Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Resolving cloud DNS names in a corporate network

Written by
Improved by
Updated at August 11, 2026
View in Markdown

If you have your own corporate networks connected to Yandex Cloud networks (e.g., via Yandex Cloud Interconnect), you can integrate your corporate DNS with internal DNS zones in Yandex Cloud and implement resolution of DNS names of cloud resources within your corporate networks. This will allow you to access cloud resources and Yandex Cloud services by name from your corporate networks.

To configure resolution of internal cloud DNS names by clients in your corporate network, you will create an inbound DNS connection on the Yandex Cloud side to redirect DNS requests from the corporate network to DNS resolvers in Virtual Private Cloud subnets. On the corporate network side, you will set up a DNS server, so that all DNS requests to cloud resources are redirected to the IP address of your new inbound DNS connection.

In this scenario, a user connected to a corporate subnet in subnet1 resolves a DNS name of a Yandex Managed Service for PostgreSQL cluster host by sending DNS requests via a local DNS forwarder.

You can see the solution architecture in the diagram below:

DNS integration example

  1. Corporate network:

    • Consists of the subnet1 subnet with the 172.16.1.0/24 address range.

    • subnet1 hosts a DNS server (DNS forwarder) with the 172.16.1.200 IP address.

      This server serves the DNS zone in the subnet1 subnet and redirects DNS requests from the user's computer 172.16.1.10 to the cloud network, namely to the IP address of the inbound DNS connection created on the Yandex Cloud side.

  2. Yandex Cloud network:

    • Consists of the subnet2 subnet with the 192.168.1.0/24 address range.

    • subnet2 hosts a Yandex Managed Service for PostgreSQL cluster.

      In this tutorial, you will set up integration in such a way that the DNS name (FQDN) of that cluster’s host successfully resolves from within the corporate network.

    • The cloud network has an inbound DNS connection allowing the corporate network clients to resolve DNS names in Yandex Cloud internal DNS zones.

      The inbound DNS connection was assigned the 192.168.1.200 IP address which belongs to subnet2 and is reserved in Yandex Virtual Private Cloud.

  3. Thanks to Yandex Cloud Interconnect, the corporate and cloud networks are linked together in such a way that all the subnet IP addresses in one network are accessible from the other network's subnet, and vice versa.

To configure the resolution of the DNS names of Yandex Cloud resources and services in corporate networks:

  1. Get your cloud ready.
  2. Configure your cloud infrastructure.
  3. Configure your corporate network.
  4. Test the integration.

If you no longer need the resources you created, delete them.

Getting started

Sign up for Yandex Cloud and create a billing account:

  1. Navigate to the management console and log in to Yandex Cloud or create a new account.
  2. On the Yandex Cloud Billing page, make sure you have a billing account linked and it has the ACTIVE or TRIAL_ACTIVE status. If you do not have a billing account, create one and link a cloud to it.

If you have an active billing account, you can create or select a folder for your infrastructure on the cloud page.

Learn more about clouds and folders here.

The cost of support for the new infrastructure includes:

Configure your cloud infrastructure

On the Yandex Cloud side, you will create a cloud network with a single subnet, a Managed Service for PostgreSQL cluster with a single host, and an inbound DNS connection.

Create a cloud network

  1. In the management console, select the folder in which you are going to create your cloud infrastructure.
  2. Navigate to Virtual Private Cloud and click Create network.
  3. In the Name field, enter a name for the cloud network: my-vpc-network.
  4. Disable Create subnets.
  5. Click Create network.

Create a subnet

  1. In the management console, select the folder where you are deploying your infrastructure.
  2. Navigate to Virtual Private Cloud.
  3. In the left-hand panel, select  Subnets and click Create subnet.
  4. In the Name field, enter a name for the subnet: subnet2.
  5. In the Availability zone field, select the ru-central1-b availability zone.
  6. In the Network field, select the my-vpc-network cloud network you created earlier.
  7. In the CIDR field, specify the 192.168.1.0/24 subnet CIDR.
  8. Click Create subnet.

Create a Yandex Managed Service for PostgreSQL cluster

  1. In the management console, select the folder where you are deploying your infrastructure.

  2. Navigate to Managed Service for PostgreSQL and click Create cluster.

  3. In the Cluster name field, enter a name for the cluster: my-postgresql-cluster.

  4. Under Database, select Generate in the Password field.

  5. Under Network settings, select the cloud network you created earlier, i.e., my-vpc-network.

  6. Under Hosts, leave one host in the ru-central1-b availability zone.

    To delete hosts you do not need, click next to host and select Delete.

    Tip

    A single host is enough to test the discussed solution.

    In production scenarios, we do not recommend creating a single-host cluster. It is a cheaper option but does not ensure high availability.

