the edge or DNS-based. Service discovery through DNS or a mesh registry.

## How networks fail

- **An empty DNS record.** In October 2025 a race in DynamoDB's DNS automation left the regional endpoint with no addresses. Every client failed, and recovery was slowed by caches holding the bad answer.
- **Private-endpoint misresolution from on-premises,** usually a missing or wrong conditional forwarder.
- **BGP route leaks or withdrawals.**
- **Certificate-chain errors after an intermediate CA is rotated.**
- **Ephemeral-port exhaustion on proxies.**
- **Asymmetric routing through stateful firewalls.**

## Trade-offs

**Global against regional networks.** Google's global VPC makes cross-region designs simpler and makes a single network a larger blast radius. Regional VNets and VPCs make you build the connections, and contain mistakes to a region.

**Centralised against distributed egress.** A central egress point is easier to inspect and allow-list, and becomes a shared dependency for everything that talks to the internet.

**TLS inspection against pinning and privacy.** Inspection lets you see what leaves. It also breaks clients that pin certificates, and puts a decryption point in the middle of traffic that may be personal data.

## By provider

| Concern | Azure | AWS | Google Cloud |
| --- | --- | --- | --- |
| Network scope | Regional VNet | Regional VPC | Global VPC |
| Private platform access | Private Endpoint and a private DNS zone | PrivateLink interface endpoints | Private Service Connect |
| Data perimeter | Composed | Composed: endpoint policies, RCPs, SCPs | VPC Service Controls |
| Transit | Virtual WAN, hub | Transit Gateway, Cloud WAN | Network Connectivity Center, Shared VPC |
| Edge | Front Door | CloudFront, Global Accelerator | Global external Application Load Balancer |

## Questions to ask in a review

Who owns this DNS zone? What is the TTL, and what ignores it? Is the return path symmetric? What happens when the conditional forwarder fails? Does the IPv6 path bypass the controls on the IPv4 one? Does egress have an allow-list, and who maintains it?

The scenarios that test this page are the [internal AI assistant](https://www.alesanalytics.com/architecture/scenarios.md), [strict data residency](https://www.alesanalytics.com/architecture/scenarios.md) and the [hybrid enterprise](https://www.alesanalytics.com/architecture/scenarios.md).

Should you have any questions regarding this page, please contact us at solutions@alesanalytics.com.

## Sources

1. [Summary of the Amazon DynamoDB Service Disruption in the Northern Virginia (US-EAST-1) Region](https://aws.amazon.com/message/101925/). Amazon Web Services, 2025. AWS's post-event summary for 19 and 20 October 2025: a race in DynamoDB's DNS automation left an empty record, with impact in three phases ending at 2:20 PM PDT on 20 October.

## Where to go next

- Previous: [Azure, AWS and Google Cloud Compared](https://www.alesanalytics.com/architecture/cloud-providers.md)
- Next: [Identity, Tokens and Authorization](https://www.alesanalytics.com/architecture/identity.md)
- Overview and every page: [Enterprise Architecture Atlas](https://www.alesanalytics.com/architecture.md)
- The whole site in one file: https://www.alesanalytics.com/llms-full.txt