  7. Leave all the other parameters unchanged and click Create cluster.

Create an inbound DNS connection

Create an inbound DNS connection through which clients from the corporate network will be able to resolve DNS names in Yandex Cloud internal DNS zones:

  1. In the management console, navigate to the page of the folder you are creating your infrastructure in.

  2. Navigate to Cloud DNS.

  3. In the left-hand panel, select  Inbound endpoints and click Create endpoint. In the window that opens:

    1. In the Name field, specify the name: corp-example-net-inbound.

    2. Under Network settings, select the my-vpc-network cloud network in the Network field.

    3. In the IP address field, click Reserve to reserve a static internal IP address for the new DNS connection. In the window that opens:

      1. In the Name field, specify the reserved address name: corp-example-net-inbound-address.

      2. In the Subnet field, select the subnet named subnet2 to reserve an IP address in.

        Note

        The IP address of the inbound DNS connection can belong to any of the subnets in the cloud network you select. However, you cannot specify IP addresses already used by Yandex Cloud resources.

      3. In the Internal IPv4 address field, specify the 192.168.1.200 IP address (belongs to the address range of subnet2).

      4. Click Create to reserve the address.

  4. Click Create to create an inbound DNS connection.

Configure your corporate network

Configure your corporate network so that DNS requests to Yandex Cloud internal zones are forwarded to the reserved internal IP address (192.168.1.200) assigned to the inbound DNS connection.

For example, you can create a DNS forwarder in the corporate subnet and specify its IP address as the main DNS server address in the network interface settings of the corporate subnet (subnet1) clients. To create DNS forwarders, we recommend you to use CoreDNS or Unbound.

Example of configuring a DNS forwarder

  1. Connect to the host you are going to set up a DNS forwarder on.

  2. Download the latest CoreDNS version from GitHub and install it:

    cd /var/tmp && wget <package_URL> -O - | tar -xz
sudo mv coredns /usr/local/sbin

  3. Create a CoreDNS configuration file:

    sudo mkdir /etc/coredns
sudo tee >> /etc/coredns/Corefile <<EOF
mdb.yandexcloud.net {
  forward . 192.168.1.200
}
. {
  forward . <main_DNS_server_IP_address_in_corporate_subnet>
}
EOF

  4. Enable running CoreDNS at boot:

    sudo tee >> /etc/systemd/system/coredns.service <<EOF
[Unit]
Description=CoreDNS
After=network.target

[Service]
User=root
ExecStart=/usr/local/sbin/coredns -conf /etc/coredns/Corefile
StandardOutput=append:/var/log/coredns.log
StandardError=append:/var/log/coredns.log
RestartSec=5
Restart=always

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl enable --now coredns

  5. Disable system DNS resolution to delegate it to the local DNS forwarder. For example, in Linux Ubuntu 20.04, you can use these commands:

    sudo systemctl disable --now systemd-resolved
rm /etc/resolv.conf
echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf

  1. Connect to the host you are going to set up a DNS forwarder on.

  2. Install the unbound package (example for Linux Ubuntu):

    sudo apt update && sudo apt install --yes unbound

  3. Create a unbound configuration file:

    sudo tee -a /etc/unbound/unbound.conf <<EOF
server:
  module-config: "iterator"
  interface: 0.0.0.0
  access-control: 127.0.0.0/8   allow
  access-control: 192.168.0.0/21 allow

forward-zone:
  name: "mdb.yandexcloud.net"
  forward-addr: 192.168.1.200

forward-zone:
  name: "."
  forward-addr: <main_DNS_server_IP_address_in_corporate_subnet>
EOF

  4. Restart Unbound:

    sudo systemctl restart unbound

  5. Disable system DNS resolution to delegate it to the local DNS forwarder. For example, in Linux Ubuntu 20.04, you can use these commands:

    sudo systemctl disable --now systemd-resolved
rm /etc/resolv.conf
echo "nameserver 127.0.0.1" | sudo tee /etc/resolv.conf

Test the integration

  1. Get the FQDN of the my-postgresql-cluster host you created earlier.

    To learn how to get a host FQDN, see FQDNs of PostgreSQL hosts.

  2. Make sure a corporate network computer can resolve names in a Yandex Cloud internal DNS zone (mdb.yandexcloud.net). Do it by executing a command with the cluster host FQDN specified.

    Here is an example:

    host rc1d-oсfgp28n0k358fj1.mdb.yandexcloud.net

    Result:

    rc1d-oсfgp28n0k358fj1.mdb.yandexcloud.net has address 192.168.1.20

  3. Make sure a corporate network computer can resolve names in public zones, for example:

    host cisco.com

    Result:

    cisco.com has address 72.163.4.185
...

How to delete the resources you created

To stop paying for the resources:

The naming requirements are as follows:

  • Length: between 3 and 63 characters.
  • It can only contain lowercase Latin letters, numbers, and hyphens.
  • It must start with a letter and cannot end with a hyphen.

A DNS forwarder is a special DNS server which forwards DNS requests differently depending on the domain name specified in the request.

Previous
Migrating DNS zones from Yandex 360
Next
Integrating Managed Service for Kubernetes with a corporate DNS zone